ZFS dataset restoring

Question

I have suddenly removed my ZFS dataset from ZFS pool. I do this from GUI of Nas4Free. In logs it was command something like "ZFS destroy Main/Video". Then i recreate dataset with same name (Main/Video) and now all data, which was in this dataset is gone. Is it possible to restore information from deleted dataset or dataset itself? I have set up daily snapshots, but, as i understand, they are stored inside dataset, so i cannot access them without restoring it's dataset.

Answer 1

Depending on how long was you pool kept online after the mistake and also how busy was the pool during this period, it might be possible to rollback it to a previous transaction group (i.e. use an older uberblock) where the file system was still present.

Here is a script that takes that approach:

http://www.solarisinternals.com/wiki/index.php/ZFS_forensics_scrollback_script

You should work on a copy of your disk(s) as the recovery attempt is destructive.

Answer 2

The “rollback to an earlier txg” answer is a good one if you can handle putting the pool back into an earlier state while also corrupting some small amount of data across the whole zpool and reverting all other changes to the zpool back to an earlier state (eek!). What’s happening when you do that is ZFS swaps an old “uberblock” back to the root of its metadata tree, which points at an old version of the block tree for your zpool. Here’s the catch: if you’ve written data since then, any blocks which were overwritten in your pool would be free space in the newest version’s view, meaning that the data is ~meaningless and it can use the space to store new writes. If that happens, the block will no longer match the checksum stored in the old version of the block tree, which causes a corruption. This can happen to anything in the same zpool which has been overwritten, both for file data blocks as well as filesystem metadata, the latter being less likely because most pools are configured to create two copies of metadata blocks.

There is a way to do this safely with no corruptions, however you need to plan for it in advance. Before deleting your filesystem / zvol, run zpool checkpoint — this gives essentially the same functionality as resetting to an earlier uberblock, except is guaranteed not to corrupt modified data, and provides a far superior UI where you can’t break stuff by accident. The author of this feature wrote a good description of how to use it here.