This is a short description about how to recover a single or multiple files from a ZFS snapshot on FreeBSD. The same trick might work on Linux, I haven’t tried, if you did please let me know.
All the snapshot data is stored under .zfs/snapshot directory within the root of the file system, for example:
steve@giantoctopus ~ % ls -lah /var/crash
total 10
drwxr-x— 3 root wheel 3B Sep 17 2016 .
drwxr-xr-x 28 root wheel 28B Jun 29 18:54 ..
dr-xr-xr-x 3 root wheel 3B Sep 17 2016 .zfs
-rw-r–r– 1 root wheel 5B Sep 13 2016 minfree
steve@giantoctopus ~ % ls -lah /var/log/.zfs
total 9
dr-xr-xr-x 3 root wheel 3B Sep 17 2016 .
drwxr-xr-x 11 root wheel 172B Jul 6 21:00 ..
dr-xr-xr-x 5 root wheel 5B Jun 29 18:54 snapshot
steve@giantoctopus ~ % ls -lah /var/log/.zfs/snapshot
total 26
dr-xr-xr-x 5 root wheel 5B Jun 29 18:54 .
dr-xr-xr-x 3 root wheel 3B Sep 17 2016 ..
drwxr-xr-x 10 root wheel 172B Jun 17 14:00 week24
drwxr-xr-x 10 root wheel 172B Jun 23 19:00 week25
drwxr-xr-x 10 root wheel 172B Jun 29 17:00 week26
steve@giantoctopus ~ % ls -lah /var/log/.zfs/snapshot/week24
total 750
drwxr-xr-x 10 root wheel 172B Jun 17 14:00 .
dr-xr-xr-x 5 root wheel 5B Jun 29 18:54 ..
-rw-r–r– 1 root wheel 73B Oct 27 2017 aculog
-rw-r–r– 1 root wheel 8.5K Jun 14 03:34 apcupsd.events
-rw——- 1 root wheel 64K Jun 17 15:38 auth.log
-rw——- 1 root wheel 7.1K May 4 21:00 auth.log.0.bz2
-rw——- 1 root wheel 8.9K Apr 15 17:00 auth.log.1.bz2
-rw——- 1 root wheel 9.0K Mar 17 17:00 auth.log.2.bz2
-rw——- 1 root wheel 8.7K Feb 4 2017 auth.log.4.bz2
-rw——- 1 root wheel 9.5K Dec 29 2016 auth.log.5.bz2
-rw-r–r– 1 root wheel 72K Sep 17 2016 bsdinstall_log
-rw——- 1 root wheel 60K Jun 17 15:38 cron
-rw——- 1 root wheel 3.7K Jun 17 12:00 cron.0.bz2
-rw——- 1 root wheel 3.8K Jun 17 06:00 cron.1.bz2
-rw——- 1 root wheel 3.6K Jun 17 00:00 cron.2.bz2
…
However by default .zfs directory is hidden, you can’t even see it with ls -la. This must be set by zfs as follows:
zfs set snapdir=visible zroot
Then if you want to hide it again: zfs set snapdir=hidden zroot. Don’t forget to replace zroot with your own pool’s name.
More information can be found here: https://www.freebsd.org/cgi/man.cgi?query=zfs
Update: it was brought to my attention that you don’t even have to set snapdirs to visible to be able to cd to .zfs or copy files from it, thank you @MacLemon!
2020.04.22 Update
This directory can also be found under /.zfs