Linux Equivalents for Novell's "Filer"?

Josh Berkus asks: "One of my clients would love to convert their entire office to Linux. But one thing keeps them tied to a NetWare file server: a little utility called 'Filer' Filer allows the sysadmins to retrieve deleted and overwritten files, up to a week after the event. With 70 secretaries using that server, that ability is crucial. I've looked around the Internet, but cannot find anything quite equivalent in the Linux world, except maybe hourly backups and that's a pain. What the client really needs is a utility/mod for the filesystem or network layer that archives files instead of over-writing or deleting them. I had one kernel hacker offer to write me something like that, but my client does not want to be a test case. Note, that we have nothing against Netware, it's just that this client has historically not been able to get good Novell support. Anybody know anything that's already in production like this? Is Reiser working on this for ReiserFS?" This sounds deceptively easy. If this was a personal machine, this would be easy, but the showstopper is that this has to work as a share meaning that this "trashcan" like functionality needs to be implemented at the filesystem level. While I can understand the submittors desire to not be a test case, if there doesn't exist a ready-made solution to this particular problem, how difficult would it be to add this on to ext2/ext3, Reiserfs or some other suitable open source filesystem and test it for reliability?

Perhaps...

[crazney]

Perhaps you could look at cvsfs? Don't know if it actually works, but meh..
http://sourceforge.net/projects/cvsfs/ [sourceforge.net]

Linux undelete utiilties

[NaveWeiss]

Here's a project [uprm.edu] that supposedly does that. They use a daemon that physically deletes the files after a while. It's not as cute as in Novell, where erased files were physically overwritten only when the system really needed the space.

unlink()

[Saint Nobody]

I know i saw a library a while ago on freshmeat that supplies a new unlink() function. This version will move the file into a trashcan area rather than just delete it. it could be worth investigating. after a quick search, it's apparently called libtrash [freshmeat.net].

I don't really know the software, so i can't vouch for it, but it seems to be taking a sensible approach. of course, the whole idea breaks if you use the kernel nfsd, so be careful with that.

NetApp filers are ideal for this

[sclatter]

I'm guessing this may be out of your budget range, but you should know about Network Appliance filers' snapshotting capability. The filers create online "backups" by saving the state information about a filesystem. You could have snapshots of the state of the filesystem every day for a week and several times a day. I think they support something like a dozen snapshots at a time.

All this does take up space on the filer, but only the changed blocks have to be saved. As long as your churn is pretty low it's not that much extra space.

If you lose or munge a file, all you have to do is cd to a special .snapshot directory, choose the latest image that has your file intact, and copy it back to the live filesystem. It's perfect for those belly churning "Ooops" situations.

Snapshots are also used for backups, so that you are always backing up a totally static image of the filesystem. No files changing midway through.

Yeah, filers are spendy, but when it comes to fast, reliable, easy to administer file service I really believe they are the best.

Other than that, I think Veritas added a similar capability to VxFS, but I don't recall it being quite as elegant.

Sarah

Undeleting files under reiserfs

[fingal]

As chance would have it, I had to perform this task for one of my clients at the weekend as they had just deleted their entire active database (doh!). After a load of research, I found that the best resources are to be found in the reiserfs mailing list [theaimsgroup.com].

The key post was this one [theaimsgroup.com] which pointed me at using:-

reiserfsck --rebuild-tree -S -l rebuild.log /dev/yourdevice

Very scary. Had to boot into a rescue system off CD first, mount HDD RO, then get enough tools to be able to backup the HDD to a remote box. Unmount disk and then run reiserfsck. Pray for a bit. Got all the db files back (and because they where in a directory that was deleted, they had all the correct names as well (once I'd found the directory)).

There was some minor file-system corruption for files that had been written frequently, but this was taken care of by restoring the previous backup and checking everything else from the RPM db. So, all-in-all not an experience that you would want to do on a daily basis, but definately worth it to restore 2 months of lost work (why oh why don't people use backups?).

As far as kernel hooks for undeleting data, the mailing list link above contains several discussions about this, but the general feeling seems to be that it is possible but Linus doesn't want it (see here [theaimsgroup.com].

Re:One word: libtrash

[Belfont9]

Oops, here [m-arriaga.net].