Shulou(Shulou.com)06/02 Report--

[storage structure of popular science Isilon]

Isilon uses the distributed file system OneFS internally. Each node in the Isilon storage cluster is a single OneFS file system, so Isilon supports scale-out without affecting the normal use of data. When the storage cluster works, all nodes provide the same function, and there is no distinction between active and standby nodes. When users store files in the storage cluster, the OneFS layer will divide the files into 128K fragments and store them in different nodes, while in the node layer, 128K fragments will be divided into 8K fragments to different hard drives of the node. On the other hand, the Indoe information, directory items and data MAP of the user file are stored in all nodes, which ensures that users can access all the data no matter from which node. Isilon allows users to choose the appropriate storage redundancy mode during initialization, and different redundancy modes provide different levels of data security (the default 3 nodes are in Nation2V1 mode).

[storage data recovery failure description]

The administrator of a company deleted important data such as MSSQL database and a large number of video files of MP4, ASF and TS types in the server due to misoperation. The overall storage architecture of the server that needs data recovery is EMC high-end network NAS (Isilon S200), the number of nodes is 3, each node is equipped with 12 3T STAT hard drives without SSD. The data that needs to be recovered includes vmware virtual machines (WEB servers) and video files. Virtual machines are shared to ESX hosts through NFS protocol, and video files are shared to virtual machines (WEB servers) through CIFS protocol. All data shared by NFS (that is, all virtual machines) is deleted while data shared by CIFS is not deleted.

[backup server data]

Due to the consideration of data security and avoiding secondary damage to the data, all hard drives need to be fully backed up. However, because the number of disks is too large (12 disks per node and 36 disks per node), and the capacity of a single disk is too large (single disk 3TB, a total of 108TB), the backup cycle will be longer. The end customer decides that only the existing data in the storage will be backed up, and the data recovery company will back up once and the customer will back up again to ensure the security of the existing data.

[server data analysis]

After the backup of the server data is completed, shut down the Isilon normally in the web management interface of Isilon. Then label all the hard drives on all nodes, remove them in turn and put them into the data recovery platform, and begin to analyze the data in all the hard drives.

Since the customer data has been deleted, there is no need to think too much about the redundancy level of the storage. The key point is to analyze whether the file Indoe and data MAP have changed after the file is deleted. The deleted virtual disk files are 64g or above, and there are no other types of large files in the storage. Write a program to scan the Indoe of all files, and scan out the Indoe that meets the size of 64G or more. After a careful analysis of the scanned Indoe, it is found that the location of the data MAP recorded in the Indoe, the content that the index points to is no longer normal data, and the Indoe on all nodes is the same. After a careful analysis of the Inode, it is found that the data MAP of a large file will have multiple layers (tree structure), and the unique ID of the file will be recorded in the data MAP, so you can try to find the lowest data MAP of the file. Traversing and tracking the data MAP at the bottom of the file with a sense of luck, I found that the data MAP at the lowest level was still there.

[data recovery process]

Take the unique ID of the file from the Inode of the file, and aggregate all the data MAP that conforms to that ID. And sort according to the VCN number in the data MAP, it is found that the first 17088 items of data in each file MAP does not exist, which means that the first 17088 items of data in each file is really impossible to recover (the mood falls into a trough).

After careful conversion, it is found that the missing data MAP item contains less than 1 gigabyte of data, while the deleted files are all virtual machine vmdk files, which are all NTFS file systems, while the MFT of the NTFS file system is basically in the 3G location, that is, you only need to manually forge a MBR and DBR in the header of each vmdk file to interpret the data in vmdk. Explain the MAP of the scanned data, and export the data according to the order of the VCN number. If there is no MAP, it remains zero.

After continuous testing, we first export a vmdk file to have a look. To my surprise, the exported vmdk file was smaller than it actually was, and the location of the MFT in the vmdk did not match my own description. It is manually randomly verified that several MPA findings can point to the data area, and there is no problem with the way the program interprets MAP. So guess that the files may be sparse!

Make some adjustments to the code and re-export the previous vmdk, this time the vmdk size is in line with the actual size, and the location of the MFT is also in the corresponding location. Manually forge a MBR, partition table and DBR, and then use the file system interpretation tool (self-use tool) to successfully interpret its file system and export the database and video files in vmdk.

After verifying that the database and video files in this vmdk are all right, export all the important vmdk files in batch, and then manually modify each vmdk file one by one.

[data acceptance]

After the recovery of all the important data of the customer is completed, the customer arranges the engineer to test the integrity and accuracy of all the recovered data. The data is finally determined that there is no problem at all, and the data recovery is successful.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.