Huawei Storage Server Volume lost data recovery success case

Description of the failure environment of the storage server

The customer equipment is Huawei OceanStor S5600T server, which supports both SAN and NAS storage protocols. One day, when the server was running, the customer found that the data in the last NAS volume was lost, the volume size was 4T, and the main data types were office file, PDF document file, picture file (JPG, JPEG, PNG, etc.), video file (MP4, AVI, etc.), audio file (MP3, etc.). The administrator then closes the system application and stops uploading data.

Second, server data backup

1. Prepare the backup space and backup server and connect the backup server to the customer's storage environment

2. Check the storage management interface and find the server LUN corresponding to the 4T volume. After viewing, the volume changes correspond to two server LUN.

3. Map the corresponding LUN to the backup server, and use the data recovery tool to mirror the LUN.

III. Server data recovery process

1. Analyze the structure of the server LUN and analyze the corresponding relationship between the two LUN

Figure 1 LUN1

Figure 2 LUN2

2. Analyze the distribution of 4T NAS volume in two storage LUN, and virtual reorganize the 4T volume.

3. Analyze the storage structure of the 4T volume to obtain the file system type, super block, node and other structures.

4. Analyze the structure of super blocks and nodes in the 4T volume, and obtain the index relationship among nodes, directory items and data areas.

Fig. 3 Super block

Figure 4 Node

5. Write programs, parse catalogue items and nodes, and extract data.

IV. Results of data recovery

1. Scan all the space of the 4T volume and find that the directory entries of the file system are still there. Scan the directory entries and nodes to check the log of the file system to find some valid nodes.

The figure shows some of the found directory items and their corresponding nodes:

Figure 5 Catalog items

Figure 6 Node

2. Try to recover the data file directly by type, and then match the directory entry and data file according to the offset position of the directory in the volume, the offset position of the data file in the volume, and the corresponding file type and file size provided by the customer. successfully match the data needed by the user, and the server data is restored successfully.