Restore deleted files under Linux

Transferred from: http://github.tiankonguse.com/blog/2015/09/13/linux-remove-recovery/

In the afternoon, the DBA came to me to say that some SQL was executed for two hours, causing a lot of delays in master-slave synchronization.

In the evening, a colleague is going to go and do a one-month project to tidy up a good handover. The result is that when you delete a file that is not used, the path has a space that causes the entire item's code to be deleted, and the pit Daddy is never filed with SVN.

Fight till the Dawn

For that project, the editor said the question, and I knew where the problem was.

When the colleague made that logic, I gave him two points to note: 1. Note the modification time 2. Refer to the batch operation logic of the energy bottle for the batch operation.

I pulled SVN, looked at the relevant code, I have nothing to say in my heart, I confessed to the attention of the point he did not do as I said.

No matter how much, fix the problem first, then find the test, leader, director, operation and maintenance of a layer of approval, finally released, waste a lot of energy and time.

DBA Find me time, I guess is autodata problem, after all, autodata inside are all kinds of like, lvalue, subquery and other SQL statements.

But I looked a little bit, found that the SQL source is not autodata, so quickly check the source IP, and then check the IP machine belongs to who is responsible.

The results found that the search team was responsible, so pull the group's operations, team leader and others.

Later, the problem is serious to master-slave synchronization delay of two hours, so the search team to stop the related tasks, the DBA manually kill the relevant SQL, only to be mitigated.

Later, slowly back to normal.

When the colleague accidentally deleted the item, I thought it was a mistake to clear the CMake temporary file, resulting in the mis-operation of the project. For example, there is a bulid directory, you want to delete bulid under the things, usually into the Bulid directory, and then delete it.

 kyyuan @skyyuan-pc3:test $ tree.├──bulid│└──tml└──file1 directory, 2 Filesskyyuan @skyyuan-pc3:test $ CD bulid/skyyuan @skyyuan-PC3 :bulid $ rm-rf *skyyuan @skyyuan-pc3:bulid $ CD. Skyyuan @skyyuan-pc3:test $ tree.├──bulid└──file1 directory, 1 file  /span>                

But this colleague did not enter the relevant directory, and then through the path to delete.

skyyuan@skyyuan-PC3:test $ touch bulid/tmpskyyuan@skyyuan-PC3:test $ tree.├── bulid│ └── tmp└── file1 directory, 2 filesskyyuan@skyyuan-PC3:test $ rm -rf bulid/*skyyuan@skyyuan-PC3:test $ tree.├── bulid└── file1 directory, 1 file

In that case, you can delete the file, but if you accidentally hit a space in front of the asterisk, the consequences would be disastrous.

skyyuan@skyyuan-PC3:test $ touch bulid/tmpskyyuan@skyyuan-PC3:test $ tree.├── bulid│ └── tmp└── file1 directory, 2 filesskyyuan@skyyuan-PC3:test $ rm -rf bulid/ *skyyuan@skyyuan-PC3:test $ tree.0 directories, 0 files

Presumably this colleague is in the management of the project, is similar to the tragedy.

Fortunately, the machine has two disks, the system is on a small disk, and the data is on a large disk. Here you can unload the large disk to slowly recover the data.

[Email protected]:[~]: parted--listdisk/dev/vda:19.3gbnumberStartend size Type File system flag 1 9994MB 9994MB primary ext3 start 2 9994MB 12.1GB 2147MB primary 3 12.1GB 19.3GB 7181MB primarydisk/dev/vdb: 195GB number start end size Type File system Flag 1 32.3kb 195GB  195GB primary ext3            

Online Search for Linux file recovery, the search is foremost, extundelete, scalpel, TestDisk, Phtorec and other related tutorials.

After trying to find are not ideal, and then add ext3 this keyword, found ext3grep this tool.

Then download the source installation.

wget https://ext3grep.googlecode.com/files/ext3grep-0.10.2.tar.gztar zxvf ext3grep-0.10.1.tar.gzcd ext3grep-0.10.1./configuremakemake install

Then unmount the disk.

root@10.123.10.23:[/]: df -k文件系统             1K-块      已用      可用 已用% 挂载点/dev/vda1              9606084   5634124   3483988 62% /tmpfs 8085312 880 8084432 1% /dev/shm/dev/vdb1 187846260 88430136 89874096 50% /dataroot@10.123.10.23:[/]: fuser -k /dataroot@10.123.10.23:[/]: umount /data

Then scan all the nodes on the disk. It will probably run for a few 10 minutes.

