Best practices for restoring data on Linux instances-Elastic Compute Service(ECS)-阿里云帮助中心

Restore accidentally deleted files on a Linux ECS instance with testdisk and disk reattachment.

Background

The workflows and tools in this topic help restore accidentally deleted files. Restoration results vary based on your scenario and method. Choose appropriate measures based on your actual situation.

Prerequisites

You have read the Workflows section.
You have the knowledge and skills to restore data without causing further corruption.
You have created snapshots for the disks whose data you want to restore to prevent corruption from incorrect operations.

Warning

This topic uses third-party open source software for data restoration. Alibaba Cloud does not guarantee the restoration results of third-party software.
If the data is critical and you lack data restoration expertise, contact a professional data restoration agency instead of restoring data manually.

Workflows

Restore data when the system cannot start after accidental deletion

If you run rm -rf /* as the root user on a Linux instance and the grub CLI appears after restart, follow this workflow to restore data from the source system disk.

Restore data after a system file is accidentally deleted

If you run rm -rf <file_or_dir> on a Linux instance and need to restore the deleted data, follow this workflow.

Note

If the deletion causes an SSH connection failure, use VNC (VNC) to connect to the instance.

Operation guide

The following example demonstrates data restoration using testdisk when the instance cannot start after accidental deletion.

Use cases

You accidentally run rm -rf /* and the instance cannot start.
No snapshots were created before the deletion, or you prefer not to use snapshots for restoration.
You want to restore data using another Linux instance.

Operation flowchart

The following flowchart shows the data restoration procedure.

Procedure

Create snapshots for the current instance.

Before restoring data, create a snapshot for the system disk or data disk of the target instance to back up existing data. See Create a snapshot for a disk.
Detach the disk from the source instance and attach it to another instance.

Warning
Before detaching the system disk, stop the instance. In the ECS console, select Force Stop. Otherwise, the system disk cannot be detached.

Force Stop is equivalent to powering off the instance. Data that has not been written to the disk in the operating system may be lost. Proceed with caution.

Detach the system disk or data disk and attach it to another normal Linux instance. See Detach or attach system disk.

Warning
When you attach the source system disk to another instance as a data disk, the ECS console may prompt you to initialize the disk. Do not select Initialize Now. Close the dialog box and proceed. Otherwise, the data to be restored will be corrupted.

Restore the accidentally deleted data.

Use testdisk to restore deleted data or directories. The following example restores a deleted directory on a Linux instance.

Install testdisk on the normal instance. The command varies by operating system.
Alibaba Cloud Linux 2 or 3
```
sudo yum install -y testdisk
```
CentOS 6, CentOS 7, or CentOS 8
```
sudo yum install -y testdisk
```
Ubuntu or Debian
```
sudo apt install -y testdisk
```

Check the current disk partitions:

sudo fdisk -lu

Example output:

Disk /dev/vda: 145 GiB, 155692564480 bytes, 304087040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C

Device      Start       End   Sectors   Size Type
/dev/vda1    2048      6143      4096     2M BIOS boot
/dev/vda2    6144    415743    409600   200M EFI System
/dev/vda3  415744 304087006 303671263 144.8G Linux filesystem


Disk /dev/vdb: 40 GiB, 42949672960 bytes, 83886080 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C

Device      Start      End  Sectors  Size Type
/dev/vdb1    2048     6143     4096    2M BIOS boot
/dev/vdb2    6144   415743   409600  200M EFI System
/dev/vdb3  415744 83886046 83470303 39.8G Linux filesystem

In this example, /dev/vda is the system disk of the normal instance. /dev/vdb is the source instance's system disk, attached as a data disk.

Run testdisk on the target disk:

sudo testdisk /dev/vdb

Select Proceed (default) and press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
>Disk /dev/vdb - 42 GB / 40 GiB



>[Proceed ]  [ Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has an incorrect size, check HD jumper settings and BIOS
detection, and install the latest OS patches and disk drivers.

Select the partition table style. The default is Intel. If the disk uses GUID Partition Table (GPT), select EFI GPT. Press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/vdb - 42 GB / 40 GiB

Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
>[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map (legacy)
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Hint: EFI GPT partition table type has been detected.Note: Do NOT select 'None' for media with only a single partitio

Select Analyse and press Enter to scan the disk.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/vdb - 42 GB / 40 GiB
     CHS 83220 16 63 - sector size=512

>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection



Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.

