CentOS Recovery RM-RF * Delete data by mistake

One, mount the disk partition as read-only

This step is important and you should mount the disk as read-only as soon as possible after deleting the file by mistake. The sooner you do it, the greater the chance of success in recovery.

1. See which partition the deleted files are in

[Root@localhost ~]# Mount
/dev/mapper/volgroup-lv_root on/type ext4 (rw)
/dev/mapper/volgroup-lv_home on/home type EXT4 (rw)

2. Try to re-mount the corresponding directory as read-only

[Root@localhost ~]# mount-r-n-o remount/home
Mount:/home is busy

3. If show xxx is busy

[root@localhost ~]# fuser-v-m/data

Find the relevant process, kill.

4. Successfully mount the directory as read-only

[Root@localhost ~] # mount-r-n-o remount/home

When you touch a file in the/home directory, an error is displayed:

[Root@localhost ~] # Touch txt
Touch:cannot Touch 'txt ': Read-only file system

Ii. using data recovery tools Extundelete

Previously tried Debugfs + DD, no results.

Later installed extundelete-0.2.4,:

1. Download

(1) Because SourceForge by the wall, the server directly wget unsuccessful, so only in the local FQ download, the link is as follows:

http://superb-dca2.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

(2) Place the downloaded file on the server

Start the local nginx, and then wget on the server (of course, by other means, as long as it can be uploaded to the server):

wget/http/native ip/extundelete-0.2.4.tar.bz2

(3) Decompression

Tar jxf extundelete-0. 2. 4. tar.bz2

2. Compiling

(1) Configure

[Root@localhost extundelete-0.2.4]#./configure

Configure times wrong, looked at the next config.log, determined that the machine is not compiled environment.

Yum-y Install gcc+gcc-c++

Wait, a little slow.

After the installation is complete, again config, still error

Configuringextundelete 0.2.4
Configure:error:Can ' t find ext2fs Library

This is because Extundelete relies on e2fsprogs.

After installing E2fsprogs again configure, success.

[Root@localhost extundelete-0.2.4]# Yum Install E2fsprogs-devel
[Root@localhost extundelete-0.2.4]#./configure
Configuring Extundelete 0.2.4
Writing generated FilesTo disk

(2) Make & make Install

[Root@localhost extundelete-0.2.4] #make & make Install

If there is no exception information, the basic instructions are installed successfully.

(3) can be verified by the src directory .

[Root@localhost extundelete-0.2.4]# cd src
[Root@localhost src]#./extundelete
No Action specified;implying--superblock.
./extundelete:missing device Name.
Usage:./extundelete [Options] [--] Device-file
.............

[Root@localhost src]#./extundelete-v

Extundelete version 0.2.4

LIBEXT2FS version 1.41.12

Processor is Littleendian.

The above information proves that the installation was successful.

Only then does the data recovery really begin.

Third, mount the new hard disk

(If the original server disk space is large enough, you can skip this step.) ）

Because the data that was mistakenly deleted is very large (about 200G), there is no disk space on the physical machine where the original server resides. Because of the need to remotely mount another server B on the disk, B is the Xen virtual machine, the space is not enough, but the physical machine on which there is disk space, you need to separate space from the host to B.

1 mount a disk to B on Xen

Because it is a graphical operation, it is no longer elaborate. Just allocate a large enough space to do it, I chose 300G.

2 Log on to Server B and prepare to mount the new disk.

(1) to see if the new disk is mounted

[Nmen@dev-ubuntu-server] ls /dev/sd*
/dev/sda/dev/sda1/dev/sda2/dev/sda5/dev/sda6/dev/sda7/dev/sda8/dev/sdb

/dev/sdb is indeed mounted.

The new disk is neither partitioned nor formatted, so you need to do both things first.

(2) partitioning

It is the hard disk of HDB, and the disk of SDB is the same operation.

(This image is from: http://www.shyw.net/bbs/yxt443333-1-1.html)

(3) formatting

[nmen@dev-ubuntu-server]:~$ sudo mkfs-t ext3/dev/sdb1
MKE2FS 1.41.11 (14-mar-2010)
Filesystem label=
OS Type:linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
22937600 inodes, 91749215 blocks
4587460 blocks (5.00%) reserved forThe Superuser
First Data block=0
Maximum filesystem blocks=4294967296
2800 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock Backups Storedon Blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968

Writing inode tables: Done
Creating Journal (32768 blocks): Done
Writing Superblocks and filesystem accounting Information: Done

This filesystem'll beautomatically checked every mounts or
Whichever comes first. Usetune2fs-c or-i to override.

Displays the above information stating that the formatting was successful.

(4) Setting the volume label

sudo e2label/dev/sdb1/restore

(5) mounting

[nmen@dev-ubuntu-server]:~$ Mkdir/restore
[Nmen@dev-ubuntu-server]: ~ $ mount-vl-t Ext3/dev/sdb1/restore

Now that the new hard drive is mounted on server B, there is enough room to store the data to be recovered.

Iv. Remote Mount via NFS

Through the network, the remote Host B shared file system, mounted to the need to do data recovery machine A.

