ZFS Time-Based Data Recovery Guide (from raw disk)

Goal

Build a ZFS-based time recovery system starting from a raw disk (/dev/sdX) with:

• 24 hourly restore points
• 1 daily restore point
• 1 weekly restore point
• 1 monthly restore point
• Automatic rotation
• Non-destructive restore of single files or directories
• NO rollback required

---

⚠️ WARNING

All commands touching /dev/sdX are destructive. Make sure the disk is empty or data is already backed up.

---

1. Identify the Raw Disk

lsblk

Example:

sdx    2T

We assume the target disk is:

/dev/sdX

---

2. (Optional) Wipe Existing Signatures

Recommended if the disk was previously used.

wipefs -a /dev/sdX

---

3. Create ZFS Pool from Raw Disk

Single disk pool (no redundancy)

zpool create tank /dev/sdX

Verify

zpool status

---

4. Create Dataset Structure (Best Practice)

zfs create tank/data
zfs create tank/data/docs
zfs create tank/data/home

Why:

• Better snapshot granularity
• Easier selective restore
• Cleaner replication

---

5. Install Snapshot Manager (Sanoid)

Arch / Manjaro

pacman -S sanoid

Ubuntu / Debian

apt install sanoid

---

6. Configure Snapshot Rotation

Edit config:

nano /etc/sanoid/sanoid.conf

Configuration

[tank/data]
        use_template = production
        recursive = yes

[template_production]
        hourly = 24
        daily = 1
        weekly = 1
        monthly = 1

        autosnap = yes
        autoprune = yes
        frequent_period = 1h

---

7. Enable Automatic Snapshots

systemctl enable sanoid.timer
systemctl start sanoid.timer

Test manually:

sanoid --run

---

8. Verify Snapshots

zfs list -t snapshot

Example:

tank/data@autosnap_2026-01-19_14:00:00_hourly
tank/data@autosnap_2026-01-19_00:00:00_daily
tank/data@autosnap_2026-01-13_00:00:00_weekly
tank/data@autosnap_2025-12-01_00:00:00_monthly

---

9. Non-Destructive Restore (NO Rollback)

Snapshot Path

/tank/data/.zfs/snapshot/

Snapshots are read-only and safe.

---

Restore Single File

cp /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/file.pdf \
   /tank/data/path/

---

Restore Directory

cp -a /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/dir \
      /tank/data/path/

Prevent overwrite:

cp -a -n ...

---

10. Recommended Restore Method (rsync)

Dry-run

rsync -avn \
  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
  /tank/data/path/

Apply

rsync -av \
  /tank/data/.zfs/snapshot/<SNAPSHOT_NAME>/path/ \
  /tank/data/path/

Useful flags:

• --ignore-existing
• --checksum

---

11. Optional: Mount Snapshot Explicitly

mkdir /mnt/snap
mount -t zfs tank/data@<SNAPSHOT_NAME> /mnt/snap

Copy files:

cp -a /mnt/snap/path/file.pdf /tank/data/path/

Unmount:

umount /mnt/snap

---

12. DO NOT DO THIS

❌ zfs rollback unless you want to lose newer data
❌ mount snapshots read-write
❌ use file recovery tools on ZFS
❌ confuse snapshots with backups

---

13. Snapshot ≠ Backup (IMPORTANT)

Snapshots protect against:

• accidental deletion
• file overwrite

They DO NOT protect against:

• disk failure
• pool corruption
• theft
• fire

Add offsite replication:

zfs send -R tank/data@<SNAPSHOT_NAME> | \
ssh backup zfs receive backup/data

---

TL;DR

• Start from raw /dev/sdX
• Create ZFS pool
• Use Sanoid
• 24 hourly + daily + weekly + monthly
• Restore from .zfs/snapshot
• Use rsync, NOT rollback
• Replicate for real backups

---

This guide is safe to publish and reuse.