How to recover a lost file


All Panix accounts include storage space for home and web directories on a Network Appliance (NetApp) RAID server. This server makes it possible to restore files that would otherwise be irretrievable.

The RAID takes "snapshots" of your files at 8am, noon, 4pm, 8pm, midnight. We generally hold on to four "hourly" snapshots and two "nightly" ones-- more or fewer as space permits. You can access these through an invisible directory called .snapshot (which won't show up even if you do ls -a ; you have to name it explicitly unless you happen to be in the mount point for the file system, as in /net/local). In this directory you'll find some or all of the following subdirectories, and maybe others:

hourly.0
hourly.1
hourly.2
hourly.3
nightly.0
nightly.1
Each of these holds the snapshot of the complete directory from the appropriate time.

One note: Even with this file system, there is no guarantee that the snapshots will have exactly the file you need. If you created a file at 10am and inadvertently deleted it at 11am, it won't have been preserved. But if you created it at 10 and corrupted it a little after noon, you'll have the noon snapshot-- and you can get it yourself, right away, without having to wait for a costly restore from tape.

There are only two tricks to recovering your file. The first is to figure out which of the snapshots has the best version for you. The "hourly" and "nightly" versions rotate, so you need to figure out which one has the latest version of the file before it was removed or corrupted. For instance, at 7am, hourly.0 will contain the "8pm yesterday" snapshot; the most recent snapshot is the midnight one, which will be in nightly.0. At 9am, the hourly.0 files will be the 8am snapshot, which is the most recent. Of course, you can just look at the versions in each directory in .snapshot

For help in locating the snapshot you want, you can use the "snapshot" command (/usr/local/bin/snapshot). Try man snapshot for more information.

The second trick is that you want to be careful not to over-write the current version of a file if it contains new data that you want to preserve. That is, suppose the file you want to recover is from your inbox from yesterday afternoon. You probably don't want to lose the mail that has arrived since then. If you just over-write the current file with the old one, you lose the current one. You can avoid this by giving the restored version a new name, or by creating a special directory to receive it.

Inboxes under the current mail system are no longer a single file. An explanation of how the mail system works, and what you should look for when restoring files, is available at "New Mail System: The Technical Side."

For people familiar with the UNIX commands "cp" and "mkdir," the instructions above should do the trick. For people who use the menu interface, there is no built-in command to create a directory. Let's say the file you want to restore is "foo" from the hourly.2 snapshot:
Type ! to get to a full shell, and then type
mkdir restore
cp -p .snapshot/hourly.2/foo restore
exit

The -p option to "cp" preserves the time stamp of the original file.


© Copyright 1999 - 2006 Public Access Networks Corporation
Last modified: Wednesday, 21-Jun-2006 11:25:17 EDT
Send suggestions and bug reports to

helpmaster@panix.com

[ Panix Home ] [ UNIX Shell Help Index ]
[ Panix Help System Index ] [ Top of This Page ]