how to restore deleted files

[varcal]

is there a way to restore deleted files in FreeNAS there are data files I had and I went to move them and now they are gone some how so I wanted to know if there is a way to bring them back
I found testdisk but it is not on FreeNAS is there a way to you that or something else
thank you

 

[joeschmuck]

Some folks have been able to restore files that were deleted but it takes a great deal of work. Search the internet for something like "freenas file recovery" and you are likely going to be reading a lot before you find someone who lists a tool they used that worked for them. My advice, turn off your system because any write operation you perform is likely to overwrite your deleted data.

Good Luck, you will need it. If you find a solution, maybe share it in detail and we can write a Resource Document to help others coming after you.

 

[kdragon75]

is there a way to restore deleted files in FreeNAS there are data files I had and I went to move them and now they are gone some how so I wanted to know if there is a way to bring them back
I found testdisk but it is not on FreeNAS is there a way to you that or something else
thank you

Do you have automatic snapshots setup? If not, odds are no.

 

[varcal]

I had a snap shot back in October but I do not know if it has what I need it was when I put in the new drive and I do not know how to retrieve the files

also is there a way I can plug that drive into windows on a usb and have windows see that drive and use a recovery program on windows

or I also read about testdisk can I use that on FreeNAS and if so how do I install it

 

[Apollo]

is there a way to restore deleted files in FreeNAS there are data files I had and I went to move them and now they are gone some how so I wanted to know if there is a way to bring them back
I found testdisk but it is not on FreeNAS is there a way to you that or something else
thank you

October is really old for snapshots.
If those files where present at the time of your last snapshot, then you should be able to see what appened to them using the following command:

zfs diff pool@last-snapshot

You can also do the same from the very first snapshot and it should list all the differences since then.

If you are lucky enough, you might be able to recover some of it by cloning the relevant snapshots to extract the files.

 

[Kevin Horton]

I know it is a bit late now, but I have periodic snapshot tasks set up to protect from mistakes like this. My system takes snapshots every hour, and keeps them for two days. Daily snapshots are kept for 30 days, and two week interval snapshots are kept for a year. This scheme has saved my bacon more than once from either an accidental file deletion, or some major blunder that wreaked havoc on a jail.

 

[blueether]

@varcal, what is the pool layout? You are talking about moving a single disk to windows?

recovery tools will recover files from fzfs disks (well the best tools), the problem is that zfs is almost never on a single disk and that is what they access. I believe photorec may work on ZFS if ZFS is on a single disk.

If the file has only just gone and there are only very few transactions on the pool the you could look at zpool imort -T http://www.c0t0d0s0.org/archives/7621-Back-in-time-or-zpool-import-T.html

 

[AlexGG]

I believe photorec may work on ZFS if ZFS is on a single disk.

Nope, photorec does not work on anything which has compression and/or variable block size, even with a single disk.

 

[blueether]

Nope, photorec does not work on anything which has compression and/or variable block size, even with a single disk.

Hate to be that guy, but there are a few reports of it working to some extent...

 

[AlexGG]

there are a few reports of it working to some extent...

Yes, it will work to some extent. Some files can't be compressed. In JPEG, for example, image data can't be compressed, but EXIF metadata can be. So, the file happens to be small and not have enough metadata to gain at least one block in compression, the entire file is stored uncompressed and can be recovered. If whatever produced JPEGs happens to had settings to produce less EXIF, the entire set may be recoverable. There are other examples (notably including document formats which are internally ZIP), but in general case the results are not really useful.