Shulou(Shulou.com)06/02 Report--

Description of virtual machine failure environment

The customer's physical machine operating system is Linux system and the file system is EXT4 file system. The KVM virtual machine on it is deleted, and each virtual machine contains a disk file in qcow2 format and a disk file in raw format with a size of about 1.2T. It is mainly necessary to restore the disk file in raw format. The customer has backed up by himself.

Virtual machine 1: primary database server

Virtual disk: 10G system disk (qcow2) + 1.2T data disk (raw, main recovery)

File system: EXT4

Main data: MySQL database

Virtual machine 2: backup database server

Virtual disk: 10G system disk (qcow2) + 1.2T data disk (raw, main recovery)

File system: EXT4

Main data: MySQL database

Virtual machine 3: code server

Virtual machine disk: 10G system disk (qcow2) + 1.2T data disk (raw, main recovery)

File system: EXT4

Main data: program code

II. Virtual machine data recovery process

1. Analyze the EXT4 file system and locate the node location of the deleted virtual machine disk file.

2. Get the residual index information of disk files.

3. Check the correctness of the residual index information and repair the indexes that are not seriously damaged.

The picture shows the obtained index and other information:

Virtual machine data recovery case screenshot 1

4. After the repair is completed, parse the remaining indexes at all levels and extract the virtual disk files from the volume where the virtual machine resides.

5. According to the extraction of virtual disk files, get the free space in the volume that is not indexed.

6. Check the correctness and integrity of the extracted disk files.

7. Get valid information from free space and try to repair virtual disk files (such as nodes, directory items, database pages, etc.).

The picture shows the extracted free space:

Virtual machine data recovery case screenshot 2

III. Results of data recovery

1. Due to the loss of the index, the extracted virtual disk file is not complete. For the database server, if the database file is lost, the database page can be obtained from the free space to repair the database file. However, as part of the page area is covered and occupied, you can only fill as many pages as possible.

2. In the case of the loss of nodes and directory items in the server where the program code is stored, if the node or directory items remain, you can try to make up the nodes and directory items. However, it is found that the nodes and directory items of some files are lost at the same time, which cannot be made up according to the characteristics associated with the nodes and directory items. In addition, according to the characteristics of the program code file, it does not have a certain regularity, if its data area is lost, it can not be made up.

The figure shows the recovered partial directory structure:

Virtual machine data recovery case screenshot 3

Virtual machine data recovery case screenshot 4

IV. Data verification

After trying to patch the virtual disk file and the database file in it as much as possible, the data is verified by the customer. Some of the data is lost and cannot be recovered, but the whole is acceptable and the data recovery is valid.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.