recover file from destroyed zfs snapshot - is it possible?

[Artem Belevich]

On Thu, Jun 9, 2011 at 1:00 PM, Greg Bonett <greg at bonett.org> wrote:
> Hi all,
> I know this is a long shot, but I figure it's worth asking. Is there
> anyway to recover a file from a zfs snapshot which was destroyed? I know
> the name of the file and a unique string that should be in it. The zfs
> pool is on geli devices so I can't dd the raw device and look for it.
> Any suggestions?
>
> Thanks for the help.

Theoretically it may be possible. Practically it will not be trivial.

ZFS state at any given point in time is determined by it's uberblock.
ZFS keeps number of previous uberblocks (and thus -- ZFS states). If
you're familiar with ZDB and with ZFS filesystem layout, you may be
able to use information in the last saved uberblock before the
snapshot was nuked and, with some luck, would be able to find the data
tat was in your file. That, however, relies on an optimistic
assumption that a) such uberblock is still around and, b) appropriate
disk blocks have not been reused by more recent transactions.I believe
recent ZFS versions (v28 should qualify) make an effort to keep recent
transaction groups in consistent state to improve chances of recovery
with "zpool import -F" in case disks lied about cache flushes.

In case you do want to dig in, ZFS on-disk data structures are documented here:
http://opensolaris.org/os/community/zfs/docs/ondiskformat0822.pdf

This script (WARNING -- DESCTRUCTIVE) should allow you to roll back
ZFS state to an earlier point in time on single-device pools:
http://www.solarisinternals.com/wiki/index.php/ZFS_forensics_scrollback_script

Good luck.

--Artem

P.S. You wouldn't happen to have backup of your file,  would you? That
would make things so much easier. :-)