How to find a deleted file in snapshots ?

[g---man]

First-time poster here.

I have 6-hours snapshot schedule, kept for 30 days. PC is copying data to freenas using rsync with --delete option. Imagine one of the files on the PC got deleted, and rsync deletes it from dataset.

How can i recover it if I don't know when file was deleted ? Brute-force approach would be to clone/mount each and every snapshot, or alternatively try some logic to "half" population of snapshots.

Is there better option? One of commercial products I used in the past had .snapshot directory where you could technically do "find . -name filename"

What is the best way to find deleted file in freenas without spending hours ?

thanks

 

[cyberjock]

Unfortunately there isn't a better option I'm aware of. There is a directory that you can browse to that is kind of like the .snapshot directory you mentioned, but there is *serious* risk of damaging your pool and for that reason it isn't discussed in the manual or in the forums at all. It's a "fubar it and you'll potentially crash the pool" type of thing. :P

 

[fracai]

If you're comfortable with the command line, my preferred method is to connect to the server via SSH and use the "zfs diff <snapshot>" command to determine the most recent snapshot that contains the file.

 

[SirMaster]

Snapshots are stored in poolname/.zfs/snapshot/snapshotname so I would just do a find in there.

I'm curious how reading the read-only snapshot directories could ever damage your pool. I've used the snapshot directories to access old file versions forever without any issues. I have them automatically mounted in my SMB shares when new ones are created.

The documentation talks about using these folders to access snapshots here and it doesn't mention anything about this being dangerous: http://docs.oracle.com/cd/E19253-01/819-5461/6n7ht6r4j/index.html

 

[fracai]

cyberjock has told me that there is a bug that sometimes allows these folders to be writeable. I haven't found any other references to this, but if it's true I'd consider it a reason to stay away.

 

[cyberjock]

Snapshots are stored in poolname/.zfs/snapshot/snapshotname so I would just do a find in there.

I'm curious how reading the read-only snapshot directories could ever damage your pool. I've used the snapshot directories to access old file versions forever without any issues. I have them automatically mounted in my SMB shares when new ones are created.

The documentation talks about using these folders to access snapshots here and it doesn't mention anything about this being dangerous: http://docs.oracle.com/cd/E19253-01/819-5461/6n7ht6r4j/index.html

That is... EXTREMELY dangerous. Do NOT do this if you don't have backups. It can end very badly for you. This is the method I specifically said I would not discuss, and should not be recommended at all.

 

[fracai]

When I search for "zfs snapshot directory" every returned link offers this as a method of accessing snapshot data. Many specifically reference the directories as read-only. None mention any sort of "writeable" bug.

It's a pretty big claim to contend that this activity is dangerous, but it would also be very important to get this information to be well known if it's true.

Do you have any supporting references for this bug?

I'd think this would be a candidate for either removing the feature from FreeNAS or at least opening a ticket to track the behavior.

 

[SirMaster]

cyberjock has told me that there is a bug that sometimes allows these folders to be writeable. I haven't found any other references to this, but if it's true I'd consider it a reason to stay away.

Hmm, I'd definitely be interested in finding out about this bug if anyone has any information and potentially getting it fixed in ZFS on Linux. Then the others could upstream it.

I've been told by the original ZFS creator before in IRC that it was safe to use the .zfs/snapshot folder before ("that's what it's for") so I always have been.

 

[titan_rw]

I've also used the .zfs/snapshot folder structure before to pull out deleted / changed files. Of course I've never tried to write anything there.

I'd also be curious as to what bug it is that affects using the .zfs directories.