Shulou(Shulou.com)06/02 Report--

KVM Virtual Machine, short for Kernel-based Virtual Machine, is an open source system virtualization module that has been integrated in major releases of Linux since Linux 2.6.20. It is managed using Linux's own scheduler.

Description of virtual machine failure environment

The customer's physical machine operating system is Linux system and the file system is EXT4 file system. The KVM virtual machine on it is deleted, and each virtual machine contains a disk file in qcow2 format and a disk file in raw format with a size of about 1.2T. It is mainly necessary to restore the disk file in raw format. What the user needs is three virtualized servers, which store database, program code and other data.

II. Virtual machine data recovery process

1. Analyze the EXT4 file system and locate the node location of the deleted virtual machine disk file.

2. Get the residual index information of disk files.

3. Check the correctness of the residual index information and repair the indexes that are not seriously damaged.

The picture shows the obtained index and other information:

Figure 1

4. After the repair is completed, parse the remaining indexes at all levels and extract the virtual disk files from the volume where the virtual machine resides.

5. According to the extraction of virtual disk files, get the free space in the volume that is not indexed.

6. Check the correctness and integrity of the extracted disk files.

7. Get valid information from free space and try to repair virtual disk files (such as nodes, directory items, database pages, etc.).

The picture shows the extracted free space:

Figure 2

III. Results of data recovery

1. Due to the loss of the index, the extracted virtual disk file is not complete. For the database server, if the database file is lost, the database page can be obtained from the free space to repair the database file. However, as part of the page area is covered and occupied, you can only fill as many pages as possible.

2. In the case of the loss of nodes and directory items in the server where the program code is stored, if the node or directory items remain, you can try to make up the nodes and directory items. However, it is found that the nodes and directory items of some files are lost at the same time, which cannot be made up according to the characteristics associated with the nodes and directory items. In addition, according to the characteristics of the program code file, it does not have a certain regularity, if its data area is lost, it can not be made up.

The figure shows the recovered partial directory structure:

Figure 3

Figure 4

IV. Data verification

After trying to patch the virtual disk file and the database file in it as much as possible, the data is verified by the customer. A small part of the data is lost, the whole is acceptable, and the data recovery is valid.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.