Linux system mistakenly delete KVM virtual machine Data recovery Method-data Recovery success story

one, virtual machine failure Environment Description
The client's physical machine operating system is a Linux system, and the file system is the EXT4 file system. The KVM virtual machine on it is deleted, each virtual machine contains a disk file in Qcow2 format, and a disk file of approximately 1.2T in raw format, mainly to restore RAW format disk files. Customer has backed up on their own.

Virtual Machine 1: Primary database server
Virtual Disk: 10G system disk (QCOW2) +1.2T data Disk (raw, primary recovery)
File system: EXT4
Key data: MySQL Database

Virtual Machine 2: Backing up the database server
Virtual Disk: 10G system disk (QCOW2) +1.2T data Disk (raw, primary recovery)
File system: EXT4
Key data: MySQL Database

Virtual Machine 3: Code server
Virtual machine Disk: 10G system disk (QCOW2) +1.2T data Disk (raw, primary recovery)
File system: EXT4
Main Data: Program code

Second, the virtual machine data recovery process
1, analyze the EXT4 file system, locate the node location of the deleted virtual machine disk files;
2, get the index information of the disk file residue;
3, check the correctness of residual index information, repair the index of the non-serious damage;
Figure for information such as the index obtained:

Virtual machine Data Recovery Case 1
4, after the completion of the repair, to resolve the remaining levels of the index, from the virtual machine is located in the volume to extract virtual disk files;
5, according to the extraction of virtual disk files, to obtain the volume is not indexed to the free space;
6. Verify the correctness and completeness of the extracted disk files.
7, from the free space to obtain effective information, try to repair the virtual disk files (such as nodes, directory items, database pages and other information).
The diagram shows the free space extracted:

Virtual machine Data Recovery Case 2

Third, data recovery results
1, because the index is missing, the extracted virtual disk file is not complete, for the database server, the database file is lost, you can get the database page from the free space to repair the database file, but because part of the area of the page is covered, only as much as possible to fill the page;
2, for the server in the program code of the node and directory items are missing, if the node or directory items are left, you can try to complement the node and directory entries. However, it is found that the node and directory entries of some files are missing at the same time, which is not possible in this case, depending on the attributes associated with the node and directory entries. Another according to the program code file characteristics, does not have a certain regularity, if its data area is missing, can not be filled.
The figure shows a partial directory structure that is recovered:

Virtual Machine Data Recovery Case 3

Virtual Machine Data Recovery Case 4

Iv. Validation of data
After attempting to patch the virtual disk file and its database files as much as possible, the data is validated by the customer. The data is partially lost and cannot be recovered, but the overall is acceptable and data recovery is effective.

Linux system mistakenly delete KVM virtual machine Data recovery Method-data Recovery success story