Exsi5.5 restoration of snapshot data from a virtual machine

Exsi5.5 restoration of snapshot data from a virtual machine

With the rise of virtualization technology, many enterprises have begun to use virtualization technology. Virtualization Technology virtualizes hardware to different virtual machines. That is, a physical machine can have multiple virtual machines. However, if the physical machine fails or the storage server fails, the upper-layer virtual machine becomes unavailable. There are also reasons such as employee misoperations. These will lead to the loss of important data in the virtual machine, and the only way to make up for this data is to restore the data. What we want to talk about today is a data recovery case with incorrect VMware virtualization operations.

 

[Environment description]

1) faulty virtual machines are migrated from physical machines to exsi. After the migration is completed, a snapshot is created to prevent instability.

2) the VM runs an SQL 2005 database that records all data from January 1, 2008 to January 1, 2014.

3) There are more than 20 virtual machines on the exsi. The exsi-connected storage is an HP eva4400, and all virtual machines (including faulty virtual machines) are placed on Eva.

 

[Fault description]

Due to employee misoperations, the snapshots are accidentally restored. The snapshot was created three years ago when the migration was completed, that is, the VM was restored three years ago. This means that all the data in the past three years has been deleted, and the data is particularly important.

 

[Preparations]

Restoring a snapshot is equivalent to deleting data, which means that a portion of the underlying storage space will be released. To prevent reuse of this part of space, all virtual machines connected to this storage need to be turned off. If an important virtual machine cannot be down for a long time, it needs to be migrated to another exsi. The customer has a virtual machine, which is very important and cannot be shut down. It can only be used for hot migration. While VMware's hot migration requires the creation of more than N snapshots to complete the migration, which brings a lot of trouble to the snapshot recovery work in the future. After migrating all the virtual machines, you need to mirror the underlying Eva storage. However, the customer is worried that it takes too long to store the image. Finally, we mount Eva storage to a server in read-only mode, and restore Data in read-only mode.

 

[Solution]

Vmfs file system introduction:

VMware's own file system is called vmfs. All virtual machines are stored in this file system. By default, the entire disk is divided into 1 MB blocks in the vmfs file system, and the minimum unit allocated to the file is one block. A region in the vmfs file system describes the usage of these 1 m blocks, and each 1024 blocks (that is, 1 GB) are recorded with a map. The 1 m block recorded in this map is not necessarily continuous on the physical disk. However, all the 1 M Blocks recorded by this map must belong to the same file. It can be understood that a file is composed of 1024 blocks in N multiple maps, that is, filesize = N * map * 1024 (Block ).

 

A VMware snapshot is actually a file. Restoring a snapshot means deleting a file. In the vmfs file system, deleting a file only deletes the index of the file, but does not delete the actual data of the file and the map pointing to the data. What we need to do is to extract the idle map in the entire vmfs file system and find a map that conforms to the snapshot File Header structure in the idle map. Then, based on the structure of the snapshot file, the remaining parts of the snapshot file are extracted. After the snapshot file is extracted, You need to combine the snapshot file with the original vmdk to generate a new vmdk. The new vmdk contains all the data. Then, mount the new vmdk to explain the data.

 

[Data recovery successful]

Due to the customer's overheated migration of virtual machines, several fragments of snapshots were reused. In the final recovered data, the latest data is unavailable. However, because the customer's data is a database and backed up twice a day, the latest data is unavailable, but the backup data is available, the customer still accepts the recovery results. The entire recovery process takes two days, including database verification.

 

With the rise of virtualization technology, more and more enterprises begin to apply virtualization technology. With the increasing number of virtualization failures, virtualization data recovery technology is available in few companies in China.

 

Deng Qi (North Asia server data recovery Engineer)

Email: [email protected]

Contact info: 010-4006505808-801