File Recovery

Introduction

Within research storage shares (your allocated storage areas), files which have been accidentally deleted or corrupted in some way may be recovered easily using the share’s “shapshots” – the the hourly and daily backups. This is something that users can do – no need to wait for IT Services to do it!

These snapshots exist within a hidden directory, called .snapshot, which is located at the top level within the share. File management tools will not reveal .snapshot unless the path is manually entered. Within this hidden directory exists a snapshot of your share for each hour for the last 24 hours, and for each day for the last 35 days.

These snapshots are readonly, i.e., it not possible to delete them or change them in any way. To restore a file, you copy the file from the snapshot area to the main storage area.

How do I recover files from a CIFS share on Windows?

1. Open Computer.
2. Right click on the mapped network/isilon drive (e.g., your R:/ drive) and select Restore previous versions.
3. Wait a moment while a list of snapshots loads up. Each will have a date and time next to it.
4. Open a snapshot folder which is dated/timestamped before the date/time you deleted the file(s) you wish to recover.
5. The snapshot folder will open in a new window. You should now be able to find your missing file and open it to check it.
6. If you are happy with the version of the file, copy-and-paste it or drag-and-drop it to your mapped drive (e.g., your R:/ drive.) Close all windows associated with the snapshots when you have finished.

How do I recover files from a CIFS share on Linux?

Suppose today is 21 June 2025 and we wish to recover a file called notes.txt that was deleted yesterday:

1. Change to the .snapshot directory on your mount/share where you have it mounted on your system. For example:

   cd  /mnt/myshare/.snapshot
                         #
                         # Note: you won't be able to see the .snapshot folder
                         # if you list the contents of your share (ls -a /mnt/myshare).
                         # But it IS there. 
   

2. List all the snapshot folders, which shows the dates and times of the snapshot in the folder names

   ls -l
   

3. Enter the directory for 19 June (remember, this example was written on 21 June 2025 and we assume we deleted a file on the 20th June 2025), for example

   Reynolds_EPS_CIFS_28days_2025-06-19_00-30-00
                     #
                     # Despite the name indicating 28 days of backups, there are
                     # actually 35 folders representing 35 days of backups.
   

4. Within this directory, you will find a copy of notes.txt from two days ago (in our example). Copy this back to your share.

   cp notes.txt /mnt/myshare
   

5. To copy an entire folder and its contents from the snapshot area to the live storage:

   cp -r somefolder /mnt/myshare
   

How do I recover files from a CIFS share on OS-X?

Suppose today is 21 June 2025 and we wish to recover a file called notes.txt that was deleted yesterday:

Via the Terminal command line

1. Change to the .snapshot directory on your mount/share where you have it mounted on your system. For example:

   cd /Volumes/myshare/.snapshot
                            #
                            # Note: you won't be able to see the .snapshot folder
                            # if you list the contents of your share (ls -a /Volumes/myshare).
                            # But it IS there. 
   

2. List all the snapshot folders, which shows the dates and times of the snapshot in the folder names

   ls -l
   

3. Enter the directory for 19 June (remember, this example was written on 21 June 2025 and we assume we deleted a file on the 20th June 2025), for example

   cd Reynolds_EPS_CIFS_28days_2025-06-19_00-30-00
                         #
                         # Despite the name indicating 28 days of backups, there are
                         # actually 35 folders representing 35 days of backups.
   

4. Within this directory, you will find a copy of notes.txt from two days ago (in our example). Copy this back to your share.

   cp notes.txt /Volumes/myshare
   

5. To copy an entire folder and its contents from the snapshot area to the live storage:

   cp -r somefolder /mnt/myshare
   

How do I recover files from a NFS share on Linux?

This also applies to additions RDS areas on the CSF and iCSF.

This is done using the hidden .snapshot directory in exactly the same way as for CIFS shares, above.