SOLVED Catastrophe! How can I restore from Snapshot??!

[NumberSix]

Hi
Some unknown process has deleted half my data (it may have been the Emby plugin when i asked it to delete a single film, it seems to have wiped the entire Media folder I had). My heart is in my mouth now as protection of my media was the sole reason I invested time in TrueNAS. Can you help me restore it please?

I have looked at this question elsewhere in the forums but they all assume a level of knowledge I don't have. Clone a snapshot? How?? Share the snapshot? How?? One link refered to a manual, but when I followed the link it was dead. I am finding it all quite overwhelming.

Can some saintly guru please save my bacon and spell out for me what i need to do? I DO have a snapshot for that folder dated just 10 days ago and that would be perfectly fine if I can reinstate from there? I am nervous to just go clicking on the 'Rollback' link when I really have never been through this before. Your help and support would be just WONDERFUL if you can talk me through what I should do now.

Thank you.

 

[duderuud]

That should be it. You can also select clone if you have enough free space and want to be cautious .

 

[NumberSix]

Footnote. I followed a Youtube tutorial and managed the clone and share steps, and looked inside the snapshot, only to find it totally EMPTY. How can this be? It was created over 2 weeks before the disaster happened?

 

[winnielinnie]

First thing first, hold the snapshot to prevent its destruction from any pruning / cleanup task. You can repeat this for as many snapshots as you want, but preferably the most recent ones. Perhaps, the six most recent ones, just to be safe. (You can "release" the hold's protection later.)

Code:

zfs hold protect mypool/mydataset@snapshot-DATE

Now, what snapshots do you have for the dataset in question?

Code:

zfs list -t snap -o name,refer,used mypool/mydataset

Finally, and this is important, did you save your media via the jail, within the jail itself? Or did you properly create a mountpoint, which points to an actual dataset outside of the jail?

 

[NumberSix]

Hi
Thank you for trying to help me.
I tried the first zfs command and received the reply "NAS/Media-auto-2023-08-20_00-00 is not a snapshot" so I am doing something wrong already. This may help:

So my command was zfs hold protect NAS/Media-auto-2023-08-20_00-00

Should it include the folder name somewhere, 'Media'?

Also note the size of the 'Used' in the table above is zero. Is that normal? As I said previously, this snapshot is dated more than 2 weeks prior to everything getting deleted.

Thank you for your assistance.

 

[winnielinnie]

I tried the first zfs command

You need to write out the ZFS object in the form of pool/dataset@snapshot

Every symbol is important, including the @ symbol before a snapshot's name.

Also note the size of the 'Used' in the table above is zero. Is that normal? As I said previously, this snapshot is dated more than 2 weeks prior to everything getting deleted.

Let's ignore the "clone" for now, since that wasn't even necessary in the first place. (In fact, I'd delete the clone after you're done with this attempted recovery.)



List the snapshots and their properties:

Code:

zfs list -t snap -o name,refer,used NAS/Media

Then protect a snapshot in the meantime:

Code:

zfs hold protect  NAS/Media@auto-2023-08-20_00-00

Just a heads up: Use an SSH session, as the "Shell" in TrueNAS Core is nearly useless.


EDIT: Fixed a typo in the commands.

 

[NumberSix]

Thank you winnielinnie! I have bizarre good news here. It came from looking at the size of the 'missing' folder in the image I posted above. I couldn't figure out why the Media folder was non-zero in size. Turns out my partner had been messing with it - cloned it to another (encrypted) dataset (as I understand it) and for some reason it showed up on a samba share as accessible but empty. With other encryted shares that I know about, you cannot connect from windows at all until you have unlocked them with a password, but confusingly, this allowed me to look in to an apparently empty folder. I am SO relieved. Although there will be blood to pay around here for this panic!

Incidentally, your support is not in vain. I have learnt how (and why) to protect a snapshot. Surely the first step in securing a recovery from any future catastrophie. Before I sign off and close this thread, may I ask, does the fact that my mounted snapshot (image above) is of zero size mean that it had preserved nothing and wasn't able to give me a restore? I did 'cd' into it via the Shell and it was indeed an empty folder?

Thank you.

 

[winnielinnie]

You're referring to the clone you made?

If you want an accurate display:

Code:

zfs list -o space NAS/Media-auto-2023-08-20_00-00-clone

If you created the clone for this "recovery", but it's not needed, you can destroy it.

 

[NumberSix]

Clone deleted. Thank you again winnielinnie

 

[MrGuvernment]

...sole reason I invested time in TrueNAS

Backups, backups, backups, 3-2-1 rule.. a single TrueNAS systems is not a backup, no matter how you have your system configured and how many drives are in it.

 

[NumberSix]

Unfortunately I don't have the finance for a 2nd Trunas or a backup to my NAS of any other kind. Meanwhile I am striving to understand what level of safety net a snapshot offers.