FreeNAS 8.2.0 Undelete File

[osobh]

I have the following setup FreeNAS-8.2.0-RC1-x64 (r11876)

and created a volume called backup. I exported this volume via NFS for use with my virtualized servers. This morning I accidentally deleted a critical VM image being served via this NFS share. Nothing has been written to disk since this morning. I did make a snapshot after the fact but not sure what that will do.

1) Is it possible to scan the RAID-Z pool for the file in question and restore this?

2) Are there any tools that will help accomplish this?

 

[cyberjock]

I don't think there's much of a chance of undeleting your file. That's why backups are so great :P

After all, what would happen if your zpool failed?

 

[osobh]

After much reading it seems that the data will never be overwritten, and since I haven't touched the zpool since this happened, i feel like the file I need should still be on disk. Since this is zfs it's quite difficult to understand what happens on the block level during a delete operation. Since I did this over NFS, Does it wipe the blocks completely or something else? Would it be possible to run any forensics tools on a dataset and recover anything?

 

[Stephens]

A snapshot after the fact does nothing to help you. Also I'm not sure how that's consistent with the statement that you haven't touched the pool since the delete.

Anyway, there's no upside to hiding the tools for ZFS file recovery. The likely answer is they don't exist, which is why Google turns up no results. Coming from a Windows world where there are seemingly 1001 ways to recover a deleted file (and sometimes even recover from Format and FDISK), it can be a bitter pill to realize such recovery tools don't exist (or even make sense) on other platforms.

Is it possible to recover? Well, it's a computer. Sure it's possible. But is it feasbile? How much time do you have to recover the image before it becomes a non-issue? How much money can you spend to recover it? Recovering a file that isn't overwritten from a NTFS partition is one thing, but recovering a file that has been broken into parts spread across multiple discs, one of which may contain nothing more than parity information, is a completely different ballgame.

I know the low level for mat for FAT16/FAT32 and NTFS, so I get how undelete works there. ZFS? Not so much. However, it IS open source and there are people who've done some reverse engineering in that area. But I'm afraid if you're looking for a readily available solution that you can use in any reasonable timeframe, the odds aren't good. You're not the first person to want to recover accidentally deleted data, and every person I've seen has received the advice to restore from backups -- usually followed by the question, "You do have backups, right?" Optionally followed by the reminder that RAID isn't backup.

 

[osobh]

I can get on the FreeNAS shell, would it be possible to dd the pool to a seperate disk or file for analysis later on?

 

[ben]

dd the whole pool, disk for disk, bit for bit? I guess it could be done, but I don't know if it would work and you're adding another variable to the equation.