0

I need help. Accidentally, all files from root were deleted. It was not me) It is easy if there would be simple disk partition. But, there is logical volumes used. Centos 7 KVM QEMU

$ ll server.img 
-rw-------. 1 root root 53687091200 oct 23 14:35 server.img

$ file -sL server.img 
server.img: x86 boot sector; partition 1: ID=0x83, active, starthead 32, startsector 2048, 2097152 sectors; partition 2: ID=0x8e, starthead 170, startsector 2099200, 102758400 sectors, code offset 0x63

I tried some things with no success. Anybody have an thoughts how to recover the data from /dev/cl/root? Will appreciate any ideas.

  • Related: unix.stackexchange.com/questions/316401/… – Jim L. Oct 23 '19 at 20:16
  • Thank you. I already mounted partition from the img file, changed volume group name. And then, I've realized that it used xfs. Officially lost. Question is solved. – willyd Oct 23 '19 at 21:02
0

If someone need a solution for ext3/4 filesystem. Here it is. Check fs table

# fdisk -lu server.img

Disk server.img: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000bef15

              Device Boot      Start         End      Blocks   Id  System
server.img1   *        2048     2099199     1048576   83  Linux
server.img2         2099200   104857599    51379200   8e  Linux LVM

Target partition starts at sector 2099200 Size is 512*2099200 = 1074790400

# losetup -o 1074790400 /dev/loop0 server.img
# fsck -fv /dev/loop0
fsck from util-linux 2.23.2
# lvmdiskscan
  /dev/loop0       [      49.00 GiB] LVM physical volume
  /dev/cl/root     [     430.71 GiB] 
  /dev/sda1        [       1.00 GiB] 
  /dev/cl/swap     [       4.00 GiB] 
  /dev/sda2        [     464.71 GiB] LVM physical volume
  2 disks
  1 partition
  0 LVM physical volume whole disks
  1 LVM physical volumes

Check Volume Groups.

# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl" using metadata type lvm2
# vgdisplay
  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                3
  Open LV               3
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               464.71 GiB
  PE Size               4.00 MiB
  Total PE              118965
  Alloc PE / Size       118965 / 464.71 GiB
  Free  PE / Size       0 / 0   
  VG UUID               qXzwwe-OLg7-Xm25-LImC-fBb9-ohLh-RMqtxn

  --- Volume group ---
  VG Name               cl
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               49.00 GiB
  PE Size               4.00 MiB
  Total PE              12543
  Alloc PE / Size       12543 / 49.00 GiB
  Free  PE / Size       0 / 0   
  VG UUID               tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc

Our volume groups have same name. Rename target volume group.

# vgrename -v tMnvy0-3LWI-SWX3-SuHr-Cxfy-ueE7-7jeYZc cl_new
# vgscan
  Reading volume groups from cache.
  Found volume group "cl" using metadata type lvm2
  Found volume group "cl_new" using metadata type lvm2
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  inactive          '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

Activate logical volume

# lvchange -ay /dev/cl_new/root
# lvscan
  ACTIVE            '/dev/cl/root' [430.71 GiB] inherit
  ACTIVE            '/dev/cl/home' [30.00 GiB] inherit
  ACTIVE            '/dev/cl/swap' [4.00 GiB] inherit
  ACTIVE            '/dev/cl_new/root' [44.00 GiB] inherit
  inactive          '/dev/cl_new/swap' [5.00 GiB] inherit

Use some tool to restore file (extundelete, ext3magic, ext4magic, etc)

# extundelete /dev/cl_new/root --restore-all

Good luck! And do not use rm -rf / with sudo :)

PS. I have XFS on my virtual disks and it was failed.

extundelete: Bad magic number in super-block when trying to open filesystem /dev/cl_new/root

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.