[go: up one dir, main page]

CN119739562A - Data recovery method, device, equipment and medium based on NetApp WAFL file system damage - Google Patents

Data recovery method, device, equipment and medium based on NetApp WAFL file system damage Download PDF

Info

Publication number
CN119739562A
CN119739562A CN202411808463.0A CN202411808463A CN119739562A CN 119739562 A CN119739562 A CN 119739562A CN 202411808463 A CN202411808463 A CN 202411808463A CN 119739562 A CN119739562 A CN 119739562A
Authority
CN
China
Prior art keywords
file system
data
node
damaged
netapp
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202411808463.0A
Other languages
Chinese (zh)
Inventor
孙美君
康艳荣
王征
张亚平
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tianjin University
Original Assignee
Tianjin University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tianjin University filed Critical Tianjin University
Priority to CN202411808463.0A priority Critical patent/CN119739562A/en
Publication of CN119739562A publication Critical patent/CN119739562A/en
Pending legal-status Critical Current

Links

Landscapes

  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The invention discloses a data recovery method, device, equipment and medium based on NETAPP WAFL file system damage, which comprises the steps of S1 judging whether RAID array information of a file system is damaged and reconstructing storage pool equipment according to the RAID array information, S2 analyzing file system metadata in the storage pool equipment and judging whether the file system metadata exists, S3 reading user node table data based on the file system metadata and judging whether the user node table data exists, S4 reading file system root node data and judging whether the root node data exists, S5 analyzing node data block mapping and judging node types, S6 analyzing node data corresponding to directory items, obtaining the file node types, traversing files in the directory items to complete file analysis, S7 repeatedly traversing all hard disks in the storage pool equipment and analyzing a complete file system.

