# ZFS Time-Based Data Recovery Guide (from raw disk)

## Goal
Build a **ZFS-based time recovery system** starting from a **raw disk (`/dev/sdX`)** with:
- 24 hourly restore points
- 1 daily restore point
- 1 weekly restore point
- 1 monthly restore point
- Automatic rotation
- **Non-destructive restore of single files or directories**
- NO rollback required

---

## ⚠️ WARNING
All commands touching `/dev/sdX` are **destructive**.
Make sure the disk is empty or data is already backed up.

---

## 1. Identify the Raw Disk

```bash
lsblk
```

Example:
```text
sdx    2T
```

We assume the target disk is:
```text
/dev/sdX
```

---

## 2. (Optional) Wipe Existing Signatures

Recommended if the disk was previously used.

```bash
wipefs -a /dev/sdX
```

---

## 3. Create ZFS Pool from Raw Disk

### Single disk pool (no redundancy)

```bash
zpool create tank /dev/sdX
```

### Verify
```bash
zpool status
```

---

## 4. Create Dataset Structure (Best Practice)

```bash
zfs create tank/data
zfs create tank/data/docs
zfs create tank/data/home
```

Why:
- Better snapshot granularity
- Easier selective restore
- Cleaner replication

---

## 5. Install Snapshot Manager (Sanoid)

### Arch / Manjaro
```bash
pacman -S sanoid
```

### Ubuntu / Debian
```bash
apt install sanoid
```

---

## 6. Configure Snapshot Rotation

Edit config:
```bash
nano /etc/sanoid/sanoid.conf
```

### Configuration

```ini
[tank/data]
        use_template = production
        recursive = yes

[template_production]
        hourly = 24
        daily = 1
        weekly = 1
        monthly = 1

        autosnap = yes
        autoprune = yes
        frequent_period = 1h
```

---

## 7. Enable Automatic Snapshots

```bash
systemctl enable sanoid.timer
systemctl start sanoid.timer
```

Test manually:
```bash
sanoid --run
```

---

## 8. Verify Snapshots

```bash
zfs list -t snapshot
```

Example:
```text
tank/data@autosnap_2026-01-19_14:00:00_hourly
tank/data@autosnap_2026-01-19_00:00:00_daily
tank/data@autosnap_2026-01-13_00:00:00_weekly
tank/data@autosnap_2025-12-01_00:00:00_monthly
```

---

## 9. Non-Destructive Restore (NO Rollback)

### Snapshot Path

```text
/tank/data/.zfs/snapshot/
```

Snapshots are **read-only** and safe.

---

### Restore Single File

```bash
cp /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/file.pdf \
   /tank/data/path/
```

---

### Restore Directory

```bash
cp -a /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/dir \
      /tank/data/path/
```

Prevent overwrite:
```bash
cp -a -n ...
```

---

## 10. Recommended Restore Method (rsync)

### Dry-run
```bash
rsync -avn \
  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
  /tank/data/path/
```

### Apply
```bash
rsync -av \
  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
  /tank/data/path/
```

Useful flags:
- `--ignore-existing`
- `--checksum`

---

## 11. Optional: Mount Snapshot Explicitly

```bash
mkdir /mnt/snap
mount -t zfs tank/data@<SNAPSHOT_NAME> /mnt/snap
```

Copy files:
```bash
cp -a /mnt/snap/path/file.pdf /tank/data/path/
```

Unmount:
```bash
umount /mnt/snap
```

---

## 12. DO NOT DO THIS

❌ `zfs rollback` unless you want to lose newer data  
❌ mount snapshots read-write  
❌ use file recovery tools on ZFS  
❌ confuse snapshots with backups  

---

## 13. Snapshot ≠ Backup (IMPORTANT)

Snapshots protect against:
- accidental deletion
- file overwrite

They DO NOT protect against:
- disk failure
- pool corruption
- theft
- fire

### Add offsite replication:

```bash
zfs send -R tank/data@<SNAPSHOT_NAME> | \
ssh backup zfs receive backup/data
```

---

## TL;DR

- Start from raw `/dev/sdX`
- Create ZFS pool
- Use Sanoid
- 24 hourly + daily + weekly + monthly
- Restore from `.zfs/snapshot`
- Use `rsync`, NOT rollback
- Replicate for real backups

---

**This guide is safe to publish and reuse.**