测试 wipefs 删除的file system及分区怎么恢复.

注意!! 如果不明白命令的功能. 千万不要执行下面提到的命令!!!
执行相关命令的后果自负!!!

测试 wipefs 删除的file system及分区怎么恢复.
环境:
Red Hat Enterprise Linux release 8.3 (Ootpa) 5.4.17-2011.7.4.el8uek.x86_64

################
情况1.
*dos分区, ext4 file system


fdisk -l /dev/vda

Disk /dev/vda: 20 GiB, 21474836480 bytes, 41943040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x33621404

Device Boot Start End Sectors Size Id Type
/dev/vda1 * 2048 41940991 41938944 20G 83 Linux

[root@localhost ~]# fsck /dev/vda1
fsck from util-linux 2.32.1
e2fsck 1.45.6 (20-Mar-2020)
/dev/vda1: clean, 36794/1310720 files, 450882/5242368 blocks

wipefs /dev/vda1

DEVICE OFFSET TYPE UUID LABEL
vda1 0x438 ext4 1fa74ff3-20c0-46b6-ac38-137a1d30745f

wipefs /dev/vda

DEVICE OFFSET TYPE UUID LABEL
vda 0x1fe dos

================

wipefs -a /dev/vda1

/dev/vda1: 2 bytes were erased at offset 0x00000438 (ext4): 53 ef

wipefs -a /dev/vda

/dev/vda: 2 bytes were erased at offset 0x000001fe (dos): 55 aa
/dev/vda: calling ioctl to re-read partition table: Success

=====================

fdisk -l /dev/vda

Disk /dev/vda: 20 GiB, 21474836480 bytes, 41943040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

#重建出分区
这里需要讨论一下. 磁盘开始的位置是不确定的. 我见过不同的情况.怎么找到实际位置也不太好说.

fdisk -l /dev/vda

Disk /dev/vda: 20 GiB, 21474836480 bytes, 41943040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6dd8faa7

Device Boot Start End Sectors Size Id Type
/dev/vda1 2048 41943039 41940992 20G 83 Linux

#这步没用到.

mkfs.ext4 -n /dev/vda1

mke2fs 1.45.6 (20-Mar-2020)
Creating filesystem with 5242624 4k blocks and 1310720 inodes
Filesystem UUID: b2becc7c-9c44-4aa2-8696-5b9d943436d1
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000

#直接修

fsck /dev/vda1

fsck from util-linux 2.32.1
e2fsck 1.45.6 (20-Mar-2020)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks…
/dev/vda1 was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
Block bitmap differences: +(819200–820227) +(884736–885763) +(4096000–4097027)
Fix? yes
…一直y 修下去.

/dev/vda1: ***** FILE SYSTEM WAS MODIFIED *****
/dev/vda1: 36794/1310720 files (0.2% non-contiguous), 450882/5242368 blocks

mount 测试及文件内容正常.

测试结论:
恢复分区后. 直接fsck.ext4就全都恢复了.

#############
情况2

mkfs.xfs -f /dev/vda1

meta-data=/dev/vda1 isize=512 agcount=4, agsize=1310656 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=0
= reflink=1
data = bsize=4096 blocks=5242624, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0, ftype=1
log =internal log bsize=4096 blocks=2560, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0

wipefs -a /dev/vda1

/dev/vda1: 4 bytes were erased at offset 0x00000000 (xfs): 58 46 53 42

wipefs -a /dev/vda

/dev/vda: 2 bytes were erased at offset 0x000001fe (dos): 55 aa
/dev/vda: calling ioctl to re-read partition table: Success

#恢复分区

#目前我也不知道应该怎么办.测试一下.

fsck.xfs /dev/vda1

If you wish to check the consistency of an XFS filesystem or
repair a damaged filesystem, see xfs_repair(8).

xfs_repair -n /dev/vda1

Phase 1 - find and verify superblock…
bad primary superblock - bad magic number !!!

attempting to find secondary superblock…
.found candidate secondary superblock…
verified secondary superblock…
would write modified primary superblock
Primary superblock would have been modified.
Cannot proceed further in no_modify mode.
Exiting now.
看样子有门 . 喝喝.

xfs_repair /dev/vda1

Phase 1 - find and verify superblock…
bad primary superblock - bad magic number !!!

attempting to find secondary superblock…
.found candidate secondary superblock…
verified secondary superblock…
writing modified primary superblock
sb realtime bitmap inode 18446744073709551615 (NULLFSINO) inconsistent with calculated value 129
resetting superblock realtime bitmap ino pointer to 129
sb realtime summary inode 18446744073709551615 (NULLFSINO) inconsistent with calculated value 130
resetting superblock realtime summary ino pointer to 130
Phase 2 - using internal log
- zero log…
- scan filesystem freespace and inode maps…
sb_icount 0, counted 64
sb_ifree 0, counted 61
sb_fdblocks 5240040, counted 5240032
- found root inode chunk
Phase 3 - for each AG…
- scan and clear agi unlinked lists…
- process known inodes and perform inode discovery…
- agno = 0
- agno = 1
- agno = 2
- agno = 3
- process newly discovered inodes…
Phase 4 - check for duplicate blocks…
- setting up duplicate extent list…
- check for inodes claiming duplicate blocks…
- agno = 0
- agno = 1
- agno = 2
- agno = 3
Phase 5 - rebuild AG headers and trees…
- reset superblock…
Phase 6 - check inode connectivity…
- resetting contents of realtime bitmap and summary inodes
- traversing filesystem …
- traversal finished …
- moving disconnected inodes to lost+found …
Phase 7 - verify and correct link counts…
Note - stripe unit (0) and width (0) were copied from a backup superblock.
Please reset with mount -o sunit=,swidth= if necessary
done
文件一切正常.

测试结论:
恢复分区后. 直接xfs_repair 就全都恢复了.

==============
使用wipefs 删除特征信息的恢复操作. 测试的两种情况都很顺利.
实际当中可能还要考虑两个情况.

  1. 如果需要恢复分区. 分区开头在哪儿!
  2. 数据是不是wipefs删除的. 之后又做了什么.
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值