When you use a Linux Elastic Compute Service (ECS) instance, a common O&M operation is to delete the files that you no longer require. This can effectively reduce disk usage. However, if files are accidentally deleted due to misoperation, program anomalies, or viruses, you must restore the files. This topic describes how to restore data after files on a Linux instance are accidentally deleted.
Background information
The workflow and tools described in this topic provide a comprehensive solution to restore files that are accidentally deleted. The extent to which files can be restored may vary based on your business scenario and operation method. We recommend that you take reasonable data restoration measures based on your actual business scenario.
Prerequisites
You read the Workflows section of this topic.
You have the required knowledge and skills on how to restore data to prevent data corruption.
You create snapshots for the disks whose data you want to restore. This prevents data from being corrupted due to incorrect operations.
Third-party open source software is used as the data restoration tool in this topic. Alibaba Cloud cannot guarantee to the extent to which files are restored by third-party software.
If the data that you want to restore is critical, and you do not have the relevant expertise in data restoration, we recommend that you contact a professional data restoration agency, instead of manually restoring data.
Workflows
Restore data from a system that cannot be started due to accidental file deletion
You run the rm -rf /* command on a Linux instance as the root user to delete all files in the root directory. After you restart the operating system, the grub command line interface appears. If you want to restore the data on the source system disk, follow the following workflow.
Restore data after a system file is accidentally deleted
You run the rm -rf <file_or_dir> command on a Linux instance to delete files or directories. If you want to restore the data on the source system disk, follow the following workflow.
If an accidentally deleted file may cause an SSH connection failure, you can use Virtual Network Computing (VNC) to connect to the instance.
Operation guide
The preceding content introduces two common data restoration workflows after data is accidentally deleted from Linux instances. The following section describes how to restore data by using three conditions as examples.
Scenarios
For example, you run the
rm -rf /*command to accidentally delete the files. As a result, the instance cannot start.You have not created snapshots before the delete operation or do not want to use snapshots to restore data.
You want to restore data by using another Linux instance.
Operation flowchart
The following flowchart shows the procedure of data restoration.
Procedure
Create snapshots for the current instance.
Before you restore data, we recommend that you create a snapshot for the system disk or a data disk of the instance on which you want to restore data. This way, you can use the snapshot to back up existing data and prevent file corruption during subsequent restoration operations. For information about how to create a snapshot, see Create a snapshot for a disk.
Detach the system disk or a data disk from the instance on which you want to restore data and attach the disk to another instance.
WarningBefore you detach the system disk, you must stop the system disk. If you perform the stop operation in the ECS console, select Force Stop. Otherwise, the system disk fails to be stopped.
You can detach the system disk or a data disk and attach the disk to another normal Linux instance to restore data. For information about how to detach and attach a data disk, see Detach or attach a system disk.
WarningWhen you attach the source system disk to another instance as a data disk in the ECS console, the file system mounted to the system disk may be corrupted. As a result, the ECS console prompts you to initialize the disk. In this case, do not select Initialize Now in the ECS console. Otherwise, the data to be restored may be corrupted. Close the dialog box and proceed with the operation.
Restore the accidentally deleted data.
You can use the testdisk tool to restore the deleted data or directory. The following example describes how to restore a deleted directory on a Linux instance.
Run the following command to install the testdisk tool on a normal instance. The command varies based on the operating system.
Alibaba Cloud Linux 2 or 3
sudo yum install -y testdiskCentOS 6, CentOS 7, or CentOS 8
sudo yum install -y testdiskUbuntu or Debian
sudo apt install -y testdiskRun the following command to check the current disk partition:
sudo fdisk -luThe following command output is returned.
Disk /dev/vda: 145 GiB, 155692564480 bytes, 304087040 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C Device Start End Sectors Size Type /dev/vda1 2048 6143 4096 2M BIOS boot /dev/vda2 6144 415743 409600 200M EFI System /dev/vda3 415744 304087006 303671263 144.8G Linux filesystem Disk /dev/vdb: 40 GiB, 42949672960 bytes, 83886080 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C Device Start End Sectors Size Type /dev/vdb1 2048 6143 4096 2M BIOS boot /dev/vdb2 6144 415743 409600 200M EFI System /dev/vdb3 415744 83886046 83470303 39.8G Linux filesystemIn the preceding example,
/dev/vdais the system disk of the existing normal instance./dev/vdbis the system disk of the source instance, which is attached to the normal instance as a data disk.Run the following command to use
testdiskto handle the specific disk:sudo testdisk /dev/vdbThe following command output is returned. Select
Proceed(default) and press the Enter key.
Select the partition table style for scanning. In most cases, the default Intel style is selected. If your data disk uses the GUID Partition Table (
GPT) style, select EFI GPT. Press the Enter key.
Select Analyse and press the Enter key for disk analysis.
If partition information is not displayed, select Quick Search and press the Enter key.
In the command output shown in the following figure, partition information is displayed. Select the partition from which you want to restore data and press the Enter key.
Select Deeper Search and press the Enter key.
In the search results, the recoverable files appear. Select Continue and press the Enter key.
Press the P key to list files.
Restore specified files and folders
Select the file that you want to restore and press the c key.
Restore all files
Press the a key to select all files, and then press the C key to copy the files.
Select a destination directory and press the C key to paste the selected files to the destination directory. In this example, files are restored to the /home/ecs-user/data_recovery directory.
If a message similar to
Copy done! 10 ok, 0 failedappears as shown in the following figure, the files are copied as expected.
Reconnect to the existing instance and go to the /home/ecs-user/data_recovery directory. If the files are listed in the directory, the files are restored as expected.
References
For information about how to create a snapshot, see Create a snapshot for a disk.
For information about how to detach and attach a data disk, see Detach or attach a system disk.
For information about how to re-initialize a system disk, see Re-initialize a system disk.
For information about how to create a disk from a snapshot, see Create a disk from a snapshot.
For information about how to use VNC to connect to an instance, see Connect to an instance by using VNC.
For information about how to use SSH to connect to an instance, see Use Workbench to log on to a Linux instance over SSH.
For information about data restoration tools for Linux instances, see Restore data in Linux instances.