Description

Data recovery method, device, equipment and medium based on NETAPP WAFL file system damage
Technical Field
The invention relates to a data recovery method, device, equipment and medium based on NETAPP WAFL file system damage, and relates to the technical field of data recovery.
Background
When the file system is damaged or data is deleted by human error in the current production environment NETAPP WAFL, it means that all or part of the data of the user in the file system will not be visible.
The existing data recovery technology can only complete recovery of lost data by scanning the head and tail of a known file type in a binary mode of a scanning disk, and the method can only recover files with a known file format and the data of the files are continuous in the disk, and files with an unknown format or file data with fragments in the disk cannot be recovered or the recovered files cannot be opened to prompt file damage. In addition, this recovery method requires scanning the entire binary content of the disk, and is therefore often slow and cannot quickly solve the problem.
Disclosure of Invention
The present invention aims to solve at least one of the technical problems existing in the prior art. In view of the foregoing, it is an object of the present invention to provide a method, apparatus, device and medium for recovering data based on NETAPP WAFL file system corruption, which can effectively recover invisible data.
In order to achieve the aim of the invention, the invention adopts the following technical scheme:
In a first aspect, the method for recovering data based on NETAPP WAFL file system corruption provided by the present invention includes:
s1, judging whether RAID array information of NETAPP WAFL file systems is damaged or not, and rebuilding storage pool equipment according to the RAID array information;
S2, analyzing file system metadata in storage pool equipment and judging whether the file system metadata exists, if so, entering S3, and if not, entering S8;
S3, reading user node table data based on file system metadata, judging whether the user node table data exist or not, if yes, entering S4, and if not, entering S9;
S4, reading file system root node data, judging whether the root node data exist, if yes, entering S5, and if not, entering S10;
s5, analyzing the node data block mapping, judging the node type, if the acquired node type is a file, completing file analysis, if the acquired node type is a directory entry, entering S6, and if the acquired directory entry data is damaged, entering S11;
s6, analyzing node data corresponding to the directory entries, obtaining file node types, traversing files in the directory entries, and completing file analysis;
s7, repeating the steps S2-S6 to traverse all hard disks in the storage pool equipment, and analyzing a complete file system;
S8, searching all file system metadata from storage pool equipment through a search keyword AB, FB, B8 or DA, and returning to S3;
S9, searching all user node table data blocks from the storage pool equipment through the search keywords 4D, 42, 46 or 49, and returning to S4;
S10, searching all user node table data from storage pool equipment, finding out a node with a node unique number of 2 as a root node of a file system, and returning to S5;
S11, searching all directory data blocks from the storage pool device through the search key words 43, 56, 58 or 00, and returning to S6.
Further, whether RAID array information of NETAPP WAFL file systems is damaged or not is judged, and storage pool equipment is rebuilt according to the RAID array information, specifically:
S101, reading RAID array information of NETAPP WAFL file systems, judging whether the RAID array information is damaged by searching whether a keyword of 44, 49, 41 or 52 is stored in the head of each disk, wherein 44, 49, 41 or 52 is byte data, if one of the keywords is byte data, indicating that the RAID array information exists, and if one of the keywords is not byte data, indicating that the RAID array information is damaged;
S102, if RAID array information is damaged, analyzing a distribution rule of data in each hard disk, and calculating RAID array information;
S103, combining all hard disks in storage into a large storage pool device through RAID array information, namely virtualizing all the hard disks into a large hard disk through RAID array information.
Further, analyzing the file system metadata in the storage pool device and judging whether the file system metadata exists, specifically, searching the file system metadata through searching keywords AB, FB, B8 or DA and analyzing, and if any keyword is not searched, considering that the file system metadata is not acquired or the acquired file system metadata is damaged.
Further, the user node table data is read based on the file system metadata, and whether the user node table data exists or not is judged, specifically, a user node table data block is searched through a search keyword 4D, 42, 46 or 49, and if any keyword is not searched, the user node table data is not obtained or the obtained user node table data is damaged.
Further, the root node data of the file system is read, whether the root node data exist or not is judged, specifically, the root node data of the file system is analyzed, user node table data is searched, a node with the unique node number of 2 is found as the root node data of the file system, and if the root node is not found, the root node data of the file system is not obtained or the obtained root node data of the file system is damaged.
Further, the node data block mapping is analyzed, and the node type is judged, specifically, the judgment that the node type flag bit is 0 represents a directory entry and 1 represents a file.
Further, it is determined whether the acquired directory item data is corrupted by searching the directory data block by the search key "43, 56, 58 or 00", and if any of the above keys is not searched, the acquired directory item data is considered corrupted.
In a second aspect, the present invention provides a data recovery apparatus based on NETAPP WAFL file system corruption, the apparatus comprising:
A first unit configured to determine NETAPP WAFL whether RAID array information of the file system is damaged, and reconstruct a storage pool device according to the RAID array information;
a second unit configured to parse the file system metadata in the storage pool device and determine whether the file system metadata exists;
A third unit configured to read user node table data based on the file system metadata and determine whether the user node table data exists;
A fourth unit configured to read root node data of the file system and determine whether the root node data exists;
a fifth unit configured to parse the node data block map, determine a node type, complete file parsing if the obtained node type is a file, and parse a directory entry if the obtained node type is a directory entry;
a sixth unit configured to parse node data corresponding to the directory entry, obtain a file node type, traverse the file in the directory entry, and complete file parsing;
And a seventh unit configured to traverse all hard disks in the storage pool device and parse the complete file system.
In a third aspect, the invention also provides an electronic device comprising at least one processor and a memory communicatively coupled to the processor, wherein the memory stores instructions executable by the processor to enable the processor to perform any one of the methods.
