Deleting Snapshots.

[zoltron]

I just starting to enter the realm of using snapshots after having to restore from a offline back following a ransomware attack.

My question is, 12 months down the line if I need to delete all snapshots, as a broad example would it delete data from the drive which was subsequently added since snapshots were created?

Also when a snapshot is deleted does it free up the data being used by that snapshot?

I know it sounds like a noob question, but I have only just moved over from XigmaNAS and are still finding my way.

Also is there any advice anyone could give to prevent further ransomware breaches? I've done the obvious such as using snapshots, but have also enabled 2FA, disabled all services not being used including SSH.

Any help would be appreciated.

 

[winnielinnie]

My question is, 12 months down the line if I need to delete all snapshots, as a broad example would it delete data from the drive which was subsequently added since snapshots were created?

No. The data on the live filesystem (dataset) will not be affected by destroying all of the dataset's snapshots. It means that the only data that will remain is that which lives on the live filesystem. (Any "deleted" records that only existed because they still had snapshots pointing to them will be gone forever. If you suddenly remember "Doh! That one snapshot I had contained a previously deleted file which I now realize was important!" Too bad, whoops! It's gone forever.)

Also when a snapshot is deleted does it free up the data being used by that snapshot?

The only space you will liberate are records that exclusively belong to that snapshot. Otherwise, you won't free up such space until all snapshots (that point to the records in question) are likewise destroyed.

See this post for a graphical representation. (I realize I should have added a fourth "color" to represent the "live filesystem".)

Also is there any advice anyone could give to prevent further ransomware breaches?

Malicious access to your server negates any ransomware protection. Keep this in mind. While your Windows PC (which accesses your NAS's SMB shares and/or makes backups to your NAS) is the most vulnerable to ransomware attacks, you can't rely on snapshots themselves to protect your data if someone has physical access to your server, or you experience a hardware failure., and so on.

 

[Butrarstabor]

When you delete a snapshot, it only deletes the data that was stored in that particular snapshot, which means that any data that was added to the drive after the snapshot was created will not be affected. So, if you delete all the snapshots, it won't delete any data from the drive that was added since the snapshots were created.