Shulou(Shulou.com)06/02 Report--

I. introduction to the process of disk array partition loss

The cause of the incident was that the administrator of the computer room carried out regular maintenance of the computer room in accordance with the regulations, resulting in the loss of partitions in a certain brand of server equipment (raid5 disk array) due to operational errors, and all the production business data of the company were stored in the lost partitions, thus paralyzing the business. After the detection by the data recovery engineer, it is found that because the super block and some nodes and directory items in the head of the file system of the server are lost, the super block is repaired and restored according to the super block backup and the directory tree structure in the file system. after repairing and reconstructing the lost nodes and directory items, the file system can be completely restored.

2. Raid5 disk array data recovery process

1. After receiving the customer server, the data recovery engineer first distributes all the hard drives to the special storage for data recovery by mirror image, and returns the original server to the customer after the backup is successful.

two。 Use the server data recovery tool to parse the customer's backup data. (note that this data recovery tool is currently for internal use, and you can also use other similar data recovery tools on the market to search file id for array analysis. After parsing, you can get basic information such as disk array order and stripe size. Because this operation has certain risks, it must not be operated on the original device.

3. The basic information of the original raid array can be directly obtained by parsing the backup data, and the engineer uses this information to reorganize the raid5 disk array, and then locate the partition starting position of the xfs file system; (note: XFS INODE number: variable length digits, composed of three parts: starting block group number + starting block number + INODE number within the block. The bit lengths of the starting block number and the INODE number within the block are specified by the parameters in SUPERBLOCK. )

4. The server data recovery engineer verifies the integrity and correctness of the file system, and the results show that the xfs file system header is lost very quickly, some nodes are lost, and the directory entries are lost.

5. According to the super block backup and the directory tree structure in the file system, the super block is repaired and restored (the process is brief). Repair the lost nodes and directory items in the xfs file system; repair and reconstruct the lost nodes and directory items.

6. After the above repair work is completed, you can write a Mini Program to parse the file system and extract data.

3. Raid5 disk array data was recovered successfully

Because the customer did not do any destructive operations to write to the storage after the data loss, most of the data and file system information remained intact, and the server data was 100% restored.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.