Recover virtual machine disk file loss by spelling database fragmentation

Background overview

due to sudden power outage of the server, my company A VPS (that is, a Xen server virtual machine) is unavailable in the Xen server server and the virtual disk file is missing . The hardware environment is a h710p raid card with a Dell 720 server, a RAID 10 consisting of 4 Seagate 2T stat hard drives, a Xen Server 6.2 version operating system, and a virtual machine that is a Windows server 2003 system, 10G system disk + 5G data disk two virtual machine disks, the upper layer is the Web server (ASP + SQL 2005 site architecture). The North Asia Data Recovery Centre was contacted by telephone for recovery and two colleagues were stationed at the site.

Analyze the cause of the failure

of our Data Disk was first Connect to North Asia Recovery Environment Server, and then exceed the total capacity of the hard disk space will be The data disk is mirrored to the backup space in the disk's underlying sector.

because The disks of the virtual machines in the Xen server server are stored in the structure of the LVM( that is, each virtual machine's virtual disk is a LV, and the virtual disk is in compact mode .) Information about LVM is documented in Xen server, and the information about LVM under "/etc/lvm/backup/frombtye.com" is found to be free of corrupted virtual disk information. It is therefore possible to conclude that LVM information has been updated. Then analyze the bottom to see if we can find the LVM information that has not been updated, and have not yet updated the LVM information at the bottom.

Figure 1:

The data region of the virtual disk was found based on the LVM information that was not updated, but unfortunately the data for that region has been compromised. After analysis, it was found that the final reason for the unavailability of the virtual machine was because the virtual machine's virtual disk was destroyed, resulting in the loss of operating system and data in the virtual machine. This is likely to occur when a virtual machine encounters a network attack or a malicious program is left behind by a hack intrusion. After careful checking of the area, it was found that many of the data in the area were destroyed, but the page fragments of many databases were found. You can therefore try to make the page fragments of many databases into one available database.

Treatment methods:

1, the implementation of the programme one

According to the idea of scenario one of the underlying analysis, according to the structure of RAR compression package can find a lot of compressed packet data start position, and the RAR compressed package file in the first sector will record the file name of this RAR. As a result, we can find the starting location of the backup database compressed package According to the file name of the archive that we provided to the backup database and the location of the compressed package currently found. After locating the location of the compressed package, carefully analyze the data in this area and then restore the data from this area to a compressed file in a RAR format. Then try to unzip the package and find the decompression error.

Figure 2:

the reason for extracting the error is Some of the data has been compromised. then began to try to use RAR Repair tool to see if you can ignore the error decompression part of the data , the results of the decompression after the completion of the database only part of the site code, and there is no database backup files. It is therefore possible to determine that the backup file of the data is corrupted in the RAR compression package.

Figure 3:

2. Implementation Plan II

Since the database was not recovered in conjunction with the programme , another programme had been adopted . Based on the structure of the SQL Server database to go to the beginning of the underlying analysis database, in the structure of the database, the 9th page will record the database name. Therefore, after the name of the database is provided , the initial location of the database is found in the underlying analysis. Because database page numbers and file numbers are recorded in each page of the database, you can write programs based on these features to scan the underlying data that conforms to the database page.

The scanned fragments are then re-formed in order to form a complete MDF file, and then the MDF check program detects the integrity of the entire MDF file.

Figure 4:

3. Verifying data

After testing, the database environment is built, and the reorganized database is attached to the built database environment. Then query whether the related table data is normal, and query whether the latest data exists.

Figure 5:

4. Conclusion

Because the database needs to be combined with site code to better verify the integrity of the database. We also Developer Place get the site code to build up the environment and then restore the good database sent to us to verify that everything is OK, The database is successfully recovered by the way the database is fragmented, and the entire data is restored successfully.

Recover virtual machine disk file loss by spelling database fragmentation