Restore rm from CentOS and rm from centos

Source: Internet
Author: User

Restore rm from CentOS and rm from centos


  • I. Mount the disk partition as read-only

    This step is very important, and the disk should be mounted as read-only as soon as possible after the file is deleted by mistake. The sooner you start the process, the higher the chances of successful recovery.

     

    1. Check the partition in which the deleted file is located.

    [root@localhost  ~]# mount
    /dev/mapper/VolGroup-lv_root on / type ext4(rw)
    /dev/mapper/VolGroup-lv_home on /home type ext4(rw)

    2. Try to remount the corresponding directory as read-only

    [root@localhost  ~]#  mount -r -n -o remount /home
    mount: /home is busy

     

    3. If xxx is busy

    [root@localhost  ~ ]# fuser -v -m /data

    Find the relevant process and kill it.

     

    4. The directory is successfully mounted as read-only

    [root@localhost  ~ ] #  mount -r -n -o remount /home

    When the touch file in the/home directory is displayed, the following error occurs:

    [root@localhost  ~ ] # touch txt
    touch: cannot touch `txt’: Read-only file system

     

    Ii. Use the data recovery tool extundelete

    I tried debugfs + dd before.

    Later install extundelete-0.2.4 ,:

    1. Download

    (1) Because sourceforge is walled and wget on the server is not successful, you can only download it from the local firewall. The link is as follows:

    Http://superb-dca2.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

    (2) Place the downloaded file to the server

    Start the local nginx, and then wget on the server (of course, other methods can also be used, as long as it can be uploaded to the server ):

    Wget http: // local IP/extundelete-0.2.4.tar.bz2

    (3) Extract

    tar jxf extundelete - 0 . 2 . 4 .tar.bz2

     

    2. Compile

    (1) configure

    [root@localhost  extundelete-0.2.4]# ./configure

    Configure reported an error. I checked config. log and confirmed that the local machine has no compiling environment.

    yum -y install gcc+ gcc-c++

    Wait, a little slow.

    After the installation is complete, config again, an error is still reported

    Configuring extundelete 0.2.4
    configure: error: Can’t find ext2fs library

    This is because extundelete depends on e2fsprogs.

    After e2fsprogs is installed, configure again.

    [root@localhost  extundelete-0.2.4]# yum install e2fsprogs-devel
    [root@localhost  extundelete-0.2.4]# ./configure
    Configuring extundelete 0.2.4
    Writing generated files to disk

     

    (2) make & make install

    [root@localhost  extundelete-0.2.4]#make & make install

    If no exception information is displayed, the installation is successful.

     

    (3) You can go to the src directory for verification.

    [root@localhost  extundelete-0.2.4]# cd src
    [root@localhost  src]# ./extundelete
    No action specified; implying --superblock.
    ./extundelete: Missing device name.
    Usage: ./extundelete [options] [--] device-file
    .............

     

    [root@localhost  src]# ./extundelete -v

    extundelete version 0.2.4

    libext2fs version 1.41.12

    Processor is little endian.

    The above information proves that the installation is successful.

    The data recovery is started.

     

    3. Attach a new hard disk

    (If the disk space of the original server is large enough, skip this step .)

    Because the accidentally deleted data is large (about 200 GB), there is no disk space on the physical machine where the original server is located. Because some disks need to be remotely mounted to another server B, B is a virtual xen machine, and there is not enough space, but there is still disk space on the physical machine, in this case, we need to allocate space to B from the host machine.

    1. mount a disk on xen to B.

    Because it is a graphic operation, I will not elaborate on it. You only need to allocate enough space. I chose 300 GB at the time.

    2. log on to server B and prepare to attach a new disk.

    (1) check whether the new disk is mounted

    [nmen@dev -ubuntu-server] ls /dev/sd*
    /dev/sda  /dev/sda1  /dev/sda2  /dev/sda5  /dev/sda6  /dev/sda7  /dev/sda8  /dev/sdb

    /Dev/sdb is indeed mounted.

    In this case, the new disk is neither partitioned nor formatted. Therefore, you need to perform these two operations first.

     

    (2) Partition

    It is an hdb hard disk, and the sdb disk also performs the same operation.


    (This figure comes from: http://www.shyw.net/bbs/yxt443333-1-1.html)

     

    (3) Format

    [nmen@dev -ubuntu-server]:~$ sudo mkfs -t ext3 /dev/sdb1
    mke2fs 1.41.11 (14-Mar-2010)
    Filesystem label=
    OS type: Linux
    Block size=4096 (log=2)
    Fragment size=4096 (log=2)
    Stride=0 blocks, Stripe width=0 blocks
    22937600 inodes, 91749215 blocks
    4587460 blocks (5.00%) reserved for the super user
    First data block=0
    Maximum filesystem blocks=4294967296
    2800 block groups
    32768 blocks per group, 32768 fragments per group
    8192 inodes per group
    Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968
     
    Writing inode tables: done                           
    Creating journal (32768 blocks): done
    Writing superblocks and filesystem accounting information: done
     
    This filesystem will be automatically checked every 33 mounts or
    180 days, whichever comes first.  Use tune2fs -c or -i to override.

    If the preceding information is displayed, the format is successfully formatted.

     

    (4) set the volume label

    sudo e2label /dev/sdb1 /restore

     

    (5) Mounting

    [nmen@dev -ubuntu-server]:~$ mkdir /restore
    [nmen@dev  - ubuntu - server] : ~ $ mount -vl -t ext3 /dev/sdb1 /restore

    Now, mounting a new hard disk on server B is complete, and there is enough space to store the data to be restored.

