Linux: Recovering files from /filespace home directories and group shared space.

Note that the # character at the beginning of each command line is not part of the command and should not be included in the command.

Background

Traditionaly, when you delete, remove (rm), rename, or move (mv) a file in Unix the operation cannot be undone because of the way that it modified the underlying filesystem. However, recent volume managers allow one to take snapshots or checkpoints of how a filesystem looked at a given point in time. These can function as simple file recovery aids, though aren't suitable for disaster recovery.

Restoring Files from /filespace or /groupspace

With the /filespace storage system there are now several levels of read-only snapshots to choose from. The snapshots are accessible by users in any sub directory in your home directory or group space by navigating to the hidden .ckpt directory. Within this directory are a series of dated subdirectories that indicate the time the snapshot was taken. These subdirectories are of the form YEAR_MONTH_DATE_HOUR.MINUTE.SECOND_TIMEZONE. You can browse through each of them at your leisure until you find the appropriate file, then cp it back to the original location or a new one.

For example, say one wanted to restore a script called colortable16.sh they had been working on in ~/tmp directory from a couple days ago.

# cd ~/tmp
# ls -1a
./
../
6200-5400-3500-CLI-k1201-Feb2007.pdf
preexec.bash
vi3_35_25_u2_admin_guide.pdf

Notice that there is no .ckpt directory listed, however it is there ...

# cd .ckpt 
# ls -1a
./
../
2009_11_22_00.01.01_America_Chicago/
2009_11_29_00.01.00_America_Chicago/
2009_12_06_00.01.01_America_Chicago/
2009_12_09_00.01.00_America_Chicago/
2009_12_10_00.01.01_America_Chicago/
2009_12_11_00.01.01_America_Chicago/
2009_12_12_00.01.01_America_Chicago/
2009_12_13_00.01.01_America_Chicago/
2009_12_14_00.01.01_America_Chicago/
2009_12_14_12.01.01_America_Chicago/
2009_12_14_15.01.01_America_Chicago/
2009_12_14_18.01.01_America_Chicago/
2009_12_14_21.01.01_America_Chicago/
2009_12_15_00.01.01_America_Chicago/
2009_12_15_03.01.02_America_Chicago/
2009_12_15_06.01.01_America_Chicago/
2009_12_15_09.01.00_America_Chicago/

Our current snapshot schedule is the following, though it is subject to change:
Every 3 hours for the last day.
Every day at midnight for the past 7 days.
Every Sunday at midnight for the past 4 weeks.

At this point if I know the time I want to recover from I can simply enter the directory and copy it to a new location like so:

# cp 2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/colortable16.sh.restored

However, I could also use the following command to see when it last appeared, and then review from that list:

# find . -name colortable16.sh
./2009_11_22_00.01.01_America_Chicago/colortable16.sh
./2009_11_29_00.01.00_America_Chicago/colortable16.sh
./2009_12_06_00.01.01_America_Chicago/colortable16.sh
./2009_12_09_00.01.00_America_Chicago/colortable16.sh

Now I can review some of the candidates and decide to copy one back to my ~/tmp directory:

# less ./2009_12_09_00.01.00_America_Chicago/colortable16.sh
# less ./2009_12_06_00.01.01_America_Chicago/colortable16.sh
# cp ./2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/

Recall that the snapshots under the .ckpt directories are read-only, so at this point one can go back to ~/tmp to begin working on the file again:

# cd ~/tmp/
# vim colortable16.sh