Recover lost data from Linux reiserfs file system corruption

Before introducing the recovery process, a brief explanation of the failure situation, the failure is an IBM X3850 server, the server is composed of 4 146G SAS hard disk RAID5 as storage media, the operating system is SuSE LINUX, the file system is all reiserfs. We first analyzed and found that the previous hard disk data organization structure is a boot partition of less than 100M, followed by a 271G LVM volume, followed by 2G swap partition. The LVM volume directly divides a ReiserFS file system as the root partition.

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/8F/A3/wKiom1jnRMzRuh9aAACTiihD0a8404.jpg-wh_500x0-wm_ 3-wmp_4-s_3874696808.jpg "title=" 2.jpg "alt=" Wkiom1jnrmzruh9aaactiihd0a8404.jpg-wh_50 "/>

Users in the process of use, the system encountered unknown causes and paralysis, after the collision of the system found that the entire raid logical volume into the front 2G boot and swap partitions, followed by 271G of LVM volume, the LVM volume file system location has an empty ReiserFS super block.

The data we are going to restore this time is all the user data in the original 271G file system, which contains all the Office documents in the MySQL database, the Pgsql database, the website program and Web page, the unit OA system.

We first determined the original ReiserFS partition location by the association between the whole ReiserFS tree node, and found that the first 2G data of the filesystem that originally stored the data had been overwritten, it should be the user incorrectly initialized the partition structure when installing the system. So install the system cannot import LVM volume and did reiserfsck try to fix. Since the ReiserFS file system is linearized for all files in the file system (including directories), and then a B + tree is generated with the file key, the tree's increasing node will result in a smooth migration of the tree structure to the entire data area of the disk after the overall pull-out. This way, top-level nodes are typically not placed at the front of the file system. Because the root directory of the file key is usually the smallest, so, in terms of space, the most storage in the top 2G should be from the root start path closest to the key node, so that user data due to the depth of the directory hierarchy, the possibility of a node is very high. The data covered by the top 2G is no longer recoverable and you only want to avoid overwriting user data exactly. Because the index of the whole tree is lost in front of the file system, and the tree concept of reiserfs is very abstract, it is difficult to re-build the tree.

650) this.width=650; "src=" https://s2.51cto.com/wyfs02/M01/8F/A3/wKiom1jnRQyz3Cc7AAIxcGqLMJY507.jpg "title=" geometry stereoscopic. jpg "width=" "height=" "border=" 0 "hspace=" 0 "vspace=" 0 "style=" width:600px;height:600px; "alt=" Wkiom1jnrqyz3cc7aaixcgqlmjy507.jpg "/>

We perform a key node scan throughout the original file system area through our own program and export all nodes. Then, through the autonomic program to re-order all the leaf nodes, filter (remove the deleted files before deleting the node), regenerate two, three, four, and other leaf nodes. Select the 2G space in front of the partition as the structure of the new tree (this part of the data is useless anyway, the reload system is full), and generate the corresponding address information. Address directory naming problems, such as encountering a node in the original tree path is missing, it is named after a custom key node number, such as cannot determine its parent directory, temporarily join/otherfiles. Depending on the face, generate tree index information, write to a specific location, and then, based on that information, generate the Super block and set the clear flag. Under the SuSE virtual machine, create a snapshot, mount the repaired volume, and you can already see the file. (Note: The purpose of the virtual machine and the snapshot in order to operate can be retroactive, and because bitmap and other metadata does not affect the data, did not modify, it is not allowed to do reiserfsck before mounting). Under the repaired SuSE virtual machine, mount the target hard disk for copy data, and MKFS all data to the target disk after the The user organizes the required data through the Find command, correcting the location and name of some directory files. Partially lost scattered files, by size with the file header flag, find and then move and rename.

Fortunately, all of the important data 100% have been found by us. The non-intuitive nature of the tree coupled with the program debugging, so that the whole recovery work unusually complicated, in the Fanluan information tree with to follow, it is really annoying, fortunately survived. Data recovery analysis of complex locks it's not a man's job.

。。。

Should let the machine dry ^_^

This article is from the "SUN" blog, be sure to keep this source http://sun510.blog.51cto.com/9640486/1913864

Recover lost data from Linux reiserfs file system corruption