Data restoration on Linux ECS instances

Workflow: System fails to start

When you run the rm -rf /* command as the root user on a Linux ECS instance, all files in the root directory are deleted. After you restart the operating system, the ECS instance enters the grub command-line interface. To restore data from the original system disk, you can follow the workflow below.

Workflow for accidental file deletion

When you run the rm -rf <file_or_dir> command on a Linux ECS instance, it deletes files or directories. To restore data from the original system disk, you can follow the workflow below.

Scenario

• You ran the rm -rf /* command, which deleted files and caused the system to fail to start.

• You did not create a snapshot before the deletion, or you prefer not to use a snapshot for data restoration.

• You want to restore data by using another Linux ECS instance.

Workflow overview

The following flowchart shows the procedure for this scenario.

Procedure

1. Create a snapshot for the ECS instance

   Before you start the data restoration, create a snapshot of the system disk or data disk that you want to recover. This backs up the current data and prevents data loss from errors during the recovery process. For more information, see Create a snapshot for a disk.

2. Detach the disk and attach it to a new ECS instance

   Warning

   You must stop an ECS instance before you can detach its system disk. When you stop the ECS instance in the console, you must select the Force Stop option. Otherwise, the stop operation fails.

   

   Detach the system disk or data disk and attach it to another Linux ECS instance to restore the data. For more information, see Detach or attach a system disk.

   Warning

   When you attach the original system disk as a data disk to a new ECS instance in the console, the console may prompt you to initialize the disk because its file system might be corrupted. In this situation, do not select Initialize Now. If you re-initialize the disk from the console, the data that you want to restore may be permanently damaged. Close the dialog box to proceed.

   

3. Restore the deleted data

   Use the testdisk tool to restore the deleted data. The following steps show how to restore a deleted directory on a Linux ECS instance.

   1. Run the following command on the new ECS instance to install the testdisk tool.

      Alibaba Cloud Linux 2/3

      sudo yum install -y testdisk

      CentOS 6/7/8

      sudo yum install -y testdisk

      Ubuntu/Debian

      sudo apt install -y testdisk

   2. Run the following command to check the current disk partitions.

      sudo fdisk -lu

      Example output:

      Disk /dev/vda: 145 GiB, 155692564480 bytes, 304087040 sectors
      Units: sectors of 1 * 512 = 512 bytes
      Sector size (logical/physical): 512 bytes / 512 bytes
      I/O size (minimum/optimal): 512 bytes / 512 bytes
      Disklabel type: gpt
      Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C
      
      Device      Start       End   Sectors   Size Type
      /dev/vda1    2048      6143      4096     2M BIOS boot
      /dev/vda2    6144    415743    409600   200M EFI System
      /dev/vda3  415744 304087006 303671263 144.8G Linux filesystem
      
      
      Disk /dev/vdb: 40 GiB, 42949672960 bytes, 83886080 sectors
      Units: sectors of 1 * 512 = 512 bytes
      Sector size (logical/physical): 512 bytes / 512 bytes
      I/O size (minimum/optimal): 512 bytes / 512 bytes
      Disklabel type: gpt
      Disk identifier: F51132A7-67B1-4650-806D-FD0DE6E1210C
      
      Device      Start      End  Sectors  Size Type
      /dev/vdb1    2048     6143     4096    2M BIOS boot
      /dev/vdb2    6144   415743   409600  200M EFI System
      /dev/vdb3  415744 83886046 83470303 39.8G Linux filesystem

      In this example, /dev/vda is the system disk of the current ECS instance, and /dev/vdb is the original system disk attached as a data disk.

   3. Run the following command to open the specified device with testdisk.

      sudo testdisk /dev/vdb

      The following information is returned. Select Proceed (default) and press Enter.

      

   4. Select the partition table type to scan. Typically, you can select Intel. If your data disk uses the GUID Partition Table (GPT) format, select EFI GPT. After you make your selection, press Enter.

      

   5. Select Analyse and press Enter to analyze the disk.

      

   6. Select Quick Search and press Enter to perform a quick search.

      

      The partition information is displayed in the search results. Select the partition from which you want to restore data and press Enter.

      

   7. Select Deeper Search and press Enter.

      

   8. After the search is complete, a list of recoverable files is displayed. Select Continue and press Enter.

      

      Press P to list the files.

      

      Specific files and folders

      Select the files or folders that you want to restore, and then press c to copy them.

      

      All files

      Press a to select all files, and then press C to copy them.

      

   9. Select a destination directory and press C to copy the selected files to it. This example uses /home/ecs-user/data_recovery as the destination.

      

      When the message Copy done! 10 ok, 0 failed appears, the files have been successfully copied.

      

   10. Open a new connection to the ECS instance and navigate to the /home/ecs-user/data_recovery directory to view the files. If you can see the files, the data restoration is successful.