1. Install NFS on Server B

(1) installation

B is the Ubuntu system, and NFS is not installed by default.

# sudo apt-getinstall nfs-kernel-server

(2) configuration

Modify/etc/exports and add the following statement.

#/etc/exports:the AccessControl list for filesystems which could be exported
# TONFS clients. See Exports (5).
#
# Example for NFSv2 andNFSv3:
#/srv/homes hostname1 (Rw,sync,no_subtree_check) hostname2 (Ro,sync,no_subtree_check)
#
# Example for NFSv4:
#/srv/nfs4 gss/krb5i (Rw,sync,fsid=0,crossmnt,no_subtree_check)
#/srv/nfs4/homes gss/krb5i (Rw,sync,no_subtree_check)
#
/restore * (Rw,sync,no_root_squash,no_subtree_check)

which

/restore -a directory that needs to be shared with the client;

* --Indicates that any host can access this directory, or can specify IP;

(W,sync,no_root_squash,no_subtree_check) --Configure the client's permissions;

Because it is temporarily used, and the server is located in the intranet, the settings are relatively arbitrary.

(3) make configuration effective

# EXPORTFS–RV

#/etc/init.d/nfs-kernel-serverrestart

(4) Verify the configuration is successful

Displays a list of NFS server output directories:

Nmen@dev-ubuntu-server:showmount-e
Export list for Chinahrd-ubuntu-dev:
/restore *

(5) firewall

Because the time is urgent, and is the intranet, so temporarily shut down the firewall on B:

sudo ufw disable

You can enable the firewall with the following command:

sudo UFW enable

2. Mount the remote directory on server A

Mount the/restore directory from server B to/mnt.

Mount-t NFS [B's Ip]:/restore/mnt

The commands are detailed below:

# mount-t NFS [-omount-options] Server:/directory/mount-point

-O mount-options
Specifies the mount option that can be used to mount the NFS file system.
Server:/directory
Specifies the server host name that contains the shared resource, and the path to the file or directory to mount.
/mount-point
Specifies the directory where you want to mount the file system.

V. Data recovery

1. Approximate time to get deleted

This step is not required, but this helps to respond faster to the data you want.

Date -D "Fri Apr 15:40:00" +%s
1397202000

1397202000 This time value, we will use later.

2. View deleted files

# extundelete/dev/sdb1--inode 2

Filename | Inode number | Deleted status

. 9

.. 11

Lost+found Deleted

Data Deleted

When a partition is mounted to a directory, the Inode value for the "root" directory is typically 2.

The status of deleted is the deleted file.

3. Data recovery

Enter the remote directory/restore of the new Mount;

Specify--after "1397202000", which indicates the recovery of files after this point in time;

The file is restored to the Recovered_files directory in the current directory by default.

Cd/restore
[root@localhost restore]#[extundelete installation path]./extundelete--restore-all--after "1397202000"/dev/mapper/VolGroup-lv _home

Only show and processdeleted entries if they is deleted on or after 1397202000 and before9223372036854775807.

Notice:extendedattributes is not restored.

Loading Filesystemmetadata ... 6924 groups loaded.

Loading journaldescriptors ... 27149 descriptors loaded.

Searching for recoverableinodes in directory/...

696 recoverable inodesfound.

Looking through thedirectory structure for deleted files ...

Unable to restore inode27394319 (VMWARE/9.50_PS/9.55LOCATE.VMX.LCK): Space has been reallocated.

Unable to restore inode27402241 (VMWARE/9.35WIN7/9.35WIN7.VMX.LCK): Space has been reallocated.

Unable to restore inode27396032 (VMWARE/9.35WIN7/9.35WIN7-SNAPSHOT1.VMSN): No undeleted copies FoundIn the journal.

Unable to restore inode27394051 (VMWARE/9.36WIN2008/9.36WIN2008R2.VMX.LCK/E00633.LCK): Space has beenreallocated.

Unable to restore inode27394603 (LOST+FOUND/E09292.LCK): Space has been reallocated.

8 recoverable Inodesstill lost.

In general, wait a long time ...

CD restore/recovered_files$
Ls
110_open_dns 111_open_dns_node1 112_dns_node2 116_SVN

The deleted files came back, so relieved.

Vi. concluding work

(1) re-mount the disk on a to read and write:

[Root@localhost src]# mount-o remount, rw/home/

Uninstall the directory on Server B.

(2) turn on B 's firewall.

sudo UFW enable

(3) enable aliases on the rm command on a to prevent silent deletion.

Vi/etc/bashrc

Source/etc/bashrc

# do not delete/or promptif deleting more than 3 files at a time #
Alias rm= ' Rm-i--preserve-root '

# confirmation #
Alias mv= ' mv-i '
Alias cp= ' cp-i ' Alias ln= ' Ln-i '

# Parenting changing Permson/#
Alias chown= ' Chown--preserve-root '
Alias chmod= ' chmod--preserve-root '
Alias chgrp= ' Chgrp--preserve-root '

(4) use Rsyncon Bto back up the data on A regular basis .

Reference: http://abloz.com/2013/09/12/linux-rm-rf-file-recovery-record.html

?

CentOS Recovery RM-RF * mistakenly deleted data (RPM)