6 Posts
0
418
PS6010X Firmware 10.0.03 : Retrieve Snapshot removal
Hello,
I need to recover a snapshot that is no longer presented. Is it possible to find it on the command line? It is dated January 20.
I got hacked on 01/21 and the new snapshots have encrypted elements (Phobos ransomware). Nothing moves at the given level for the moment.
Is there a way to play on the descriptors to find the old snapshot?
Thanks.
dwilliam62
1 Rookie
1 Rookie
•
1.5K Posts
0
January 25th, 2023 10:00
Hello,
What the list shows is all that exist. There are no "hidden" snapshots on EQL arrays. Depending on how much snapshot reserve you allocate, what the max keep is set for on any schedules and how much write IOs a volume has will determine the number of available snapshots.
When they are deleted they are gone.
Regards,
Don
#iworkfordell
dwilliam62
1 Rookie
1 Rookie
•
1.5K Posts
0
January 25th, 2023 06:00
Hello,
If the snapshots do not show up in the GUI, they likely have been deleted. Either by policy, or snapshot space allocation requirement.
At the CLI you can run:
GrpName>volume select VOLUMENAME show snapshots
GrpName> volume select esxv65-vol3 show snapshots
Name Permission Status Schedule Connections
--------------------------- ---------- ----------- -------- -----------
esxv65-vol3-2023-01-24-00:0 read-write offline ESXv6-Vo 0
5:01.306659.90001 ls-SnapShots
esxv65-vol3-2023-01-25-00:0 read-write offline ESXv6-Vo 0
5:01.306693.90001 ls-SnapShots
The snapshot name has the date and time it was created. If earlier snapshots are not listed they are gone.
Regards,
Don
#iworkfordell
Moxouris
6 Posts
0
January 25th, 2023 10:00
Thanks for reply.
I have the same list than GUI.
Does not exist it an advanced command to see more ?
Regards.
Christophe