In a fourth aspect, the present invention also provides a computer readable storage medium storing one or more programs, the one or more programs comprising computer instructions for causing a computer to perform any of the methods.
The invention adopts the technical proposal and has the following characteristics:
1. The invention can quickly recover the data in the damaged NETAPP WAFL file system.
2. The invention does not cause secondary damage to the damaged NETAPP WAFL file system.
3. The invention can solve the problem of data recovery in the case of NETAPP WAFL file system damage, NETAPP WAFL file system mistakenly deleting data and the like.
In conclusion, the method and the device can be widely applied to data recovery.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Like parts are designated with like reference numerals throughout the drawings. In the drawings:
fig. 1 is a flow chart of a data recovery method according to an embodiment of the invention.
Fig. 2 is a block diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
It is to be understood that the terminology used herein is for the purpose of describing particular example embodiments only, and is not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises," "comprising," "includes," "including," and "having" are inclusive and therefore specify the presence of stated features, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and/or groups thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order described or illustrated, unless an order of performance is explicitly stated. It should also be appreciated that additional or alternative steps may be used.
Although the terms first, second, third, etc. may be used herein to describe various elements, components, regions, layers and/or sections, these elements, components, regions, layers and/or sections should not be limited by these terms. These terms may be only used to distinguish one element, component, region, layer or section from another region, layer or section. Terms such as "first," "second," and other numerical terms when used herein do not imply a sequence or order unless clearly indicated by the context. Thus, a first element, component, region, layer or section discussed below could be termed a second element, component, region, layer or section without departing from the teachings of the example embodiments.
For ease of description, spatially relative terms, such as "inner," "outer," "lower," "upper," and the like, may be used herein to describe one element or feature's relationship to another element or feature as illustrated in the figures. Such spatially relative terms are intended to encompass different orientations of the device in use or operation in addition to the orientation depicted in the figures.
Because the existing hard disk data recovery method needs to scan all binary contents of the disk, the method is slow and can not solve the problem rapidly. The data recovery method, device, equipment and medium based on NETAPP WAFL file system damage comprise the steps of S1 judging whether RAID array information of NETAPP WAFL file systems is damaged or not and reconstructing storage pool equipment according to the RAID array information, S2 analyzing file system metadata in the storage pool equipment and judging whether the file system metadata exists or not, S3 reading user node table data based on the file system metadata and judging whether the user node table data exists or not, S4 reading file system root node data and judging whether the root node data exists or not, S5 analyzing node data block mapping and judging node types, S6 analyzing node data corresponding to directory items, obtaining the file node types, traversing files in the directory items to complete file analysis, S7 repeatedly traversing all hard disks in the storage pool equipment from S2 to S6, and analyzing a complete file system. Therefore, the invention can quickly recover the data in the damaged NETAPP WAFL file system.
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
The NETAPP WAFL file system structure of the present invention mainly includes RAID array information, file system metadata (Meta Data), user node Table Data (User Inode Table), block Mapping Data (Block Mapping), directory entry Data (Dir Item), etc.
In the first embodiment, as shown in fig. 1, the method for recovering data based on NETAPP WAFL file system corruption provided in this embodiment is used for continuing to read normal data when the NETAPP WAFL file system part structure is damaged, wherein the specific process is as follows:
S1, judging NETAPP WAFL whether RAID array information of the file system is damaged or not, and reconstructing storage pool equipment according to the RAID array information.
In this embodiment, the above process specifically includes:
s101, reading RAID array information of NETAPP WAFL file systems, judging whether the RAID array information is damaged by searching whether a keyword of 44, 49, 41 or 52 exists in the head part of each block of magnetic disk (the head part refers to a part of byte data in front of a hard disk, and the part of byte data can store the RAID array information), wherein 44, 49, 41 or 52 is byte data, if one of the byte data exists, the existence of the RAID array information is indicated, and if one of the byte data does not exist, the damage of the RAID array information is indicated.
S102, if the RAID array information is damaged, analyzing the distribution rule of the data in each hard disk, and calculating the RAID array information.
In this embodiment, the distribution rule of the data in each hard disk is analyzed, and RAID array information is calculated, which specifically includes:
finding out a section of regular and continuous data in the hard disk, and judging the position, the size and other information of the data distributed in each hard disk;
The RAID array information is calculated by summarizing and integrating the analysis conditions to obtain the distribution condition of a section of continuous data in each hard disk, and then recording the information such as the position, the size and the like of the hard disk sequence forming the section of continuous data in each hard disk, wherein the combination is the RAID array information.
S103, because RAID array information records hard disk parameters, all hard disks in storage are combined into a large storage pool device through RAID array information, namely, all hard disks are virtualized into a large hard disk through RAID array information, and the structure of a subsequent NETAPP WAFL file system is based on the large storage pool device for data reading.
S2, analyzing file system metadata in storage pool equipment and judging whether the file system metadata exists, if so, entering S3, and if not, entering S8;
In this embodiment, the metadata information block is searched and parsed by searching the keywords "AB, FB, B8 or DA", and if the keywords are not searched, the metadata of the file system is considered to be incorrect or the metadata of the file system obtained is damaged.
S3, reading user node table data based on file system metadata, judging whether the user node table data exist or not, if so, entering S4, and if not, entering S9.