--ls --inode 2Running ext3grep version 0.10.2WARNING: I don‘t know what EXT3_FEATURE_COMPAT_EXT_ATTR is.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.Number of groups: 1456Loading group metadata... doneMinimum / maximum journal block: 23790082 / 23823397Loading journal descriptors... sorting... done......

Looking at the node one scan, the heart gradually stabilized.

Suddenly found such an error:

‘locate_output‘. See locate.ccERROR: dir_inode_to_block(1589385) returned -1.ext3grep: init_directories.cc:82: bool init_directories_action(const ext3_dir_entry_2&, const Inode&, bool, bool, bool, bool, bool, bool, Parent*, void*): Assertion .已放弃

Heart inside a surprised, hurriedly Google what is going on Google Group on the need to add --accept-all parameters.

Added after the discovery or existence of such a problem, some people say that the old file deleted, so delete again, do not report this error.

Root@10.123.10.23:[/recovery]: ll total dosage 2808-rw-r--r--1 root root 124904 September 18:08 scan.log-rw-r--r--1 root root 2737 031 September 17:27 Vdb1.ext3grep.stage1[email protected]:[/recovery]: MV Vdb1.ext3grep.stage1 Vdb1.ext3grep.stage1.bak01root@10. 123.10.23:[/recovery]: ll total dosage 2808-rw-r--r--1 root root 124904 September 13 18:08 scan.log-rw-r--r--1 root root 2737031 September 17:27 Vdb1.ext3grep.stage1.bak01[email protected]:[/recovery]: EXT3GREP/DEV/VDB1--accept-all--ls--inode 2 > Scan.logwarning:failed to open file  ' Locate_output '. See Locate.ccroot@10. 123.10.23:[/recovery]:       

Then generally we recover files by name, so we need to find our files first.

root@10.123.10.23:[/home/skyyuan/test]: ll screenshot_hash.cpp -rwxr--r-- 1 skyyuan users 730 9月 9 11:01 screenshot_hash.cpp[email protected]:[/recovery]: ext3grep /dev/vdb1 --dump-names | grep screenshot_hash.cppskyyuan/skyyuan/.vim/view/~=+test=+screenshot_hash.cpp=skyyuan/test/screenshot_hash.cppskyyuan/test/screenshot_hash.cpp~

At this point we can search for a file path that can be recovered and then restore it.

[Email protected]:[/recovery]: ext3grep/dev/vdb1--restore-file skyyuan/test/screenshot_hash.cpprunning ext3grep version 0.10.2warning:i don ' t know what EXT3_FEATURE_ Compat_ext_attr is. Warning:ext3_feature_incompat_recover isSet. This either means that your partitionis still mounted,and/or the file systemIsIn a unclean state.Numberof groups:1456minimum/maximum Journal Block:23790082/23823397Loading journal descriptors sorting ... donethe oldest inode block thatis stillIn the journal, appearsTo ISFrom13246709 = Wed June315:38:291970JournalTransaction884563 wraps around,Some data blocks might have been lostof thisTransaction.Numberof descriptorsIn Journal:31536; Min/max sequence numbers:883887/885058writing output to directory restored_files/loading Vdb1.ext3grep.stage2 ..... ......................................................................................................................... ... erestoring Skyyuan/test/screenshot_hash.cpp[email protected]:[/recovery]: ll total dosage 16992drwxr-xr-x 3 root Root 4096 September 18:23 restored_files-rw-r--r--1 root root 325248 September 18:19 scan.log-rw-r--r--1 root root 2737059 September 18:18 vdb1.ext3grep.stage1-rw-r< c2>--r--1 root root 2737031 September 17:27 vdb1.ext3grep.stage1.bak01-rw-r--r--1 root root 11554133 September 18:19 vdb1.ex T3grep.stage2[email Protected]:[/recovery]: ll restored_files total dosage 4drwxr-x---3 root root 4096 September 18:23 Skyyuan[emai L Protected]:[/recovery]: Tree restored_files/restored_files/└──skyyuan└──test└──screenshot_hash.cpp2 directories, 1 file   

When we're done, we'll hang up the disk.

mount /dev/vdb1 /data

Finally, after compiling the program, run to find the normal, nothing, hurriedly submit svn.

Tail notes

This Friday, has been busy to the midnight more than 2 to go back, these accidents and problems actually have nothing to do with me, but joined in to learn a lot of things.

Ext3grep source I have saved a copy on my GitHub, interested in the source code can be seen since.

Restore deleted files under Linux