Under the Ext3/Ext4 file system under LINUX, if the data is deleted by mistake, the data recovery is very difficult. If the number of deleted files is not large (usually within a few hundred files), it can also be restored by comparing the remaining inode information with the .journal log file. The restored data directory structure may not be preserved completely; if the number of deleted files is very large Large, data recovery can hardly preserve the file directory structure. This is a common problem of the Ext3/Ext4 file system, and does not leave the wrong way to delete it! In the data recovery industry case, there are many examples of accidentally deleting the ORACLE database file under LINUX. The following describes the data recovery of deleting the Oracle database under Linux. Technical solutions.
Data loss case background:
The computer maintenance engineer stopped the oracle service and planned to make a cold backup of the oracle, back up the library files to the Windows PC Server, and download them with the CuteFTP client. During the download process, it was found that the download speed was extremely slow. I wanted to delete the download task. The result was misoperation. The oracle instance folder to be downloaded was deleted. The oracle library file, control file, and log file were all deleted.
Introduction to EXT3 file system recovery technology under LINUX:
The EXT3 file system does not reserve the function of anti-delete. In the EXT3 file system, each file is described by Inode to describe the specific location of its data storage. When the file is deleted, the data pointer portion of the Inode is cleared, and the file directory area does not change much. File reading and writing is implemented by Inode. When the Inode data pointer is cleared, even if the file content is still there, we have no way to combine the contents of the file.
The EXT3 file system is a file system with logging function. Inode changes will be recorded in the log file .journal. The .journal file is relatively small, usually 32MB. When the metadata data in the EXT3 file system changes, the corresponding metadata will have a COPY in the .journal file. For example, if a file is deleted, its Inode information will be saved in the .journal file first, and then the information about the inode to be deleted will be cleared. This .journal file is recycled. When there are too many operations, the inode log of the deleted file will be replaced by the new data, which completely loses the chance to retrieve the data according to the inode. If a large number of files are deleted, this .journal file will be recycled multiple times, leaving only the chances of recovery of those files that were last deleted.
Data recovery technology program:
The client wants to restore the oracle database. After the oracle database file is deleted, as long as the data content is not overwritten, the Darth data recovery technology can extract the file separately. After in-depth analysis, the deleted oracle data file was not found in the .journal file. The reason is that after the user deletes the data, the system is still running, and tries to start the oracle instance. Oracle generates some log files. The number of these log files is relatively large. The number of deleted files to be restored is only 16 and there is no inode information for deleting files in the .journal file.
There are two ideas for recovery:
The first one: according to the internal structure of the oracle data file, the whole disk is searched, the data conforming to the oracle data page is extracted, and then recombined according to the ID number of the oracle data file.
The second: according to the distribution rule of the oracle data file, accurately locate the data pointer address of the oracle file, including the first-level indirect address, the second-level indirect address, and the third-level indirect address, reconstruct the inode information of the file, and then read the data. come out.
The data recovered by these two kinds of effects are very good, and finally Oracle can start normally. The engineer backed up the data all the time. Finally, it was found that there were two records with less records. The reason was that after deleting the files, some log files were written to the partition, which destroyed some data pages of the Oracle data file. Fortunately this The two table data is not very important to the user.
Darth Data Security Alert:
In the case of LINUX/UINX, the file is deleted by mistake. When the data is found to be lost, it is best not to perform any operation, shut down immediately, and keep the scene. If the conditions do not allow shutdown, you must find a way to mirror the data loss of the file system through the DD mirror to another storage space as the most original backup. Source: Das data recovery 覃 total reprint, please indicate the source
Double Induction Cooktop,Induction Cooker Electric,Induction Cooker 3500W,High Power Induction Cooker
Guangdong Puda Electrical Appliance Co., Ltd. , https://www.elecapoka.com