# Snapshot as Backup-Option for unwanted deletions



## bsus (Jul 26, 2011)

Hi,
I want to ask if it is safe to use ZFS-Snapshots to provide accidently deletions.

Following situation:
There some stupid sectarian working with important files. One of them has selected a folder and accidentally deleted some files.
Is it recommand to use the ZFS snapshot function to avoid this issue?

Regards, bsus


----------



## jalla (Jul 26, 2011)

Yes


----------



## fonz (Jul 26, 2011)

I sincerely apologise for the uselessness of this reply, but I *have* to ask...



			
				bsus said:
			
		

> to provide accidently deletions.


Providing accidental deletions? Who are you, the BOFH? :e

Fonz (couldn't help myself, sorry)


----------



## bsus (Jul 26, 2011)

Hmm, I could believe that the time comes where I press blind the wrong button.
Instead of Paste Delete, or I slid the wrong menue entry while I want to copy something.

I am sure that this isn't impossible 

Are there some more detailed informations how the snapshot works.
I can't beleave that this is so safe because the image is just virtualy and when I delete something it is gone even zfs doesn't overwrite this directly with zeros but by the next bigger copy-procedure should then overwrite the free given space where my deleted file could be or not?


----------



## gkontos (Jul 26, 2011)

bsus said:
			
		

> Hi,
> I want to ask if it is safe to use ZFS-Snapshots to provide accidently deletions.
> 
> Following situation:
> ...



Actually this is the most bulletproof solution. You can also script hourly - daily snapshots so that you can prevent accidental data loss.


----------



## kpa (Jul 26, 2011)

sysutils/zfsnap


----------



## gkontos (Jul 26, 2011)

bsus said:
			
		

> I can't beleave that this is so safe because the image is just virtualy and when I delete something it is gone even zfs doesn't overwrite this directly with zeros but by the next bigger copy-procedure should then overwrite the free given space where my deleted file could be or not?


ZFS uses COW (copy on write) to write data to your disks. Practically this means that even if you delete a file, ZFS will not overwrite to that location. This of course can cause fragmentation in the long term.
But the bottom line is that snapshots are the safest way to protect your data.


----------



## rusty (Jul 27, 2011)

This screencast about OpenSolaris' Timeslider gives a decent view of how ZFS snapshots work
http://www.dailymotion.com/video/x7oe8l_time-slider-screencast_tech


----------



## Sebulon (Jul 27, 2011)

Provided that you design your ZFS-filesystem to only rollback the affected data, e.g.

```
NAME                          MOUNTPOINT
pool/root                     /
pool/root/home                /home
pool/root/home/secretary1     /home/secretary1
pool/root/home/secretary2     /home/secretary2
pool/root/home/secretary3     /home/secretary3
```


But if you rollback home and it looks like this:

```
NAME                          MOUNTPOINT
pool/root                     /
pool/root/home                /home
```
You will rollback the homes of all secretaries. So if you have 3000 secretaries(users), you reset data for all 3000. So you will need to create zfs-filesystems for each user if you want to do it like that.

/Sebulon


----------



## carlton_draught (Jul 27, 2011)

Sebulon said:
			
		

> You will rollback the homes of all secretaries. So if you have 3000 secretaries(users), you reset data for all 3000. So you will need to create zfs-filesystems for each user if you want to do it like that.


It's not necessary to rollback a filesystem to recover data. Provided you know which files have changed, you can just copy the actual file(s) from the .zfs directory and overwrite the current one.


----------



## Sebulon (Jul 27, 2011)

@carlton_draught

That definitely depends on the size. It is awesome to have users themselves restoring lost data through e.g. Previous Versions, since most restores are only a couple of MBÂ´s, perhaps even half of that. That is the amount of data you can expect a user to restore, but if you, as an administrator is going to restore GBÂ´s or even TBÂ´s with copy/replace over a network, I promise you, you will wish you could do a rollback instead.

/Sebulon


----------



## bsus (Jul 27, 2011)

Hmm ok, I think my actuak solution is not so good.
Actually I got a RAID6 with 6TB (5x 2TB). There two main Users:
1. One with much office files /home-dir keps about 4GB
2. Me much Film-Data, Images, very Big files not much small files - about 1,4TB

2. thinks he could renounce on snapshots.

Also the RAID6 exists out of the bad WD Caviar Green-Series

Is there a much better way?

Thanks for the help, Regards


----------



## carlton_draught (Jul 27, 2011)

Sebulon said:
			
		

> @carlton_draught
> 
> That definitely depends on the size. It is awesome to have users themselves restoring lost data through e.g. Previous Versions, since most restores are only a couple of MBÂ´s, perhaps even half of that. That is the amount of data you can expect a user to restore, but if you, as an administrator is going to restore GBÂ´s or even TBÂ´s with copy/replace over a network, I promise you, you will wish you could do a rollback instead.
> 
> /Sebulon


I'm sure the rollback is quicker. The problem with rollbacks is that the filesystem is brought back to the state of the snapshot you are restoring to, and all intermediate snapshots must be destroyed. Fine if the delete/modification was the last change the user made. Not fine if the user made the change and then has proceeded to make other useful changes in the meantime before discovering the disaster. Rollback is a blunt tool.


----------



## Sebulon (Jul 27, 2011)

@ carlton_draught

You have a good point. That is very important to keep in mind when choosing method. Rollback is quick but blunt.

/Sebulon


----------



## bsus (Jul 28, 2011)

Hi,
1. What is the best way to make Snapshots of /home/<user> but not of /home/j?
2. In the man of zfs I read about the rollback command in relation to the snapshot.
Does this mean that when I want to recover a "missing" or "older" file I have to take the whole /home directory to this state???

Regards


----------

