Data goes from deleting the database to running away and then rolling it back to recover.

Install recovery software

1. epel warehouse installation

If the epel warehouse is added to our source, we can install it directly using the following command.

yum install extundelete -y

2. Source code compilation and installation

wget http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2
yum -y install bzip2 e2fsprogs-devel e2fsprogs gcc-c make
tar -xvjf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4
./configure
make && make install

3. Delete data search

Because my data path is relatively deep, we need to search step by step. We can first search from the root partition inode

extundelete /dev/sdb1 --inode 2

We will see the inode of the weapps directory,

extundelete /dev/sda5 --inode 24641537

We see the inode of the project,

extundelete /dev/sda5 --inode 24903688

We found the directory where the data was finally deleted upload

extundelete /dev/sda5 --inode 24904454

We can see the nominal Deleted, which is the data we want to restore.

4. Data recovery

Then we restore the specified directory, set the path with the current partition as the root partition, and mask the project name

extundelete /dev/sda5 --restore-directory /webapps xx/upload

Because the disk data has been read and written, the previous inodes of some files have been reallocated, causing some data to be unrecoverable. The data will eventually tell us how many files have not been restored, but we have recovered most of the data. This It's a very important thing.

Let’s check the restored data. The software will generate a directory RECOVERED_FILES in the current directory, which contains the data we recovered.

To restore all data, you can use the command

extundelete /dev/sda5 --restore-all

Instructions

extundelete --help

Among them, the parameters (options) are:
--version, -[vV], displays the software version number.
--help, displays software help information.
--superblock, displays superblock information.
--journal, display log information.
--after dtime, time parameter, indicates files or directories that will be deleted after a certain period of time.
--before dtime, time parameter, indicates files or directories that were deleted before a certain period of time.
Actions include:
--inode ino, displays information about node "ino".
--block blk, displays information about data block "blk".
--restore-inode ino[,ino,...], restore command parameter, means to restore the files of node "ino". The restored files will be automatically placed in the RESTORED_FILES folder in the current directory, using the node number as the extension. .
--restore-file 'path', restore command parameter, means that the file in the specified path will be restored and the restored file will be placed in the RECOVERED_FILES directory in the current directory.
--restore-files 'path', restore command parameter, means that all files listed in the path will be restored.
--restore-all, restore command parameter, indicates that all directories and files will be attempted to be restored.
-j journal means reading the extended journal from the named file.
-b blocknumber means using the previously backed up super block to open the file system. It is generally used to check whether the existing super block is the currently required file.
-B blocksize, opens the file system by specifying the data block size, generally used to view files whose size is already known.

After deleting the data, first unmount the disk or partition where the deleted data is located. If the system root partition is accidentally deleted, you need to enter single-user mode and mount the root partition in a read-only manner.

Reason: After the file is deleted, only the sector pointer in the inode node of the file is cleared. In fact, the file still exists on the disk. If the disk is mounted in read-write mode, these deleted data blocks may be After the system re-allocates and these data blocks are overwritten, the data is really lost, so mount it in a read-only manner to avoid data overwriting as much as possible.

The above is the detailed content of Data goes from deleting the database to running away and then rolling it back to recover.. For more information, please follow other related articles on the PHP Chinese website!