If no partition information appears, select Quick Search and press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/vdb - 42 GB / 40 GiB - CHS 83220 16 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Unknown                    2048       6143       4096
 2 P EFI System                 6144     415743     409600
 3 P Linux filesys. data      415744   83886046   83470303


              P=Primary  D=Deleted
>[Quick Search]  [ Backup ]
                    Try to locate partition

When partition information appears, select the target partition and press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

   Disk /dev/vdb - 42 GB / 40 GiB - CHS 83220 16 63
     Partition               Start        End    Size in sectors
  P MS Data                   6144     415743       409600
>P Linux filesys. data      415744   83886039    83470296 [root]




Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition

Select Deeper Search and press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/vdb - 42 GB / 40 GiB - CHS 83220 16 63

     Partition                  Start        End    Size in sectors

 1 P MS Data                    6144     415743     409600
 2 P Linux filesys. data      415744   83886039  83470296 [root]




[ Quit  ]  [ Return ]  >[Deeper Search]  [ Write  ]
                  Try to find more partitions

When recoverable files appear, select Continue and press Enter.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/vdb - 42 GB / 40 GiB - CHS 83220 16 63

The harddisk (42 GB / 40 GiB) seems too small! (< 75 GB / 70 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  Linux filesys. data      677886   84148181   83470296  [root]
   Linux filesys. data     1202174   84672469   83470296  [root]
   Linux filesys. data     1726462   85196757   83470296  [root]
   Linux filesys. data     2250750   85721045   83470296  [root]
   Linux filesys. data     2775038   86245333   83470296  [root]
   Linux filesys. data     6969342   90439637   83470296  [root]
   Linux filesys. data     7493630   90963925   83470296  [root]
   Linux filesys. data    13260798   96731093   83470296  [root]
   Linux filesys. data    17461456  100931751   83470296  [root]
   Linux filesys. data    17461598  100931893   83470296  [root]

[ Continue ]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 42 GB / 39 GiB

Press P to list files.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
   P Linux filesys. data      415744    83886039    83470296 [root]
Directory /

>dr-xr-xr-x     0     0      4096 20-Dec-2024 10:06 .
 dr-xr-xr-x     0     0      4096 20-Dec-2024 10:06 ..
 drwxr-xr-x     0     0      4096 20-Dec-2024 10:06 usr
 dr-xr-xr-x     0     0      4096 20-Dec-2024 10:03 boot
 drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 dev
 drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 proc
 drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 run
 drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 sys
 drwxr+xr-x     0     0         0 20-Dec-2024 10:06 etc
 -rw-------     0     0         0 20-Dec 2024 10:06 root
 drwxr-xr-x     0     0      4096 20-Dec-2024 10:06 var
 drwxr-xr-x     0     0      4096 20 Dec-2024 10:06 usr
 lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 bin
 lrwxrwxrwx     0     0         8  9-Feb 2022 20:18 sbin
 lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 lib
 lrwxrwxrwx     0     0         9  9 Feb 2022 20:18 lib64
 lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 bin;672827fb
 drwxr-xr-x     0     0         8 20-Dec-2024 18:03 home
 -rw-------     0     0         8 20-Dec-2024 09:43 .ismount-test-file
 drwxr-xr-x     0     0         0 29-Dec-2024 18:03 media
 drwxr-xr-x     0     0         8 20-Dec-2024 10:03 mnt
 drwxr-xr-x     0     0         8 20-Dec-2024 18:03 opt
 lrwxrwxrwx     0     0         9  9-Feb-2022 20:18 sbin;672827fb
 drwxr-xr-x     0     0         8 29-Dec-2024 18:04 srv
 drwxrwxrwt     0     0      4096 20-Dec-2024 10:06 tmp
                                                     Next
Use Right to change directory, h to hide deleted files
    q to quit, : to select the current file, a to select all files
    C to copy the selected files, c to copy the current file

Restore specified files and folders

Select the file to restore and press c.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
   Linux filesys. data           415744    83886039    83470296 [root]
Directory /

dr-xr-xr-x     0     0      4096 18-Dec-2024 11:14 .
dr-xr-xr-x     0     0      4096 18-Dec-2024 11:14 ..
drwx------     0     0         0 18-Dec-2024 11:13 lost+found
dr-xr-xr-x     0     0      4096 18-Dec-2024 11:13 boot
drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 dev
drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 proc
drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 run
drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 sys
drwxr-xr-x     0     0         0 18-Dec-2024 11:15 etc
dr-xr-x---     0     0      4096 18-Dec-2024 11:14 root
drwxr-xr-x     0     0      4096  4-Nov-2024 10:03 var
drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 usr
lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 bin
lrwxrwxrwx     0     0         8  9-Feb-2022 20:18 sbin
                                                    Next
Use Right to change directory, h to hide deleted files
    q to quit, : to select the current file, a to select all files
    C to copy the selected files, c to copy the current file

Restore all files

Press a to select all files, then press C to copy.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
   P Linux filesys. data    415744    83886039    83470296 [root]
Directory /

