Date: Thu, 9 Jun 2011 14:57:15 -0700 From: Artem Belevich <art@freebsd.org> To: Greg Bonett <greg@bonett.org> Cc: "stable@freebsd.org" <stable@freebsd.org> Subject: Re: recover file from destroyed zfs snapshot - is it possible? Message-ID: <BANLkTinTEazsjP=hW=8OA2ECaumO5kNQkA@mail.gmail.com> In-Reply-To: <1307649610.2135.29.camel@ubuntu> References: <1307649610.2135.29.camel@ubuntu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jun 9, 2011 at 1:00 PM, Greg Bonett <greg@bonett.org> wrote: > Hi all, > I know this is a long shot, but I figure it's worth asking. Is there > anyway to recover a file from a zfs snapshot which was destroyed? I know > the name of the file and a unique string that should be in it. The zfs > pool is on geli devices so I can't dd the raw device and look for it. > Any suggestions? > > Thanks for the help. Theoretically it may be possible. Practically it will not be trivial. ZFS state at any given point in time is determined by it's uberblock. ZFS keeps number of previous uberblocks (and thus -- ZFS states). If you're familiar with ZDB and with ZFS filesystem layout, you may be able to use information in the last saved uberblock before the snapshot was nuked and, with some luck, would be able to find the data tat was in your file. That, however, relies on an optimistic assumption that a) such uberblock is still around and, b) appropriate disk blocks have not been reused by more recent transactions.I believe recent ZFS versions (v28 should qualify) make an effort to keep recent transaction groups in consistent state to improve chances of recovery with "zpool import -F" in case disks lied about cache flushes. In case you do want to dig in, ZFS on-disk data structures are documented here: http://opensolaris.org/os/community/zfs/docs/ondiskformat0822.pdf This script (WARNING -- DESCTRUCTIVE) should allow you to roll back ZFS state to an earlier point in time on single-device pools: http://www.solarisinternals.com/wiki/index.php/ZFS_forensics_scrollback_script Good luck. --Artem P.S. You wouldn't happen to have backup of your file, would you? That would make things so much easier. :-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BANLkTinTEazsjP=hW=8OA2ECaumO5kNQkA>