Shulou(Shulou.com)06/02 Report--

The data recovery case we introduce today is a data loss caused by a v7000 storage file system corruption. First of all, a brief introduction to the basic situation of the device: the file system damage occurred is a v7000 storage mounted on the Windows2003 server, divided into a partition with a capacity of 7 TB, using the NTFS file system, which is an oracle database. The direct cause of this failure is that when the server crashes and restarts the server, the system automatically performs disk scan repair when the customer forcibly shuts down and breaks the link between the storage and the server, which directly leads to the damage of the storage file system. The error message is "the file or directory is damaged and cannot be read". Below, we will describe in detail the process of this v7000 storage data recovery:

The first step and all the data recovery work must be done is to make a mirror backup of the source storage in order to restore the image file and avoid directly changing the original data. This backup we use is to mirror the entire volume to our company's own storage device through the fiber optic switch, and the original equipment is returned to the customer without any operation.

The second step begins to analyze the underlying data of the mirrored volume. through the analysis, we find that the cause of the problem is that the 80 attributes recorded by the MFT table itself was truncated during the DATARUNS operating system self-test, and there were more than 34.51 million file data in the partition, including more than 20 gigabytes of mft files, and the files had a large number of fragments.

In the third step, we originally used v7000 data recovery software for scanning and recovery, but the result was not satisfactory, not only the scan result was only 1pm 3, but also the directory structure was chaotic, so we had to analyze it manually. The first step of the manual analysis process is to collect and analyze all the mft table fragment information and rewrite the 80 attribute DATARUNS based on this information. The workload generated by this way is very complicated, but the result is gratifying. After hard work, we can see that the original 6T multi-data is completely restored and the directory structure is complete.

At this point, the v7000 storage data recovery work is over, and all data is 100% restored.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.