>dr-xr-xr-x     0     0      4096 20-Dec-2024 10:06 .
 dr-xr-xr-x     0     0      4096 20-Dec-2024 10:06 ..
 *drwxr-xr-x     0     0      4096 20-Dec-2024 10:06 usr
 *dr-xr-xr-x     0     0      4096 20-Dec-2024 10:03 boot
 *drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 dev
 *drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 proc
 *drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 run
 *drwxr-xr-x     0     0      4096  4-Nov-2024 09:48 sys
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:06 etc
 *-rw-------     0     0         0 20-Dec-2024 10:06 root
 *drwxr-xr-x     0     0      4096 20-Dec-2024 10:06 var
 *drwxr-xr-x     0     0      4096 20-Dec-2024 10:06 usr
 *lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 bin
 *lrwxrwxrwx     0     0         8  9-Feb-2022 20:18 sbin
 *lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 lib
 *lrwxrwxrwx     0     0         9  9-Feb-2022 20:18 lib64
 *lrwxrwxrwx     0     0         7  9-Feb-2022 20:18 bin;672827fb
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:03 home
 *-rw-------     0     0         0 20-Dec-2024 09:43 .ismount-test-file
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:03 media
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:03 mnt
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:03 opt
 *lrwxrwxrwx     0     0         8  9-Feb-2022 20:18 sbin;672827fb
 *drwxr-xr-x     0     0         0 20-Dec-2024 10:04 srv
 *drwxrwxrwt     0     0      4096 20-Dec-2024 10:06 tmp
                                                      Next
Use Right to change directory, h to hide deleted files
 q to quit, : to select the current file, a to select all files
 C to copy the selected files, c to copy the current file

Select a destination directory and press C to paste the files. In this example, files are restored to /home/ecs-user/data_recovery.

TestDisk 7.1, Data Recovery Utility, July 2019

Please select a destination where /root and any files below will be copied.
Keys: Arrow keys to select another directory
      C when the destination is correct
      Q to quit
Directory /home/ecs-user/data_recovery

>drwxrwxr-x  1000  1000      4096 18-Dec-2024 18:05 .
 drwx------  1000  1000      4096 18-Dec-2024 18:23 ..

A message similar to Copy done! 10 ok, 0 failed confirms the files are copied.

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
   Linux filesys. data      415744    83886039  83470296 [Root]
Directory /root
Copy done! 10 ok, 0 failed
dr-xr-xr-x     0     0     4096 18-Dec-2024 11:14 .
dr-xr-xr-x     0     0     4096 18-Dec-2024 11:14 ..
drwx------      0     0        0 18-Dec-2024 11:13 lost+found
dr-xr-xr-x     0     0     4096 18-Dec-2024 11:13 boot
drwxr-xr-x     0     0     4096  4-Nov-2024 09:48 dev
drwxr-xr-x     0     0     4096  4-Nov-2024 09:48 proc
drwxr-xr-x     0     0     4096  4-Nov-2024 09:48 run
drwxr-xr-x     0     0     4096  4-Nov-2024 09:48 sys
drwxr-xr-x     0     0        0 18-Dec-2024 11:15 etc
dr-xr-x---     0     0     4096 18-Dec-2024 11:14 root
drwxr-xr-x     0     0     4096  4-Nov-2024 10:03 var
drwxr-xr-x     0     0     4096  4-Nov-2024 09:48 usr
lrwxrwxrwx     0     0        7  9-Feb-2022 20:18 bin
lrwxrwxrwx     0     0        8  9-Feb-2022 20:18 sbin
                                                    Next
Use Right to change directory, h to hide deleted files
   St q to quit, : to select the current file, a to select all files
       C to copy the selected files, c to copy the current file

Reconnect to the instance and go to /home/ecs-user/data_recovery. If the files appear in the directory, the restoration is successful.

[ecs-user@                              root]$ pwd
/home/ecs-user/data_recovery/root
[ecs-user@                              root]$ ls -la
total 20
drwxr-xr-x 4 root     root           4096 Dec 18 11:14 .
drwxrwxr-x 3 ecs-user ecs-user       4096 Dec 18 18:26 ..
-rw-r--r-- 1 root     root              0 Nov  4 10:06 anaconda-ks.cfg
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .bash_logout
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .bash_profile
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .bashrc
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .cshrc
-rw-r--r-- 1 root     root            102 Nov  4 10:06 original-ks.cfg
drwxr-xr-x 2 root     root           4096 Dec 18 11:14 .pip
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .pydistutils.cfg
-rw-r--r-- 1 root     root              0 Dec 18 11:15 script
-rw-r--r-- 1 root     root              0 Dec 18 11:14 sedZsHuoR
drwxr-xr-x 2 root     root           4096 Dec 18 11:14 .ssh
-rw-r--r-- 1 root     root              0 Dec 18 11:14 .tcshrc

References

See Create a snapshot for a disk.
See Detach or attach system disk.
See Re-initialize system disk (reset OS).
See Create disk from snapshot.
See Connect using VNC.
See Use Workbench to log on to a Linux instance over SSH.
See Tools for restoring data on Linux.