File Recovery (SnapONE)
File Recovery (SnapONE)
Snapshots let you restore an entire volume back to an earlier point in time, but sometimes you only need to know what happened to a single file —— when it was created, changed, renamed, or deleted, and which snapshots contain which version of it. SnapONE is StorONE's change-tracking index for a volume's file system: once enabled, it keeps a searchable history of file events across every snapshot, so you can search for a file by name or path and see its history without mounting and comparing snapshots one by one.
SnapONE indexing is a file-system-level setting that must already be turned on for the volume before these commands return any results. If it isn't enabled, both commands below fail with an error telling you so.
Searching file history
Use this to find files that existed (or still exist) within a range of snapshots, optionally filtered by a path prefix or a text search against the file name.
Using the web interface
- Open Application Volumes > Volumes, select the volume, and choose SnapONE File Search.
- Under Volume Selection, the application and volume are pre-filled from your selection.
- Under Filter By Snapshot ID or Filter By Snapshot Date, narrow the search to a range of snapshots (leave blank to search the full history).
- Under Search, optionally enter a path to restrict results to a folder, or a file search text to match against file names, and set how many results to return and in which order.
- Run the search.
Using the CLI
applications snapshots files get
--application=<name> --volume=<name>
[[--startSnapId=<numbers> --endSnapId=<numbers>]|[--startSnapDate=<date> --endSnapDate=<date>] --path=<name> | --fileSearch=<text>]
[--top=<numbers> --force --descendingOrder]
| Option | Description |
|---|---|
--application=<name> |
Application name. |
--volume=<name> |
Volume name. |
--startSnapId=<numbers> |
Start snapshot ID for the time period to search for files in. |
--endSnapId=<numbers> |
End snapshot ID for the time period to search for files in. |
--startSnapDate=<date> |
Start date for the time period to search for files in. |
--endSnapDate=<date> |
End date for the time period to search for files in. |
--path=<name> |
Only show files under this path. |
--fileSearch=<text> |
Search for files containing this text anywhere in the volume. |
--top=<numbers> |
Maximum number of results to return. |
--force |
Skip the confirmation prompt (the CLI suggests capping results at 1,000 if --top isn't given). |
--descendingOrder |
Sort the results in descending order. |
Examples
Find every file under reports/2024 across the volume's whole snapshot history:
applications snapshots files get --application finance --volume ledgers --path reports/2024
Search for files with "invoice" in the name, limited to the newest 50 results:
applications snapshots files get --application finance --volume ledgers --fileSearch invoice --top 50 --descendingOrder
Search only within a specific range of snapshots:
applications snapshots files get --application finance --volume ledgers --startSnapId 100 --endSnapId 150 --path reports
Searching file events
Where the file search above answers "which files exist and where", this command answers "what happened, and when" —— a chronological feed of create/change/delete/rename events for files on the volume, optionally filtered by a date range or a file-name text search.
Using the web interface
- Open Application Volumes > Volumes, select the volume, and choose SnapONE Events.
- Under Volume Selection, the application and volume are pre-filled from your selection.
- Under Filter By date, optionally narrow the search to a date range.
- Under Search, optionally filter by file name text and set the result count/order.
- Run the search.
Using the CLI
applications snapshots events get
--application=<name> --volume=<name> [--startDate=<date> --endDate=<date> --fileSearch=<text> --top=<numbers> --force --descendingOrder]
| Option | Description |
|---|---|
--application=<name> |
Application name. |
--volume=<name> |
Volume name. |
--startDate=<date> |
Start date for the time period to search for events in. |
--endDate=<date> |
End date for the time period to search for events in. |
--fileSearch=<text> |
Only show events for files containing this text anywhere in the volume. |
--top=<numbers> |
Maximum number of results to return. |
--force |
Skip the confirmation prompt (the CLI suggests capping results at 1,000 if --top isn't given). |
--descendingOrder |
Sort the results in descending order. |
Examples
Show the most recent file events on a volume:
applications snapshots events get --application finance --volume ledgers --descendingOrder
Show events involving files with "invoice" in the name over the last week:
applications snapshots events get --application finance --volume ledgers --fileSearch invoice --startDate 2026-09-15 --endDate 2026-09-22