Shulou(Shulou.com)06/03 Report--

1. Server data recovery background

An EMC 5400 server in a government department in Beijing crashed due to the damage of the raid array, so there is an urgent need for server data recovery. As the user server data is classified, it needs door-to-door recovery.

Second, server data recovery detection

The server data recovery engineer brought the relevant equipment to the customer site for data inspection and found that the reason for the server paralysis was caused by the loss of some hard disks in the raid array. After physical inspection of all disks, no physical failure was found, and there was no bad path. Then the engineer mirrors all the disks in the failed server (EMC 5400) to our company's data recovery service platform with the help of data recovery software for later data recovery.

3. EMC 5400 server data recovery

1. Analyze the structure of the server RAID group

The LUN of the EMC 5400 server is all based on the RAID array group, so to recover the server data, we first need to analyze the underlying RAID information of the server, and then reconstruct the original RAID group according to the analyzed information. After analyzing the raid array, the server data recovery engineer found that there were two hard drives offline in the server, because disk 6 and disk 10 both belonged to Hot Spare, but when the server failed, Hot Spare replaced the disconnected hard disk 5, and disk 10 was not enabled for unknown reasons. Therefore, although the server successfully activated the Hot Spare of disk 6, due to the lack of a hard disk in the RAID5 disk array, the data was not synchronized to disk 6. The server data recovery engineer continues to analyze all other hard drives to figure out how the data is distributed on the hard drive, the size of the RAID stripes, and the order of each disk.

2. Analyze the sequence of disconnecting reel by recombination raid.

According to the analyzed raid information, the RAID virtual program developed by ourselves is used to reorganize the original raid in the failure server. Then analyze the dropping sequence of the two offline hard drives in the server. Through the careful inspection of all the hard drives in the server, it is found that the data of a hard disk on the same stripe is obviously different from that of other hard drives, so it is preliminarily judged that this hard disk may be the first to be offline. Through the self-developed RAID check program to check this stripe, it is found that the data obtained by removing the hard disk just analyzed is the best, so you can make it clear that the hard disk is the first to go offline.

3. Analyze the LUN information in the RAID group

Now that the raid information is known, the order in which the disk is dropped, then reorganize the raid according to the analysis results. Analyze the allocation information of LUN in the RAID group and the block MAP allocated by LUN. Then use the raid data recovery program to interpret the LUN data MAP and export all the LUN data based on this information.

Explain the ZFS file system and fix it

Use the ZFS file system interpreter independently developed by North Asia to interpret the generated LUN and parse all file nodes and directory structures.

Screenshots of some file directories are as follows:

5. Data recovery results of EMC 5400 server

The data is verified by the user administrator, all the data is normal and complete, and the data is recovered successfully.

Some of the files are verified as follows:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.