Data recovery process records for Linux ReiserFS file system corruption

[Data recovery failure description]

An IBM X3850 server, composed of 4 146G SAS hard drives RAID5 as storage media, operating system for SuSE LINUX, file system is all reiserfs.

After analysis that: the previous hard disk data organization structure: a less than 100M boot partition, followed by a 271G LVM volume, after the 2G of the swap partition. The LVM volume directly divides a ReiserFS file system as the root partition.

The user is in use process, system unknown reason paralysis.

After reloading the system, the entire RAID logic volume becomes the boot and swap partition of the front 2G, followed by the 271G LVM volume, and an empty ReiserFS super block in the file system location on the LVM volume.

Required to restore the original 271G file system in all user data, data are MySQL database, pgsql database, Web site procedures and Web pages, Units OA system in all Office documents.

[Data Recovery analysis]

1, through the overall reiserfs tree Node association between the original ReiserFS partition location, to determine that the original storage data file system before 2G was overwritten.

2, the user should be installed in the system incorrectly initialized the partition structure, after the system installed, found unable to import LVM volume, had done reiserfsck tried to repair.

3, because the ReiserFS file system in the file system of all files (including directories) after linearization, with file key to generate B + tree, the tree growing nodes, will cause the structure of the tree as a whole pull the entire disk data area to do smooth migration, so that the top-level node is usually not placed at the front of the file system. Because the root of the file key is usually the smallest, so from the space, the first 2G storage should be the most recent key node from the root start path, so that user data because of the depth of the directory hierarchy, the possibility of node existence is very high.

4, the first 2G overwritten data can not be restored, can only hope that do not overwrite user data exactly.

5, because the file system before the whole index of the entire tree lost, coupled with the reiserfs of the tree concept design is very abstract, it will be difficult to build trees.

[Data recovery process]

1, through the autonomous program in the entire original file system region for key node scan, all nodes exported.

2, through the autonomous program to all leaf node reordering, filtering (remove the deleted files before removing the node), regenerate two, three, four-level and other leaf nodes. Select 2G space in front of the partition as the structural area of the new tree (anyway this part of the data is useless, the reload system is full), and generate the corresponding address information. To address the problem of directory naming, such as the loss of a node in the original tree path, it is named with a custom key node number, such as unable to determine its parent directory, temporarily joined/otherfiles.

3, according to the face, generate tree index information, write a specific location, and then based on this information, generate super block, set clear flag.

4, under the SuSE virtual machine, create a snapshot, mount a repaired volume, you can already see the file. (Note: Virtual machine and the purpose of the snapshot in order to operate can be traced, at the same time because the bitmap and other metadata does not affect the data, did not make amendments, it can not be done before the reiserfsck).

5, under the repair of the SuSE virtual machine, mount the target hard disk for copy data, MKFS all data CP to the target disk.

6, the user through find command to organize the required data, modify the location and name of some directory files.

7, part of the missing scattered files, according to the size and file Head logo lookup, find the move and rename.

[Data Recovery Results]

1, fortunately important data 100% restore success.

2, the tree is not intuitive plus the debugging of the program, so that the entire recovery work lasted 3 days, in the Fanluan of the information tree to follow, really annoying, fortunately survived.

Essay

Data recovery and analysis of complex lock It's not a man's job.

。。。

You should let the machine dry ^_^