6

I have a ZFS volume on a Linux Debian.
A snapshot is took each night on this volume.
For whatever reason, a big file (virtual disk) was deleted several days ago. This file is still in use (by kvm). lsof shows this file as deleted.

If I pause the kvm process, I can recover the deleted file with cp /proc/<pid>/fd/21 myfile.bak and use it in another virtual machine. But I don't need this current file.

I need the 2 days old version of this file.
As this file was deleted several days ago, it is not in the backups.
I think the file is present in the ZFS snapshots, but not sure. I don't see it in /zpool/.zfs/snapshotname/path/to/file

Does anyone knows a way to get a not-really-deleted file from a ZFS snapshot?

Gregory MOUSSAT
  • 1,138

4 Answers4

5

look in /zpool/.zfs/snapshot/$NAMEOFSNAPSHOT/path/to/file

mmusante
  • 835
  • note that the .zfs/snapshot path is mounted on demand and running ls /zpool/.zfs/snapshot may not show the directory – CervEd Sep 27 '21 at 08:24
0

A snapshot is took each night on this volume. [...] I need the 2 days old version of this file. As this file was deleted several days ago, it is not in the backups.

Each snapshot shows the file system at the specified moment in time. Snapshots are read-only, which means no individual files inside a snapshot can be deleted, only the complete snapshot can be destroyed.

If you do nightly snaps at points T-1, T-2, T-3, ... and remove the file itself after point T-3, your snapshots T-1 and T-2 will not have this file anymore (but the others will still have it).

Therefore, your solution is to recover your file from an older snapshot (in your case, the most recent one at which point the real file was not yet deleted), and then optionally compare it with the current version for differences. Of course this works only if the older snapshots are still there.

user121391
  • 1,302
0

Can't recall if it's possible to mount a snapshot.

And you could try using zfs diff to see if the file you're looking for is in a different snapshot.

sleepyweasel
  • 1,013
0

You could also clone the snapshot if you don't want to muck with .zfs. Copy out your files/folders that need recovering, then destroy the clone.

tgunr
  • 101