Best practices for restoring data on Linux instances - Elastic Compute Service

Restore accidentally deleted files on a Linux ECS instance with testdisk and disk reattachment.

Background

The workflows and tools in this topic help restore accidentally deleted files. Restoration results vary based on your scenario and method. Choose appropriate measures based on your actual situation.

Prerequisites

You have read the Workflows section.
You have the knowledge and skills to restore data without causing further corruption.
You have created snapshots for the disks whose data you want to restore to prevent corruption from incorrect operations.

Warning

This topic uses third-party open source software for data restoration. Alibaba Cloud does not guarantee the restoration results of third-party software.
If the data is critical and you lack data restoration expertise, contact a professional data restoration agency instead of restoring data manually.

Workflows

Restore data when the system cannot start after accidental deletion

If you run rm -rf /* as the root user on a Linux instance and the grub CLI appears after restart, follow this workflow to restore data from the source system disk.

Restore data after a system file is accidentally deleted

If you run rm -rf <file_or_dir> on a Linux instance and need to restore the deleted data, follow this workflow.

Note

If the deletion causes an SSH connection failure, use VNC (VNC) to connect to the instance.

Operation guide

The following example demonstrates data restoration using testdisk when the instance cannot start after accidental deletion.

Use cases

You accidentally run rm -rf /* and the instance cannot start.
No snapshots were created before the deletion, or you prefer not to use snapshots for restoration.
You want to restore data using another Linux instance.

Operation flowchart

The following flowchart shows the data restoration procedure.

Procedure

Create snapshots for the current instance.

Before restoring data, create a snapshot for the system disk or data disk of the target instance to back up existing data. See Create a snapshot for a disk.
Detach the disk from the source instance and attach it to another instance.

Warning
Before detaching the system disk, stop the instance. In the ECS console, select Force Stop. Otherwise, the system disk cannot be detached.

Detach the system disk or data disk and attach it to another normal Linux instance. See Detach or attach system disk.

Warning
When you attach the source system disk to another instance as a data disk, the ECS console may prompt you to initialize the disk. Do not select Initialize Now. Close the dialog box and proceed. Otherwise, the data to be restored will be corrupted.
Restore the accidentally deleted data.

Use testdisk to restore deleted data or directories. The following example restores a deleted directory on a Linux instance.
1. Install testdisk on the normal instance. The command varies by operating system.
  Alibaba Cloud Linux 2 or 3
```
sudo yum install -y testdisk
```
  CentOS 6, CentOS 7, or CentOS 8
```
sudo yum install -y testdisk
```
  Ubuntu or Debian
```
sudo apt install -y testdisk
```
2. Check the current disk partitions:
```
sudo fdisk -lu
```
  Example output:
```
Disk /dev/vda: 145 GiB, 155692564480 bytes, 304087040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C

Device      Start       End   Sectors   Size Type
/dev/vda1    2048      6143      4096     2M BIOS boot
/dev/vda2    6144    415743    409600   200M EFI System
/dev/vda3  415744 304087006 303671263 144.8G Linux filesystem


Disk /dev/vdb: 40 GiB, 42949672960 bytes, 83886080 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C

Device      Start      End  Sectors  Size Type
/dev/vdb1    2048     6143     4096    2M BIOS boot
/dev/vdb2    6144   415743   409600  200M EFI System
/dev/vdb3  415744 83886046 83470303 39.8G Linux filesystem
```
  In this example, /dev/vda is the system disk of the normal instance. /dev/vdb is the source instance's system disk, attached as a data disk.
3. Run testdisk on the target disk:
```
sudo testdisk /dev/vdb
```
  Select Proceed (default) and press Enter.
4. Select the partition table style. The default is Intel. If the disk uses GUID Partition Table (GPT), select EFI GPT. Press Enter.
5. Select Analyse and press Enter to scan the disk.
6. If no partition information appears, select Quick Search and press Enter.
  
  When partition information appears, select the target partition and press Enter.
7. Select Deeper Search and press Enter.
8. When recoverable files appear, select Continue and press Enter.
  
  Press P to list files.
  
  Restore specified files and folders
  
  Select the file to restore and press c.
  
  Restore all files
  
  Press a to select all files, then press C to copy.
9. Select a destination directory and press C to paste the files. In this example, files are restored to /home/ecs-user/data_recovery.
  
  A message similar to Copy done! 10 ok, 0 failed confirms the files are copied.
10. Reconnect to the instance and go to /home/ecs-user/data_recovery. If the files appear in the directory, the restoration is successful.