Hello, I’m new to TrueNAS, and I recently deleted a folder by accident. Unfortunately, my snapshot was configured incorrectly. Is it possible to recover this folder in TrueNAS?
How did you delete the folder? Locally on the server, such as with SSH? Over an SMB network share without the Recycle Bin option?
Can you elaborate?
Without a pool checkpoint or a snapshot where the folder and its contents exist, there’s no way to easily recover the data.
I assume you’ve been using your pool before making this post, which means you’re even less likely to be able to use a (dangerous) forced TXG import.
Do you have any backups?
I’m a video editor, and I was organizing some footage when, unfortunately, I accidentally deleted the folder with all the videos!
Here at home, I have hard drives to store finished videos, client videos, and a production SSD that I use for current projects.
Until last week, the snapshots — according to a friend who helped set up the system — were supposedly misconfigured and not allowing time-based recovery. But honestly, we’re not even sure if they were set up correctly, because they didn’t work on the machine.
I ran DiskDrill and managed to recover some files, which gave me a bit of hope
I assume you mean over a network share, accessed with a Windows or Mac client? Do you remember if you enabled the “Recycle Bin” option in the SMB Share configuration?
I’m not sure what this means.
First thing, before you do anything drastic, run this command in the terminal:
zpool checkpoint <nameofpool>
You might have to use sudo.
What do your snapshots look like?
zfs list -r -t snap -o name,used,refer <nameofpool>
The only thing I can tell you is that they were videos named C0001 and so on.
I’ll check if the Recycle Bin was enabled.
What of the other commands?
1 Like
Hello, I’m the friend that made the setup.
It was my first time doing it, I had the snapshots to be taken of the Pool, not the SMB share I had setup up for him. And it wasn´t enable the snapshots to be taken from child shares.
So the snapshots were useless, very small. It was a newbie error 
He acess the share on windows SMB, and when he deleted it didnt move to the Trash, it was deleted. He swears he didnt press Shift + Del, only selected the folder and pressed Delete, but it didnt go to the trash folder on his PC.
Is this normal? Is there any configuration that can be done to prevent this?
The files he recovered he did it using external software connecting by SSH, but he couldnt recover most of the files. As he said it, he used DiskDrill and after that, most files (camera recording) had to be reconstructed again by another software, Wondershare RepairIt.
Any tips on trying to recover more data?
Now the snapshots are running as they should, on the different shares of the NAS.
Was the “Recycle Bin” option enabled in the share’s configuration?
A snapshot task was made for the root dataset, but without the “recursive” option? No other snapshot tasks exist?
Without a pool checkpoint and without snapshots, there’s nothing that can be done other than what you’re already trying: file recovery software
There’s also trying a (dangerous) TXG import, which likely won’t be useful, since enough time has already passed.
Another option for data recovery is Klennet.
I didnt find this option. It is configured pretty much as a default share: Purpose : Default Share Paramenters.
Where can I find this option? Can I edit it without destroying the Share? Any link or Wiki is much apreciatted. If it was on, can we recover the files?
Exactly. It was made for the root but not recursive. Snapshots are being taken from the shares now, but only after the deleted files were gone. Just made a test and its working now.
Under a share’s configuration. You should see a check box called “Export Recycle Bin”.
If it’s disabled, enabling it now is too late.
Unless you explicitly enabled it, I don’t believe any preset enables it by default.
I found it. Unfortunately it was disabled.
I can’t enable it now via the TrueNAS interface. How to do it now?
And we did some tests. He really didn’t press SHIFT DEL. He pressed only FN + Delete, but when he is acessing any folder on the SMB Share, it gives the message of deleting (skipping the Trash can) as if he pressed SHIFT. That doesn’t happen on his local folders.
I’m on Linux, and its working normally (Only Deleting creates a .Trash-1000/ folder on the Share that I can recover).
And English is not our native language, I hope I’m being clear 
Thanks for all the help so far.
You have to use a “preset” that doesn’t prohibit that option, or don’t use a preset at all.
Correct. This is the default behavior with Windows.
While using Windows, deleting a file over a TrueNAS hosted SMB network share permanently deletes it.
If you delete a local file, then it gets sent to the Recycle Bin.
Even over network shares, this is the default behavior with most Linux desktops / file browsers, unless you intentionally select “Permanently delete” or “Delete” instead of “Send to trash”.
Thanks for everything!
Is it risky to edit the Share configuration to Enable the .Recycle folder?
What is the big advantage in doing so, now that the Snapshots are configured correctly? I believe is for those recovery programs have better success, correct?
I think those are my final doubts, again, thank you very much for your answers.
Not risky. It’s a matter of preference if you want something that emulates a traditional “Recycle Bin” over your SMB shares when using Windows. It doesn’t add any extra risks.
You will be able to retrieve “deleted” files in the share’s hidden .recycle folder, in the same manner of restoring a file from the Recycle Bin. (It might not work for very large files that bypass this.)
You can use this in addition to configuring automatic snapshots.
I also recommend getting into the practice of taking manual snapshots before working on a new project or dealing with large files. Sometimes an automatic snapshot task might not land during a timespan between when the files were created and when the deletion occurred.
If you ever find yourself thinking “Should I take a snapshot now?” Yes. Just do it.
They do not consume an extra space[1], and they can easily be deleted later.
They will only restrict how much space can be freed for the files/blocks that have been deleted. ↩︎