File Recovery

Introduction

WPI uses a Network Appliance F740 file server to provide NFS to CCC UNIX machines. This server has a feature known as snapshots which allows for online file recovery of recently changed or deleted files. This document will show you how this mechanism works and how to use it.

How does it work?

The Network Appliance File server ("the NetApp") uses a custom file system which provides for the creation of snapshots at specified intervals. For more technical information on their implementation, you can read the technical report.

From a user's point of view, at regular intervals, the NetApp "takes a snapshot" of the current file system. This snapshot looks like a read-only copy of the file system at that point. There are hidden snapshot directories in every directory, including each user home directory.

The snapshot mechanism is independent of our normal tape backup mechanism.

How often do snapshots get taken and how long do they last?

During the day, snapshots on our /home file system happen at:

9:00 AM
noon
3:00 PM
6:00 PM
9:00 PM
3:00 AM

In addition to this, a "nightly" snapshot is taken at midnight every day, and a "weekly" snapshot is made on Sunday at midnight every week.

At any time, these snapshots should be available:

six snapshots during the day
seven daily snapshots
two weekly snapshot

How do I use this feature?

There are two easy ways to use snapshot: via a Unix shell or via Windows

Steps for Using Snapshot via Unix

Suppose you have deleted a file in your "mail" directory and you want to restore it.

Step 1: Change to the .snapshot directory

In the directory where you lost your file, there is a hidden .snapshot directory. This directory does not appear to ls or any other command unless you explicitly request it. You should cd .snapshot, even though it is not visible:

[~/mail] > cd .snapshot

Once in this directory, you will see several other directories, each representing a snapshot. The flags to the ls command are l (for long detail info) d (to show the directory, not its contents) t (to order by time) and u (to show the time on the directory):

[~/mail/.snapshot] > ls -ldtu
total 76
drwx------  2 generic 1089 4096 Nov 26 09:00 hourly.0/
drwx------  2 generic 1089 4096 Nov 26 03:00 hourly.1/
drwx------  2 generic 1089 4096 Nov 26 00:00 nightly.0/
drwx------  2 generic 1089 4096 Nov 25 21:00 hourly.2/
drwx------  2 generic 1089 4096 Nov 25 18:00 hourly.3/
drwx------  2 generic 1089 4096 Nov 25 15:00 hourly.4/
drwx------  2 generic 1089 4096 Nov 25 12:00 hourly.5/
drwx------  2 generic 1089 4096 Nov 25 00:00 nightly.1/
drwx------  2 generic 1089 4096 Nov 24 00:00 weekly.0/
drwx------  2 generic 1089 4096 Nov 23 00:00 nightly.2/
drwx------  2 generic 1089 4096 Nov 22 00:00 nightly.3/
drwx------  2 generic 1089 4096 Nov 21 00:00 nightly.4/
drwx------  2 generic 1089 4096 Nov 20 00:00 nightly.5/
drwx------  2 generic 1089 4096 Nov 19 00:00 nightly.6/
drwx------  2 generic 1089 4096 Nov 17 00:00 weekly.1/

Step 2: Find the version of the file you need

The easiest way to find the file you need is to use something like "ls -lt */filename" from within this directory. For instance, if I wanted to locate possible copies of the file saved-messages:

[~/mail/.snapshot] > ls -l */saved-messages
-rw-------   1 generic  1089         878 Aug  1  1999 hourly.4/saved-messages
-rw-------   1 generic  1089        3423 Aug  1  1999 hourly.5/saved-messages
-rw-------   1 generic  1089        3423 Aug  1  1999 hourly.6/saved-messages
-rw-------   1 generic  1089        1411 Jul 31  1999 nightly.0/saved-messages
-rw-------   1 generic  1089        1411 Jul 31  1999 nightly.1/saved-messages
-rw-------   1 generic  1089        1411 Jul 31  1999 nightly.2/saved-messages
-rw-------   1 generic  1089        1222 Jul 23  1999 nightly.3/saved-messages
-rw-------   1 generic  1089        1222 Jul 23  1999 nightly.4/saved-messages
-rw-------   1 generic  1089        1222 Jul 23  1999 nightly.5/saved-messages
-rw-------   1 generic  1089        1222 Jul 23  1999 nightly.6/saved-messages
-rw-------   1 generic  1089        1222 Jul 23  1999 weekly.1/saved-messages

This shows that there are twelve copies of the file available and, observing their dates and sizes, that there are five different versions.

Step 3: Copy the file you need back to the active file system

One can use the standard cp command:

[~/mail/.snapshot] > cp hourly.4/saved-messages ../saved-messages.new

Notice that the above file was copied from the snapshot to a different name than the original. This is important when you are retrieving an old version of a file if the original version still exists in the active file system. cp will not overwrite files with the same name as snapshot copies.

Also note that cp was used, and not mv, since data in .snapshot is always read-only, so it cannot be moved out of that directory.

That's the whole file recovery process!

Steps for Using Snapshot via Windows

Step 1: Navigate to the folder that the item was in

Step 2: In the address bar, add /~snapshot after the folder address

This will show you the backups for that folder. Choose the most recent backup that contains the file. (Hourly.0 is usually the most recent backup, with Hourly.1 being the next most recent, and so on.)

Step 3: Right-click on the file and choose Copy

Step 4: Navigate back to the original folder and choose Paste to restore the file

Note: If you can not find something using this mechanism, please contact the Helpdesk with the path of the file(s) and when it was deleted or otherwise lost. We will attempt to restore this file for you using our normal tape backup system. Please keep in mind, however, that the tape backups are only performed on a monthly basis, as we mainly rely upon the .snapshot data.

Other useful snapshot information

Here are a few other useful pieces of information about snapshots:

Files found in .snapshot do not count against your quota.
The .snapshot directory in your home directory or at the top of the mounted file systems offers another way to get to snapshot files. For instance, ~/.snapshot/hourly.0/dir/dir/file is the same as ~/dir/dir/.snapshot/hourly.0/file.

For further information

If you still have questions about snapshots after reading this document, please contact the Helpdesk. We hope you enjoy this useful facility.

Maintained by itweb.
Last modified: Nov 26, 2008, 09:18 EST