Files
2026-01-19 15:21:57 +01:00

269 lines
3.7 KiB
Markdown

# ZFS Time-Based Data Recovery Guide (from raw disk)
## Goal
Build a **ZFS-based time recovery system** starting from a **raw disk (`/dev/sdX`)** with:
- 24 hourly restore points
- 1 daily restore point
- 1 weekly restore point
- 1 monthly restore point
- Automatic rotation
- **Non-destructive restore of single files or directories**
- NO rollback required
---
## ⚠️ WARNING
All commands touching `/dev/sdX` are **destructive**.
Make sure the disk is empty or data is already backed up.
---
## 1. Identify the Raw Disk
```bash
lsblk
```
Example:
```text
sdx 2T
```
We assume the target disk is:
```text
/dev/sdX
```
---
## 2. (Optional) Wipe Existing Signatures
Recommended if the disk was previously used.
```bash
wipefs -a /dev/sdX
```
---
## 3. Create ZFS Pool from Raw Disk
### Single disk pool (no redundancy)
```bash
zpool create tank /dev/sdX
```
### Verify
```bash
zpool status
```
---
## 4. Create Dataset Structure (Best Practice)
```bash
zfs create tank/data
zfs create tank/data/docs
zfs create tank/data/home
```
Why:
- Better snapshot granularity
- Easier selective restore
- Cleaner replication
---
## 5. Install Snapshot Manager (Sanoid)
### Arch / Manjaro
```bash
pacman -S sanoid
```
### Ubuntu / Debian
```bash
apt install sanoid
```
---
## 6. Configure Snapshot Rotation
Edit config:
```bash
nano /etc/sanoid/sanoid.conf
```
### Configuration
```ini
[tank/data]
use_template = production
recursive = yes
[template_production]
hourly = 24
daily = 1
weekly = 1
monthly = 1
autosnap = yes
autoprune = yes
frequent_period = 1h
```
---
## 7. Enable Automatic Snapshots
```bash
systemctl enable sanoid.timer
systemctl start sanoid.timer
```
Test manually:
```bash
sanoid --run
```
---
## 8. Verify Snapshots
```bash
zfs list -t snapshot
```
Example:
```text
tank/data@autosnap_2026-01-19_14:00:00_hourly
tank/data@autosnap_2026-01-19_00:00:00_daily
tank/data@autosnap_2026-01-13_00:00:00_weekly
tank/data@autosnap_2025-12-01_00:00:00_monthly
```
---
## 9. Non-Destructive Restore (NO Rollback)
### Snapshot Path
```text
/tank/data/.zfs/snapshot/
```
Snapshots are **read-only** and safe.
---
### Restore Single File
```bash
cp /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/file.pdf \
/tank/data/path/
```
---
### Restore Directory
```bash
cp -a /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/dir \
/tank/data/path/
```
Prevent overwrite:
```bash
cp -a -n ...
```
---
## 10. Recommended Restore Method (rsync)
### Dry-run
```bash
rsync -avn \
/tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
/tank/data/path/
```
### Apply
```bash
rsync -av \
/tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
/tank/data/path/
```
Useful flags:
- `--ignore-existing`
- `--checksum`
---
## 11. Optional: Mount Snapshot Explicitly
```bash
mkdir /mnt/snap
mount -t zfs tank/data@<SNAPSHOT_NAME> /mnt/snap
```
Copy files:
```bash
cp -a /mnt/snap/path/file.pdf /tank/data/path/
```
Unmount:
```bash
umount /mnt/snap
```
---
## 12. DO NOT DO THIS
`zfs rollback` unless you want to lose newer data
❌ mount snapshots read-write
❌ use file recovery tools on ZFS
❌ confuse snapshots with backups
---
## 13. Snapshot ≠ Backup (IMPORTANT)
Snapshots protect against:
- accidental deletion
- file overwrite
They DO NOT protect against:
- disk failure
- pool corruption
- theft
- fire
### Add offsite replication:
```bash
zfs send -R tank/data@<SNAPSHOT_NAME> | \
ssh backup zfs receive backup/data
```
---
## TL;DR
- Start from raw `/dev/sdX`
- Create ZFS pool
- Use Sanoid
- 24 hourly + daily + weekly + monthly
- Restore from `.zfs/snapshot`
- Use `rsync`, NOT rollback
- Replicate for real backups
---
**This guide is safe to publish and reuse.**