In the ZX and NX2, a snapshot is a read-only copy of the state of a file system or volume at a specific point in time.  If enabled, snapshots can be used to recover deleted files on a ZX or NX2.  Files can be restored using Snapshots but there is no current way to see if anything was deleted, You could mount a snapshot and then compare it with your live mount point to see if there is a difference. The easiest way to explore a snapshot is on a Windows system, both Windows and Mac methods are below. 


Mac-only Process requiring an admin:


  1. Navigate to the snapshots tab in the NX2/ZX web GUI
  2. Find a snapshot that is old enough to contain the deleted files
  3. Select "clone" from the options menu for the selected snapshot
  4. Navigate to the "shares" tab
  5. Expand the newly created dataset of the cloned snapshot
  6. Select "Create a share" from the options menu for the new dataset
  7. Give the share a unique name so it can be distinguished from your production environment
  8. Mount both the new share and the production share on a workstation 
  9. Locate and copy the deleted files from the new share to the production share
  10. Verify that the files have been restored
  11. Delete the cloned dataset once finished

Windows process that anyone with access permission to the share can perform:


  1. Right-click the share
  2. Go to Properties
  3. Go to Previous Versions
  4. Double-click on the snap you wish to mount
  5. You should now be able to see the snaps contents
  6. When done with the snap, simply close its window to close out the snapshot.


Also from the ZX GUI, you can look at each Snapshot's Details and see how much was used or written, which might help determine if something changed.  The "used" space of a snapshot refers to the amount of space on disk that is shared between the snapshot and the active dataset. This includes all blocks that have been modified or deleted in the active dataset since the snapshot was taken. The "written" space of a snapshot refers to the amount of data that has been written to the dataset or volume since the snapshot was taken.


In other words, "used" represents the amount of space that is being used by both the active dataset and the snapshot, while "written" represents the amount of new data that has been written to the dataset