Restoring from a Snapshot on ZFS
If you find that you have mistakenly deleted a file and it was created/written to before the last snapshot. You can restore the file by going to the directory where the file was and changing into the .zfs/snapshot directory at the base of NFS file system mount. You can then use a normal copy operation to copy it back to the directory where you would like it. Please note that the .zfs directory is hidden and may not appear when you do a directory listing.
 - If a file was created or modified after the last snapshot then you can potentially lose up to 4 hours of work in a worse case scenario. Please make sure you save your work throughout the day.
[derek@chimerasub00 ~]$ ls f90 gpucomputingsdk_3.2.16_linux.run NVIDIA_GPU_Computing_SDK
I now remove the gpucomputingsdk_3.2.16_linux.run file.
[derek@chimerasub00 ~]$ rm gpucomputingsdk_3.2.16_linux.run
It is now gone.
[derek@chimerasub00 ~]$ ls f90 NVIDIA_GPU_Computing_SDK
Find out what file system you are in and then cd to the base file system, in this case /chimerahomes/derek.
[derek@chimerasub00 ~]$ df . Filesystem 1K-blocks Used Available Use% Mounted on chimeranexenta01:/volumes/zvol01/chimerahomes/derek 10485760 1680384 8805376 17% /chimerahomes/derek [derek@chimerasub00 ~]$ cd /chimerahomes/derek
I can change my directory into the .zfs/snapshot directory.
[derek@chimerasub00 ~]$ cd .zfs/snapshot/
Doing a directory listing will show all the snapshots available.
[derek@chimerasub00 snapshot]$ ls snap-daily-1-2011-06-20-0300 snap-hourly-4-2011-06-23-0800 snap-daily-1-2011-06-21-0300 snap-hourly-4-2011-06-23-1200 snap-daily-1-2011-06-22-0300 snap-hourly-4-2011-06-23-1600 snap-daily-1-2011-06-23-0300 snap-hourly-4-2011-06-23-2000 snap-daily-1-latest snap-hourly-4-latest snap-hourly-4-2011-06-22-2000 snap-weekly-1-2011-04-30-0300 snap-hourly-4-2011-06-23-0000 snap-weekly-1-latest snap-hourly-4-2011-06-23-0400
I choose the snap-hourly-4-latest directory and change directory into it.
[derek@chimerasub00 snapshot]$ cd snap-hourly-4-latest/
This directory is exactly like the volume when the snapshot was taken, you may need to continue to change directories until you get to the level of the file you need to restore.
[derek@chimerasub00 snap-hourly-4-latest]$ ls f90 gpucomputingsdk_3.2.16_linux.run NVIDIA_GPU_Computing_SDK
I can now copy the file back into place.
[derek@chimerasub00 snap-hourly-4-latest]$ cp gpucomputingsdk_3.2.16_linux.run ~
And now it is back.
[derek@chimerasub00 snap-hourly-4-latest]$ cd ~ [derek@chimerasub00 ~]$ ls f90 gpucomputingsdk_3.2.16_linux.run NVIDIA_GPU_Computing_SDK
ZFS Snapshots and Space Accounting
Due to the way ZFS does space accounting, data that has been rm'd from the volume but is still held in snapshots is counted against the "size" of the volume. In other words:
[volume quota] - [space occupied by snapshots] = ["size" as reported by df]
Instead of relying on the size of the volume as reported by df, you should note the "available" value reported by df. This value accurately represents the amount of space currently available for use in the volume. The snapshots eventually expire over the course of several days and the space becomes usable again.