Question: I have deleted/overwritten my file. Can I recover the lost data?
Author: Joseph Tam
Date: Dec. 12, 2010
Maybe. It depends on where and when you lost the data.
Location of data to be recovered
MathNet centralized file storage
Our centralized file storage contains the following data
||Original Data Location
|Windows Common Folder
|Personal workstation backup
Some owners of personal workstations have
pre-arranged nightly backups. Backups
takes place every 24 hours at a designated time,
and therefore, hourly snapshots do not change
unless they straddle the designated backup time.
snapname refers to the particular snapshot (i.e.
when the snapshot was taken). It is explained in the section
Retrieval from Snapshots below.
user refers to your username.
The data contained in this storage is backup'd (snapshot) every hour
at the top of the hour, and 10 hours' worth are kept. Additionally,
nightly snapshots are taken every midnight and kept for 7 days. A weekly
snapshot is also taken at Sunday midnight, and last 4 are kept. Thus, it
is possible to retrieve data for up to 5 weeks.
Snapshots cannot be kept indefinitely, so it is important to
retrieve lost data as soon as you are able to, otherwise it may be
purged before you can get to them. If you must recover data that was
lost previous to the oldest snapshot, you'll probably have to request
a recovery from tape archives.
Retrieval from Snapshots
- Step 1: Understanding snapshot names
Snapshot archives are available from our public Unix
workstations. A subset of all available archives is also
available from our public Windows workstations (e.g. ladybug,
beetle). They contain exact replicas of the data at the time
the snapshot was taken.
Each snapshot archive have names that reflect the age of the
- hourly.0, ..., hourly.9
- These directories contain hourly snapshots taken at the top
of the hour with hourly.0 being the most recent and hourly.9
being the oldest snapshot.
- nightly.0, ..., nightly.6
- The nightly snapshots are taken at midnight daily,
with nightly.0 being the most recent and nightly.6 being
the oldest snapshot.
- weekly.0, ..., weekly.3
- Weekly snapshots are taken at the start of Sunday at
midnight; weekly.0 was taken at the most recent Sunday,
and weekly.1 the Sunday previous to that, etc.
|Windows (UNC or Icon name)
- hour or Last hour
- Same as "hourly.0" explained above.
- night or Last night
- Same as "nightly.0" explained above.
- week or Last Sunday
- Same as "weekly.0" explained above.
No two snapshots are taken at the same time; if two snapshots
coincide (e.g. at Sunday midnight, the hourly, nightly, and
weeky snapshots coincide), the longer interval snapshot takes
precedence and the rest skipped. So for example, at Tuesday
02h15, the list of snapshots in increasing age is
hourly.0 (taken at Tuesday 02h00)
hourly.1 (taken at Tuesday 01h00)
nightly.0 (taken at Tuesday 00h00)
hourly.2 (taken at Monday 23h00)
- Step 2: Finding which snapshot has your data
It would be wise to recover data as soon as you realize
it is gone. You have 4-5 weeks to recover your data before
the oldest snapshots disappear. Furthermore, if the file is
modified often, the hourly changes are only kept for 10 hours,
then disappear, leaving only the nightly version available.
In general, you should start searching for the data from the
newest to the oldest snapshots. If you cannot remember the name
of your lost data or when you lost it, you have a long search
ahead of you.
If you know the file or directory name of what you want to recover,
you can use "ls" to look for that file and sort by modification time:
ls -lt /nfs/snap.home/*/schmuk/Recipes/Goulash/spicy.txt
If the modification time and size does not tell you enough about
which version you want, then you'll have to examine the contents.
You can navigate the snapshot folders until you find the data you
want to recover, then copy the data out of the snapshot folders onto
- Step 3: Recovering your data (Unix)
Once you have found your lost data, you must copy it out of
the snapshot archives back into your home directory or wherever
it should go. The snapshot archives are immutable, so you cannot
delete, rename, or modify files located there.
cp /nfs/snap.home/hourly.0/schmuk/Recipes/Goulash/spicy.txt recover.txt
If you've need to transfer a lot of files (e.g. a whole directory
with zillions of files and subdirectories), you can use this
method to copy an entire directory and its subdirectories:
tar cf - Recipes | (cd /some/safe/dir; tar xvf -)
If you cannot recover your lost data because you lost it prior
to when the oldest snapshot was taken, you'll have to pray that
you can recover from backup tape, the next section.
Retrieval from Tape Archive
Update: tape backups are no longer being done as of Nov/2010.
Data that was lost before the oldest snapshots may still be archived
on tape. A request can be made to the IT staff to search for and restore
the lost data from tape archives, if they still exists.
Please be as precise as possible about which files and directories were lost,
and the latest time the data was known to have existed.
Public workstation's local storage
Examples of data stored on public workstation's local storage are
- Temporary directories such as
Unix: /tmp, /var/tmp
- Data held on personal workstations and laptops that do not
have pre-arranged nightly backups.
- Windows: Files/folders on desktop, application folders.
This data is not backed up. You can see the section Other Places to Look to help you recover lost data.
Other Places to Look
- Trash: some desktops (e.g. Windows, GNOME) will not remove
files immediately, but place them in a temporary location
represented by a trash can icon. It may still be there.
- Application backups: some applications will make copies of
data before modification. Look for filenames suffixed with '~',
'.bak', '.old', '.sav', '.orig', '#', etc.
- Email: if you have sent (or received) the data in the
form of an Email attachment, it may still be in one of your
- Recovery software: for personal workstation, file recovery
software may be avilable that reovers deleted files. If the
data is important, do not use the computer: use of the storage
device may permanenlty overwrite your old data.
- Copies: if you have received/sent copies from/to other
people, they may be able to replace your copy.