Restore rm from CentOS and rm from centos

Restore rm from CentOS and rm from centos

I. Mount the disk partition as read-only

This step is very important, and the disk should be mounted as read-only as soon as possible after the file is deleted by mistake. The sooner you start the process, the higher the chances of successful recovery.

 

1. Check the partition in which the deleted file is located.

[root@localhost  ~]# mount
/dev/mapper/VolGroup-lv_root on / type ext4(rw)
/dev/mapper/VolGroup-lv_home on /home type ext4(rw)

2. Try to remount the corresponding directory as read-only

[root@localhost  ~]#  mount -r -n -o remount /home
mount: /home is busy

 

3. If xxx is busy

[root@localhost  ~ ]# fuser -v -m /data

Find the relevant process and kill it.

 

4. The directory is successfully mounted as read-only

[root@localhost  ~ ] #  mount -r -n -o remount /home

When the touch file in the/home directory is displayed, the following error occurs:

[root@localhost  ~ ] # touch txt
touch: cannot touch `txt’: Read-only file system

 

Ii. Use the data recovery tool extundelete

I tried debugfs + dd before.

Later install extundelete-0.2.4 ,:

1. Download

(1) Because sourceforge is walled and wget on the server is not successful, you can only download it from the local firewall. The link is as follows:

Http://superb-dca2.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

(2) Place the downloaded file to the server

Start the local nginx, and then wget on the server (of course, other methods can also be used, as long as it can be uploaded to the server ):

Wget http: // local IP/extundelete-0.2.4.tar.bz2

(3) Extract

tar jxf extundelete - 0 . 2 . 4 .tar.bz2

 

2. Compile

(1) configure

[root@localhost  extundelete-0.2.4]# ./configure

Configure reported an error. I checked config. log and confirmed that the local machine has no compiling environment.

yum -y install gcc+ gcc-c++

Wait, a little slow.

After the installation is complete, config again, an error is still reported

Configuring extundelete 0.2.4
configure: error: Can’t find ext2fs library

This is because extundelete depends on e2fsprogs.

After e2fsprogs is installed, configure again.

[root@localhost  extundelete-0.2.4]# yum install e2fsprogs-devel
[root@localhost  extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk

 

(2) make & make install

[root@localhost  extundelete-0.2.4]#make & make install

If no exception information is displayed, the installation is successful.

 

(3) You can go to the src directory for verification.

[root@localhost  extundelete-0.2.4]# cd src
[root@localhost  src]# ./extundelete
No action specified; implying --superblock.
./extundelete: Missing device name.
Usage: ./extundelete [options] [--] device-file
.............

 

[root@localhost  src]# ./extundelete -v

extundelete version 0.2.4

libext2fs version 1.41.12

Processor is little endian.

The above information proves that the installation is successful.

The data recovery is started.

 

3. Attach a new hard disk

(If the disk space of the original server is large enough, skip this step .)

Because the accidentally deleted data is large (about 200 GB), there is no disk space on the physical machine where the original server is located. Because some disks need to be remotely mounted to another server B, B is a virtual xen machine, and there is not enough space, but there is still disk space on the physical machine, in this case, we need to allocate space to B from the host machine.

1. mount a disk on xen to B.

Because it is a graphic operation, I will not elaborate on it. You only need to allocate enough space. I chose 300 GB at the time.

2. log on to server B and prepare to attach a new disk.

(1) check whether the new disk is mounted

[nmen@dev -ubuntu-server] ls /dev/sd*
/dev/sda  /dev/sda1  /dev/sda2  /dev/sda5  /dev/sda6  /dev/sda7  /dev/sda8  /dev/sdb

/Dev/sdb is indeed mounted.

In this case, the new disk is neither partitioned nor formatted. Therefore, you need to perform these two operations first.

 

(2) Partition

It is an hdb hard disk, and the sdb disk also performs the same operation.

(This figure comes from: http://www.shyw.net/bbs/yxt443333-1-1.html)

 

(3) Format

[nmen@dev -ubuntu-server]:~$ sudo mkfs -t ext3 /dev/sdb1
mke2fs 1.41.11 (14-Mar-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
22937600 inodes, 91749215 blocks
4587460 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
2800 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
    32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
    4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968
 
Writing inode tables: done                           
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done
 
This filesystem will be automatically checked every 33 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

If the preceding information is displayed, the format is successfully formatted.

 

(4) set the volume label

sudo e2label /dev/sdb1 /restore

 

(5) Mounting

[nmen@dev -ubuntu-server]:~$ mkdir /restore
[nmen@dev  - ubuntu - server] : ~ $ mount -vl -t ext3 /dev/sdb1 /restore

Now, mounting a new hard disk on server B is complete, and there is enough space to store the data to be restored.