     

    4. Remote mounting through NFS

    Through the network, mount the file system shared by remote host B to machine A that requires data recovery.

    1. Install NFS on server B

    (1) Installation

    B is a ubuntu system and nfs is not installed by default.

    #  sudo apt-get install nfs-kernel-server

     

    (2) Configuration

    Modify/etc/exports and add the following statement.


    # /etc/exports: the access control list for filesystems which may be exported
    #               to NFS clients.  See exports(5).
    #
    # Example for NFSv2 and NFSv3:
    # /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
    #
    # Example for NFSv4:
    # /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
    # /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
    #
    /restore *(rw,sync,no_root_squash,no_subtree_check)

    Where:

    /Restore -- directory to be shared with the client;

    * -- Indicates that any host can access the local directory or specify an IP address;

    (W, sync, no_root_squash, no_subtree_check) -- configure client permissions;

    Because it is temporary and the server is on the Intranet, the settings are relatively random.

     

    (3) make the configuration take effect

    #  exportfs –rv

    #  /etc/init.d/nfs-kernel-server restart

     

    (4) verify whether the configuration is successful

    Display the NFS server output directory list:

    nmen@dev -ubuntu-server: showmount -e
    Export list for chinahrd-ubuntu-dev:
    /restore *

     

    (5) Firewall

    The firewall on B is temporarily disabled because the time is urgent and the Intranet is used:

    sudo ufw disable

    Run the following command to enable the Firewall:

    sudo ufw enable

    2. Mount the remote directory on server

    Mount the/restore directory from server B to/mnt.

    Mount-t nfs [B's IP address]:/restore/mnt

    The command details are as follows:

    # Mount-t nfs [-o mount-options] server:/directory/mount-point
     
    -O mount-options
    Specifies the mounting option that can be used to mount the NFS file system.
    Server:/directory
    Specify the Host Name of the server that contains the shared resource and the path of the file or directory to be mounted.
    /Mount-point
    Specifies the directory of the file system to be mounted.

     

    V. Data Recovery 1. Get the approximate time of Deletion

    This step is not required, but it helps to quickly reply to the desired data.

    date -d "Fri Apr 15:40:00 2014" +%s
    1397202000

    We will use the time value 1397202000 later.

    2. View deleted files

    # extundelete /dev/sdb1 --inode 2

    File name                                       | Inode number | Deleted status

    .                                                 9

    ..                                                11

    lost+found                                        24             Deleted

    data                                              82             Deleted

    When a partition is mounted to a directory, the inode value of the "root" directory is generally 2.

    The deleted file is in the deleted status.

    3. Data Recovery

    Log on to the remote directory/restore;

    Specify -- after "1397202000" to restore the files after this time point;

    Files are restored to the RECOVERED_FILES directory in the current directory by default.

    Cd/restore
    [Root @ localhost restore] # [extundelete installation path]./extundelete -- restore-all -- after "1397202000"/dev/mapper/VolGroup-lv_home

    Only show and process deleted entries if they are deleted on or after 1397202000 and before 9223372036854775807.

    NOTICE: Extended attributes are not restored.

    Loading filesystem metadata ... 6924 groups loaded.

    Loading journal descriptors ... 27149 descriptors loaded.

    Searching for recoverable inodes in directory / ...

    696 recoverable inodes found.

    Looking through the directory structure for deleted files ...

    Unable to restore inode 27394319 (VMware/9.50_ps/9.55locate.vmx.lck): Space has been reallocated.

    Unable to restore inode 27402241 (VMware/9.35win7/9.35win7.vmx.lck): Space has been reallocated.

    Unable to restore inode 27396032 (VMware/9.35win7/9.35win7-Snapshot1.vmsn): No undeleted copies found in the journal.

    Unable to restore inode 27394051 (VMware/9.36win2008/9.36win2008R2.vmx.lck/E00633.lck): Space has been reallocated.

    Unable to restore inode 27394603 (lost+found/E09292.lck): Space has been reallocated.

    8 recoverable inodes still lost.

     

    Generally, it takes a long time to wait...

    cd restore/RECOVERED_FILES$
    ls
    110_open_dns  111_open_dns_node1  112_DNS_node2  116_svn

    The deleted file is back.

    Vi. Final work

    (1) Remount the disk on A to read/write:

    [root@localhost  src]# mount -o remount, rw /home/

    Uninstall the directory on server B.

     

    (2) Enable Firewall B.

    sudo ufw enable

     

    (3) Enable aliases for the rm command on A to prevent silent deletion.

    vi /etc/bashrc

    source /etc/bashrc

     

    # do not delete / or prompt if deleting more than 3 files at a time #
    alias rm='rm -I --preserve-root'  
     
    # confirmation #
    alias mv='mv -i'
    alias cp='cp -i' alias ln='ln -i'  
     
    # Parenting changing perms on / #
    alias chown='chown --preserve-root'
    alias chmod='chmod --preserve-root'
    alias chgrp='chgrp --preserve-root'

    (4) use Rsync on B to regularly back up data on.

    Reference: http://abloz.com/2013/09/12/linux-rm-rf-file-recovery-record.html

    Related Article

    Contact Us

    The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

    If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

    A Free Trial That Lets You Build Big!

    Start building with 50+ products and up to 12 months usage for Elastic Compute Service

    • Sales Support

      1 on 1 presale consultation

    • After-Sales Support

      24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.