1. A method for restoring a file which has been deleted from a data storage system, comprising: determining if the file was deleted from an active file system of the data storage system; creating, in response to the deleted file having been deleted from the active file system, a set of twin pointers by copying from latest pointers in the active file system before the file was deleted; creating a new set of pointers; comparing a pointer from the twin pointers with a pointer from a snapshot of the active file system, the snapshot being a consistency point of the active file system at a time earlier than the deletion of the file; writing, in response to the pointer from the twin pointers pointing to a same data block as the pointer from the snapshot, the twin pointer into the new set of pointers; determining, in response to the pointer from the twin pointer not pointing to the same data block as the pointer from the snapshot, if the block pointed to by the twin pointer is allocated in the active file system; copying, if the block is allocated in the active file system, a data of the block to a new block in the active file system, to restore the file to data changed since the snapshot was taken; copying, if the block is not allocated in the active file system, pointers of the snapshot to the set of new pointers, to restore the file to data of the snapshot; and writing the new set of pointers into the active file system to restore the file to the active file system.