 

4. Remote mounting through NFS

Through the network, mount the file system shared by remote host B to machine A that requires data recovery.

1. Install NFS on server B

(1) Installation

B is a ubuntu system and nfs is not installed by default.

#  sudo apt-get install nfs-kernel-server

 

(2) Configuration

Modify/etc/exports and add the following statement.


# /etc/exports: the access control list for filesystems which may be exported
#               to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#
/restore *(rw,sync,no_root_squash,no_subtree_check)

Where:

/Restore -- directory to be shared with the client;

* -- Indicates that any host can access the local directory or specify an IP address;

(W, sync, no_root_squash, no_subtree_check) -- configure client permissions;

Because it is temporary and the server is on the Intranet, the settings are relatively random.

 

(3) make the configuration take effect

#  exportfs –rv

#  /etc/init.d/nfs-kernel-server restart

 

(4) verify whether the configuration is successful

Display the NFS server output directory list:

nmen@dev -ubuntu-server: showmount -e
Export list for chinahrd-ubuntu-dev:
/restore *

 

(5) Firewall

The firewall on B is temporarily disabled because the time is urgent and the Intranet is used:

sudo ufw disable

Run the following command to enable the Firewall:

sudo ufw enable

2. Mount the remote directory on server

Mount the/restore directory from server B to/mnt.

Mount-t nfs [B's IP address]:/restore/mnt

The command details are as follows:

# Mount-t nfs [-o mount-options] server:/directory/mount-point
 
-O mount-options
Specifies the mounting option that can be used to mount the NFS file system.
Server:/directory
Specify the Host Name of the server that contains the shared resource and the path of the file or directory to be mounted.
/Mount-point
Specifies the directory of the file system to be mounted.

 

V. Data Recovery 1. Get the approximate time of Deletion

This step is not required, but it helps to quickly reply to the desired data.

date -d "Fri Apr 15:40:00 2014" +%s
1397202000

We will use the time value 1397202000 later.

2. View deleted files

# extundelete /dev/sdb1 --inode 2

File name                                       | Inode number | Deleted status

.                                                 9

..                                                11

lost+found                                        24             Deleted

data                                              82             Deleted

When a partition is mounted to a directory, the inode value of the "root" directory is generally 2.

The deleted file is in the deleted status.

3. Data Recovery

Log on to the remote directory/restore;

Specify -- after "1397202000" to restore the files after this time point;

Files are restored to the RECOVERED_FILES directory in the current directory by default.

Cd/restore
[Root @ localhost restore] # [extundelete installation path]./extundelete -- restore-all -- after "1397202000"/dev/mapper/VolGroup-lv_home

Only show and process deleted entries if they are deleted on or after 1397202000 and before 9223372036854775807.

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 6924 groups loaded.

Loading journal descriptors ... 27149 descriptors loaded.

Searching for recoverable inodes in directory / ...

696 recoverable inodes found.

Looking through the directory structure for deleted files ...

Unable to restore inode 27394319 (VMware/9.50_ps/9.55locate.vmx.lck): Space has been reallocated.

Unable to restore inode 27402241 (VMware/9.35win7/9.35win7.vmx.lck): Space has been reallocated.

Unable to restore inode 27396032 (VMware/9.35win7/9.35win7-Snapshot1.vmsn): No undeleted copies found in the journal.

Unable to restore inode 27394051 (VMware/9.36win2008/9.36win2008R2.vmx.lck/E00633.lck): Space has been reallocated.

Unable to restore inode 27394603 (lost+found/E09292.lck): Space has been reallocated.

8 recoverable inodes still lost.

 

Generally, it takes a long time to wait...

cd restore/RECOVERED_FILES$
ls
110_open_dns  111_open_dns_node1  112_DNS_node2  116_svn

The deleted file is back.

Vi. Final work

(1) Remount the disk on A to read/write:

[root@localhost  src]# mount -o remount, rw /home/

Uninstall the directory on server B.

 

(2) Enable Firewall B.

sudo ufw enable

 

(3) Enable aliases for the rm command on A to prevent silent deletion.

vi /etc/bashrc

source /etc/bashrc

 

# do not delete / or prompt if deleting more than 3 files at a time #
alias rm='rm -I --preserve-root'  
 
# confirmation #
alias mv='mv -i'
alias cp='cp -i' alias ln='ln -i'  
 
# Parenting changing perms on / #
alias chown='chown --preserve-root'
alias chmod='chmod --preserve-root'
alias chgrp='chgrp --preserve-root'

(4) use Rsync on B to regularly back up data on.

Reference: http://abloz.com/2013/09/12/linux-rm-rf-file-recovery-record.html