The timestamp (1614575293790) in the snapshot directory name is equivalent to 1 March 16:08 GMT:
actually I found a lot of .db files in the following directory: > > /var/lib/cassandra/data/mykespace/mytable-2795c0204a2d11e9aba361828766468f/snapshots/dropped-1614575293790- > mytable > which lines up nicely with this log entry: > 2021-03-01 06:08:08,864 INFO [Native-Transport-Requests-1] > MigrationManager.java:542 announceKeyspaceDrop Drop Keyspace 'mykeyspace' > In any case, those 2 pieces of information are evidence that the keyspace didn't get randomly dropped -- some operator/developer/daemon/orchestration tool/whatever initiated it either intentionally or by accident. I've seen this happen a number of times where a developer thought they were connecting to dev/staging/test environment and issued a DROP or TRUNCATE not realising they were connected to production. Not saying this is what happened in your case but I'm just giving you ideas for your investigation. Cheers!
