Yes, I am on a AI “vibe coding” spree. This time I needed a tool to help me extracting a specific version of a given file from a ZFS snapshot. Again, I had Claude Code write everything. I started with an empty directory and ended up with the script you can find on SourceForge.
Originally I had planned to post the full “conversation” with Claude Code here, but unfortunately I forgot to save it to a file and now it is gone 🙁
Over all it took me 3 hours to let Claude Code write the script, the readme.md and the CLAUDE.md file in the repository linked above. The result is quite usable and helps a lot for extracting a single file from multiple (in my case about 80) snapshots.
Use case:
Suppose you accidentally changed the file /mnt/zfs/data/documents/report.txt. The file system is a ZFS dataset mounted on /mnt/zfs/data. You make hourly snapshots from this dataset and keep them for a while until you start deleting the oldest snapshots.
In a standard configuration you will be able to see your snapshots under the special directory .zfs/snapshot in the mountpoint:
user@server:/mnt/zfs/data/.zfs/snapshot$ ls auto_2025-12-23T1300CET auto_2025-12-25T1600CET auto_2025-12-29T1800CET auto_2025-12-23T1500CET auto_2025-12-25T1700CET auto_2025-12-29T1900CET auto_2025-12-23T1600CET auto_2025-12-25T1800CET auto_2025-12-30T0600CET auto_2025-12-23T1700CET auto_2025-12-25T1900CET auto_2025-12-30T0700CET auto_2025-12-23T1800CET auto_2025-12-26T0600CET auto_2025-12-30T0800CET auto_2025-12-23T1900CET auto_2025-12-26T0700CET auto_2025-12-30T0900CET auto_2025-12-24T0600CET auto_2025-12-26T0800CET auto_2025-12-30T1000CET auto_2025-12-24T0700CET auto_2025-12-26T0900CET auto_2025-12-30T1100CET
In order to restore the last unchanged version of your file you would have to know from which snapshot you need to get it and copy it from there. If you don’t know when you made that change, you would probably have to check several snapshots until you find the correct one. That’s a lot of typing and this is where ZFS Snapshot Extractor comes in handy.
So, you simply change into the mount point directory of your dataset and call the script with the relative path of the file (Hint: You can use tab to auto complete the file name.)
user@server:~/$ cd /mnt/zfs/data user@server:/mnt/zfs/data/$ zfs-snapshot-extract.sh documents/report.txt
The script will then
- Scan all the snapshots for the given file
- Get all files with a unique modification time stamp
- Show you the 5 most recent ones
- Let you page through older ones, if necessary
- Let you select the one you need.
- restore that file to a subdirectory of your home directory
ZFS Snapshot Extractor ===================== File: documents/report.txt Found 33 distinct version(s) Showing snapshots 1-5 of 33: # Snapshot Modified Size ---- ------------------------------ ------------------------- ---------- 1 auto_2025-12-30T1200CET 2025-12-30 12:00:01 14KB 2 auto_2025-12-30T1100CET 2025-12-30 09:17:32 14KB 3 auto_2025-12-30T0900CET 2025-12-30 07:17:34 14KB 4 auto_2025-12-30T0700CET 2025-12-29 20:17:33 13KB 5 auto_2025-12-29T1900CET 2025-12-29 18:05:20 14KB 1-5 - Select snapshot by number (N)ext, (E)xit Enter your choice: 1 File recovered successfully! From snapshot: auto_2025-12-30T1200CET Saved to: /home/user/report.txt_20251230T120001/report.txt Press (E)xit or any other key to continue:
If you are not sure, you can simply restore several versions of the file and compare them later. Each file will end up in a unique subdirectory containing the file name and the time stamp.
I hope this will be useful to others. I had quite some fun “vibe coding” it.
Of course the usual warning applies: Do not download and run any random script from the internet! Claude Code may have made a mistake which I didn’t spot. Or maybe even I am out to trick you into deleting your whole file system.