Linux: Recovering files from /filespace home directories and group shared space.
This document describes how to recover lost or deleted files from /filespace home directories and /groupspace group shared space.
Note that the # character at the beginning of each command line is not part of the command and should not be included in the command.
Background
Traditionaly, when you delete, remove (rm
), rename, or move
(mv
) a file in Unix the operation cannot be undone because of the
way that it modified the underlying filesystem. However, recent volume managers
allow one to take
snapshots
or checkpoints of how a filesystem looked at a given point in time. These can
function as simple file recovery aids, though aren't
suitable for disaster recovery.
Restoring Files from /filespace
or /groupspace
With the /filespace
storage system there are now several levels
of read-only snapshots to choose from. The snapshots are accessible by users in any sub
directory in your home directory or group space by navigating to the hidden
.ckpt
directory. Within this directory are a series of dated
subdirectories that indicate the time the snapshot was taken. These
subdirectories are of the form
YEAR_MONTH_DATE_HOUR.MINUTE.SECOND_TIMEZONE
. You can browse
through each of them at your leisure until you find the appropriate file, then
cp
it back to the original location or a new one.
For example, say one wanted to restore a script called
colortable16.sh
they had been working on in ~/tmp
directory from a couple days ago.
# cd ~/tmp # ls -1a ./ ../ 6200-5400-3500-CLI-k1201-Feb2007.pdf preexec.bash vi3_35_25_u2_admin_guide.pdf
Notice that there is no .ckpt
directory listed, however it is there ...
# cd .ckpt # ls -1a ./ ../ 2009_11_22_00.01.01_America_Chicago/ 2009_11_29_00.01.00_America_Chicago/ 2009_12_06_00.01.01_America_Chicago/ 2009_12_09_00.01.00_America_Chicago/ 2009_12_10_00.01.01_America_Chicago/ 2009_12_11_00.01.01_America_Chicago/ 2009_12_12_00.01.01_America_Chicago/ 2009_12_13_00.01.01_America_Chicago/ 2009_12_14_00.01.01_America_Chicago/ 2009_12_14_12.01.01_America_Chicago/ 2009_12_14_15.01.01_America_Chicago/ 2009_12_14_18.01.01_America_Chicago/ 2009_12_14_21.01.01_America_Chicago/ 2009_12_15_00.01.01_America_Chicago/ 2009_12_15_03.01.02_America_Chicago/ 2009_12_15_06.01.01_America_Chicago/ 2009_12_15_09.01.00_America_Chicago/
Our current snapshot schedule is the following, though it is subject to change:
Every 3 hours for the last day.
Every day at midnight for the past 7 days.
Every Sunday at midnight for the past 4 weeks.
At this point if I know the time I want to recover from I can simply enter the directory and copy it to a new location like so:
# cp 2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/colortable16.sh.restored
However, I could also use the following command to see when it last appeared, and then review from that list:
# find . -name colortable16.sh ./2009_11_22_00.01.01_America_Chicago/colortable16.sh ./2009_11_29_00.01.00_America_Chicago/colortable16.sh ./2009_12_06_00.01.01_America_Chicago/colortable16.sh ./2009_12_09_00.01.00_America_Chicago/colortable16.sh
Now I can review some of the candidates and decide to copy one back to my
~/tmp
directory:
# less ./2009_12_09_00.01.00_America_Chicago/colortable16.sh # less ./2009_12_06_00.01.01_America_Chicago/colortable16.sh # cp ./2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/
Recall that the snapshots under the .ckpt
directories are
read-only, so at this point one can go back to ~/tmp
to begin
working on the file again:
# cd ~/tmp/ # vim colortable16.sh