☰

从虚拟磁盘映像恢复已删除的文件

tag-icon • tag-icon centos virtual-machine kvm data-recovery system-recovery
从虚拟磁盘映像恢复已删除的文件

我需要帮助。不小心，根目录下的所有文件都被删除了。不是我）如果有简单的磁盘分区就很容易了。但是，使用了逻辑卷。 Centos 7 KVM QEMU

$ ll server.img 
-rw-------. 1 root root 53687091200 oct 23 14:35 server.img

$ file -sL server.img 
server.img: x86 boot sector; partition 1: ID=0x83, active, starthead 32, startsector 2048, 2097152 sectors; partition 2: ID=0x8e, starthead 170, startsector 2099200, 102758400 sectors, code offset 0x63

我尝试了一些事情但没有成功。有人知道如何从 /dev/cl/root 恢复数据吗？会欣赏任何想法。

答案1

如果有人需要 ext3/4 文件系统的解决方案。这里是。检查fs表

# fdisk -lu server.img

Disk server.img: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000bef15

              Device Boot      Start         End      Blocks   Id  System
server.img1   *        2048     2099199     1048576   83  Linux
server.img2         2099200   104857599    51379200   8e  Linux LVM

目标分区从扇区 2099200 开始，大小为 512*2099200 = 1074790400

# losetup -o 1074790400 /dev/loop0 server.img
# fsck -fv /dev/loop0
fsck from util-linux 2.23.2
# lvmdiskscan
  /dev/loop0       [      49.00 GiB] LVM physical volume
  /dev/cl/root     [     430.71 GiB] 
  /dev/sda1        [       1.00 GiB] 
  /dev/cl/swap     [       4.00 GiB] 
  /dev/sda2        [     464.71 GiB] LVM physical volume
  2 disks
  1 partition
  0 LVM physical volume whole disks
  1 LVM physical volumes

检查卷组。

# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl" using metadata type lvm2
# vgdisplay
  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                3
  Open LV               3
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               464.71 GiB
  PE Size               4.00 MiB
  Total PE              118965
  Alloc PE / Size       118965 / 464.71 GiB
  Free  PE / Size       0 / 0   
  VG UUID               qXzwwe-OLg7-Xm25-LImC-fBb9-ohLh-RMqtxn

  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               49.00 GiB
  PE Size               4.00 MiB
  Total PE              12543
  Alloc PE / Size       12543 / 49.00 GiB
  Free  PE / Size       0 / 0   
  VG UUID               tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc

我们的卷组具有相同的名称。重命名目标卷组。

# vgrename -v tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc cl_new
# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl_new" using metadata type lvm2
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  inactive          '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

激活逻辑卷

# lvchange -ay /dev/cl_new/root
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  ACTIVE            '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

使用一些工具恢复文件（extundelete、ext3magic、ext4magic等）

# extundelete /dev/cl_new/root --restore-all

祝你好运！并且不要将 rm -rf / 与 sudo 一起使用:)

附言。我的虚拟磁盘上有 XFS，但它失败了。

extundelete：尝试打开文件系统 /dev/cl_new/root 时超级块中的错误幻数

相关内容