How to recover a lost file


All Panix accounts include storage space for home, mail, and web directories on a Network Appliance (NetApp) RAID server. This server makes it possible to restore files that would otherwise be irretrievable.

The RAID takes "snapshots" of your files at 8am, noon, 4pm, 8pm, midnight. We generally hold on to four "hourly" snapshots and two "nightly" ones (more or fewer as space permits). The snapshots of data in your home directory or web space are separate from those on the mail server.

Files in your home directory or web space

You can access these through an invisible directory called .snapshot (which won't show up even if you do ls -a ; you have to name it explicitly). In this directory you'll find some or all of the following subdirectories, and maybe others:

Each of these holds the snapshot of the complete directory from the appropriate time.

If you run the snapshot command from the shell, you'll get a list of snapshot directories that contain that file:

mc on panix2 in ~> snapshot myfile
Target directory: /users/somebody
Target filename: myfile

The following snapshots have been found that contain
backup copies of the directory/file specified:

1: Apr 22 20:00 /users//somebody/.snapshot/hourly.0  
2: Apr 22 16:00 /users//somebody/.snapshot/hourly.1  
3: Apr 22 12:00 /users//somebody/.snapshot/hourly.2  
4: Apr 22 08:00 /users//somebody/.snapshot/hourly.3  
5: Apr 21 20:00 /users//somebody/.snapshot/hourly.4  
6: Apr 21 16:00 /users//somebody/.snapshot/hourly.5  
7: Apr 23 00:00 /users//somebody/.snapshot/nightly.0  
8: Apr 22 00:00 /users//somebody/.snapshot/nightly.1  

Please enter the number of the directory you would like to examine,
or type a blank return to quit.

Once you've figured out which one you want, you'll need to do the actual restore.

Files on the mail server

Inboxes under the current mail system are no longer a single file. An explanation of how the mail system works, and what you should look for when restoring files, is available at "New Mail System: The Technical Side."

Also, because your mail is on a different file server, the snapshots are set up differently. To find snapshots of your mail, use the snapshot command from the shell prompt. You'll see something like this:

> snapshot .maildir
Target directory: /net/mail/spool/panix/4/7/mctest@panix.com//
Target filename: 

The following snapshots have been found that contain
backup copies of the directory/file specified:

1: Jun 6 2007 /net/mail/spool/panix/.zfs/snapshot/2009-04-22-0800.hourly  
2: Jun 6 2007 /net/mail/spool/panix/.zfs/snapshot/2009-04-22-1200.hourly  
3: Jun 6 2007 /net/mail/spool/panix/.zfs/snapshot/2009-04-22-1600.hourly  
4: Jun 6 2007 /net/mail/spool/panix/.zfs/snapshot/2009-04-22-2000.hourly  
5: Jun 6 2007 /net/mail/spool/panix/.zfs/snapshot/2009-04-23-0000.nightly  

Please enter the number of the directory you would like to examine,
or type a blank return to quit.

Ignore the date at the left; the information you want is the date that follows "snapshot" in the directory name.

When you look for files on the mail server, you may get a "permission" error. That is a result of permissions on directories above the one you're looking at, and normally does not interfere with the command you're running.

You should bear in mind that the format we use on the mail server stores each message as a separate file with a unique name. You can, therefore, copy (cp) all of the files in a snapshot of "cur" without fear of overwriting your inbox. (Messages that are in the snapshot and also in your inbox will be copied over, but that is not normally a problem.

Once you've figured out which one you want, you'll need to do the actual restore.

Doing the restore

There are only two tricks to recovering your file. The first is to figure out which of the snapshots has the best version for you. The "hourly" and "nightly" versions rotate, so you need to figure out which one has the latest version of the file before it was removed or corrupted. For instance, at 7am, hourly.0 will contain the "8pm yesterday" snapshot; the most recent snapshot is the midnight one, which will be in nightly.0. At 9am, the hourly.0 files will be the 8am snapshot, which is the most recent. Of course, you can just look at the versions in each directory in .snapshot

The second trick is that you want to be careful not to over-write the current version of a file if it contains new data that you want to preserve. That is, suppose the file you want to recover is from your inbox from yesterday afternoon. You probably don't want to lose the mail that has arrived since then. If you just over-write the current file with the old one, you lose the current one. You can avoid this by giving the restored version a new name, or by creating a special directory to receive it.

For people familiar with the UNIX commands "cp" and "mkdir," the instructions above should do the trick. For people who use the menu interface, there is no built-in command to create a directory. Let's say the file you want to restore is "foo" from the hourly.2 snapshot:
Type ! to get to a full shell, and then type

mkdir restore
cp -p .snapshot/hourly.2/foo restore
exit

The -p option to "cp" preserves the time stamp of the original file.

Final notes

Even with this file system, there is no guarantee that the snapshots will have exactly the file you need. If you created a file at 10am and inadvertently deleted it at 11am, it won't have been preserved. But if you created it at 10 and corrupted it a little after noon, you'll have the noon snapshot-- and you can get it yourself, right away, without having to wait for a costly restore from tape.


© Copyright 1999 - 2006 Public Access Networks Corporation
Last modified: Thursday, 23-Apr-2009 06:51:58 EDT
Send suggestions and bug reports to

helpmaster@panix.com

[ Panix Home ] [ UNIX Shell Help Index ]
[ Panix Help System Index ] [ Top of This Page ]