From c6314913655d48f63fe6fb31d1fc1a5b6f984a4c Mon Sep 17 00:00:00 2001
From: icsboyx <obladio28@gmail.com>
Date: Mon, 19 Jan 2026 15:18:48 +0100
Subject: [PATCH] Upload files to "/"

---
 ZFS_Time_Based_Recovery_From_Raw_Disk.md | 268 +++++++++++++++++++++++
 1 file changed, 268 insertions(+)
 create mode 100644 ZFS_Time_Based_Recovery_From_Raw_Disk.md

diff --git a/ZFS_Time_Based_Recovery_From_Raw_Disk.md b/ZFS_Time_Based_Recovery_From_Raw_Disk.md
new file mode 100644
index 0000000..3e30278
--- /dev/null
+++ b/ZFS_Time_Based_Recovery_From_Raw_Disk.md
@@ -0,0 +1,268 @@
+# ZFS Time-Based Data Recovery Guide (from raw disk)
+
+## Goal
+Build a **ZFS-based time recovery system** starting from a **raw disk (`/dev/sdX`)** with:
+- 24 hourly restore points
+- 1 daily restore point
+- 1 weekly restore point
+- 1 monthly restore point
+- Automatic rotation
+- **Non-destructive restore of single files or directories**
+- NO rollback required
+
+---
+
+## ⚠️ WARNING
+All commands touching `/dev/sdX` are **destructive**.
+Make sure the disk is empty or data is already backed up.
+
+---
+
+## 1. Identify the Raw Disk
+
+```bash
+lsblk
+```
+
+Example:
+```text
+sdx    2T
+```
+
+We assume the target disk is:
+```text
+/dev/sdX
+```
+
+---
+
+## 2. (Optional) Wipe Existing Signatures
+
+Recommended if the disk was previously used.
+
+```bash
+wipefs -a /dev/sdX
+```
+
+---
+
+## 3. Create ZFS Pool from Raw Disk
+
+### Single disk pool (no redundancy)
+
+```bash
+zpool create tank /dev/sdX
+```
+
+### Verify
+```bash
+zpool status
+```
+
+---
+
+## 4. Create Dataset Structure (Best Practice)
+
+```bash
+zfs create tank/data
+zfs create tank/data/docs
+zfs create tank/data/home
+```
+
+Why:
+- Better snapshot granularity
+- Easier selective restore
+- Cleaner replication
+
+---
+
+## 5. Install Snapshot Manager (Sanoid)
+
+### Arch / Manjaro
+```bash
+pacman -S sanoid
+```
+
+### Ubuntu / Debian
+```bash
+apt install sanoid
+```
+
+---
+
+## 6. Configure Snapshot Rotation
+
+Edit config:
+```bash
+nano /etc/sanoid/sanoid.conf
+```
+
+### Configuration
+
+```ini
+[tank/data]
+        use_template = production
+        recursive = yes
+
+[template_production]
+        hourly = 24
+        daily = 1
+        weekly = 1
+        monthly = 1
+
+        autosnap = yes
+        autoprune = yes
+        frequent_period = 1h
+```
+
+---
+
+## 7. Enable Automatic Snapshots
+
+```bash
+systemctl enable sanoid.timer
+systemctl start sanoid.timer
+```
+
+Test manually:
+```bash
+sanoid --run
+```
+
+---
+
+## 8. Verify Snapshots
+
+```bash
+zfs list -t snapshot
+```
+
+Example:
+```text
+tank/data@autosnap_2026-01-19_14:00:00_hourly
+tank/data@autosnap_2026-01-19_00:00:00_daily
+tank/data@autosnap_2026-01-13_00:00:00_weekly
+tank/data@autosnap_2025-12-01_00:00:00_monthly
+```
+
+---
+
+## 9. Non-Destructive Restore (NO Rollback)
+
+### Snapshot Path
+
+```text
+/tank/data/.zfs/snapshot/
+```
+
+Snapshots are **read-only** and safe.
+
+---
+
+### Restore Single File
+
+```bash
+cp /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/file.pdf \
+   /tank/data/path/
+```
+
+---
+
+### Restore Directory
+
+```bash
+cp -a /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/dir \
+      /tank/data/path/
+```
+
+Prevent overwrite:
+```bash
+cp -a -n ...
+```
+
+---
+
+## 10. Recommended Restore Method (rsync)
+
+### Dry-run
+```bash
+rsync -avn \
+  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
+  /tank/data/path/
+```
+
+### Apply
+```bash
+rsync -av \
+  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
+  /tank/data/path/
+```
+
+Useful flags:
+- `--ignore-existing`
+- `--checksum`
+
+---
+
+## 11. Optional: Mount Snapshot Explicitly
+
+```bash
+mkdir /mnt/snap
+mount -t zfs tank/data@<SNAPSHOT_NAME> /mnt/snap
+```
+
+Copy files:
+```bash
+cp -a /mnt/snap/path/file.pdf /tank/data/path/
+```
+
+Unmount:
+```bash
+umount /mnt/snap
+```
+
+---
+
+## 12. DO NOT DO THIS
+
+❌ `zfs rollback` unless you want to lose newer data  
+❌ mount snapshots read-write  
+❌ use file recovery tools on ZFS  
+❌ confuse snapshots with backups  
+
+---
+
+## 13. Snapshot ≠ Backup (IMPORTANT)
+
+Snapshots protect against:
+- accidental deletion
+- file overwrite
+
+They DO NOT protect against:
+- disk failure
+- pool corruption
+- theft
+- fire
+
+### Add offsite replication:
+
+```bash
+zfs send -R tank/data@<SNAPSHOT_NAME> | \
+ssh backup zfs receive backup/data
+```
+
+---
+
+## TL;DR
+
+- Start from raw `/dev/sdX`
+- Create ZFS pool
+- Use Sanoid
+- 24 hourly + daily + weekly + monthly
+- Restore from `.zfs/snapshot`
+- Use `rsync`, NOT rollback
+- Replicate for real backups
+
+---
+
+**This guide is safe to publish and reuse.**