1

I need help. Accidentally, all files from root were deleted. It was not me) It is easy if there would be simple disk partition. But, there is logical volumes used. Centos 7 KVM QEMU

$ ll server.img 
-rw-------. 1 root root 53687091200 oct 23 14:35 server.img

$ file -sL server.img 
server.img: x86 boot sector; partition 1: ID=0x83, active, starthead 32, startsector 2048, 2097152 sectors; partition 2: ID=0x8e, starthead 170, startsector 2099200, 102758400 sectors, code offset 0x63

I tried some things with no success. Anybody have an thoughts how to recover the data from /dev/cl/root? Will appreciate any ideas.

wdport
  • 31
  • Related: https://unix.stackexchange.com/questions/316401/how-to-mount-a-disk-image-from-the-command-line – Jim L. Oct 23 '19 at 20:16
  • Thank you. I already mounted partition from the img file, changed volume group name. And then, I've realized that it used xfs. Officially lost. Question is solved. – wdport Oct 23 '19 at 21:02

1 Answers1

2

If someone need a solution for ext3/4 filesystem. Here it is. Check fs table

# fdisk -lu server.img

Disk server.img: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000bef15

              Device Boot      Start         End      Blocks   Id  System
server.img1   *        2048     2099199     1048576   83  Linux
server.img2         2099200   104857599    51379200   8e  Linux LVM

Target partition starts at sector 2099200 Size is 512*2099200 = 1074790400

# losetup -o 1074790400 /dev/loop0 server.img
# fsck -fv /dev/loop0
fsck from util-linux 2.23.2
# lvmdiskscan
  /dev/loop0       [      49.00 GiB] LVM physical volume
  /dev/cl/root     [     430.71 GiB] 
  /dev/sda1        [       1.00 GiB] 
  /dev/cl/swap     [       4.00 GiB] 
  /dev/sda2        [     464.71 GiB] LVM physical volume
  2 disks
  1 partition
  0 LVM physical volume whole disks
  1 LVM physical volumes

Check Volume Groups.

# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl" using metadata type lvm2
# vgdisplay
  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                3
  Open LV               3
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               464.71 GiB
  PE Size               4.00 MiB
  Total PE              118965
  Alloc PE / Size       118965 / 464.71 GiB
  Free  PE / Size       0 / 0   
  VG UUID               qXzwwe-OLg7-Xm25-LImC-fBb9-ohLh-RMqtxn

  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               49.00 GiB
  PE Size               4.00 MiB
  Total PE              12543
  Alloc PE / Size       12543 / 49.00 GiB
  Free  PE / Size       0 / 0   
  VG UUID               tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc

Our volume groups have same name. Rename target volume group.

# vgrename -v tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc cl_new
# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl_new" using metadata type lvm2
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  inactive          '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

Activate logical volume

# lvchange -ay /dev/cl_new/root
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  ACTIVE            '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

Use some tool to restore file (extundelete, ext3magic, ext4magic, etc)

# extundelete /dev/cl_new/root --restore-all

Good luck! And do not use rm -rf / with sudo :)

PS. I have XFS on my virtual disks and it was failed.

extundelete: Bad magic number in super-block when trying to open filesystem /dev/cl_new/root

wdport
  • 31