In this embodiment, the user node table data block is searched and parsed by searching the keyword "4D, 42, 46 or 49". Analyzing the user node table data, acquiring the file system root node data from the user node table data, and if any keyword is not searched, considering that the user node table data does not exist or the acquired user node table data is damaged.
S4, reading the root node data of the file system, judging whether the root node data exists, if so, entering S5, and if the root node data of the file system is not obtained or the obtained root node data of the file system is damaged, entering S10.
In this embodiment, the root node data of the file system is parsed, and information such as the size of the node, the node unique identifier, the creation time, the modification time, the data block mapping and the like is obtained from the node data, the user node table data is searched, and the node with the node unique number of 2 is found to be the root node data of the file system. Since the unique identification number of the root node is 2, it can be determined by this value, and if no root node is found, it is considered that the obtained file system root node data does not exist or the obtained file system root node data is damaged.
S5, analyzing the node data block mapping, judging whether the node type is a file or a directory, if the obtained node type is the file, completing file analysis, if the obtained node type is a directory entry, entering S6, and if the obtained directory entry data is damaged, entering S11.
In this embodiment, the data block pointed by the node is read according to the data block mapping in the node, then the node is judged to be a file or a directory entry according to the type of the node, the node type flag bit is judged to be 0 to represent the directory entry, 1 to represent the file, if the node type is the file, the data block is the content of the file, file analysis is completed, if the node type is the directory entry, the directory entry in the data block is analyzed, all directory entry data blocks are searched through searching keywords 43, 56, 58 or 00 to judge that the acquired directory entry data is damaged, if the directory entry is not damaged, step S6 is entered, and if the acquired directory entry data is damaged, step S11 is entered.
And S6, analyzing node data corresponding to the directory entry, obtaining the node type of the file, traversing the file in the directory entry, and completing file analysis.
In this embodiment, node data corresponding to a directory entry is obtained from a user node table according to a node number in the directory entry, and information such as a size of a node, a node unique identifier, creation time, modification time, and data block mapping is obtained from the node data.
And S7, repeating the steps S2-S6 to traverse all hard disks in the storage pool equipment, and analyzing the complete file system.
S8, if the file system metadata is not acquired or the acquired file system metadata is damaged in the step S2, searching all metafile information blocks from the storage pool device through the search keywords AB, FB, B8 or DA, and returning to the step S3.
S9, if the user node table data is not acquired or the acquired user node table data is damaged in the step S3, searching all user node table data blocks from the storage pool device through the search keywords 4D, 42, 46 or 49, and returning to the step S4.
And S10, if the file system root node data or the acquired file system root node data loss is not acquired in the step S4, searching all user node table data, and returning to the step S5 if the node with the unique node number of 2 is the file system root node.
S11, if the catalog item data acquired in the step S5 is damaged, searching all catalog data blocks from the storage pool device through the search key words 43, 56, 58 or 00, and returning to the step S6.
In contrast to the first embodiment, the present embodiment provides a data recovery method based on NETAPP WAFL file system corruption, and the second embodiment provides a data recovery device based on NETAPP WAFL file system corruption. The device provided in this embodiment may implement the data recovery method based on NETAPP WAFL file system corruption in the first embodiment, where the device may be implemented by software, hardware, or a combination of software and hardware. For convenience of description, the present embodiment is described while being functionally divided into various units. Of course, the functions of the units may be implemented in the same piece or pieces of software and/or hardware. For example, the apparatus may comprise integrated or separate functional modules or functional units to perform the corresponding steps in the methods of the first embodiment. Since the apparatus of this embodiment is substantially similar to the method embodiment, the description of this embodiment is relatively simple, and the relevant points may be referred to in the description of the first embodiment, where the embodiment of the data recovery apparatus based on NETAPP WAFL file system corruption provided in the present invention is merely illustrative.
Specifically, the data recovery device based on NETAPP WAFL file system corruption provided in this embodiment includes:
A first unit configured to determine NETAPP WAFL whether RAID array information of the file system is damaged, and reconstruct a storage pool device according to the RAID array information;
a second unit configured to parse the file system metadata in the storage pool device and determine whether the file system metadata exists;
A third unit configured to read user node table data based on the file system metadata and determine whether the user node table data exists;
A fourth unit configured to read root node data of the file system and determine whether the root node data exists;
a fifth unit configured to parse the node data block map, determine a node type, complete file parsing if the obtained node type is a file, and parse a directory entry if the obtained node type is a directory entry;
a sixth unit configured to parse node data corresponding to the directory entry, obtain a file node type, traverse the file in the directory entry, and complete file parsing;
And a seventh unit configured to traverse all hard disks in the storage pool device and parse the complete file system.
In a third embodiment, an electronic device corresponding to the data recovery method based on NETAPP WAFL file system corruption provided in the first embodiment is provided, where the electronic device may be an electronic device for a client, for example, a mobile phone, a notebook computer, a tablet computer, a desktop computer, etc., so as to execute the method of the first embodiment.
As shown in fig. 2, the electronic device includes a processor, a memory, a communication interface, and a bus, where the processor, the memory, and the communication interface are connected by the bus to complete communication with each other. The bus may be an industry standard architecture (ISA, industry Standard Architecture) bus, a peripheral component interconnect (PCI, PERIPHERAL COMPONENT) bus, or an extended industry standard architecture (EISA, extended Industry Standard Component) bus, among others. The memory stores a computer program that can be executed on the processor, and when the processor executes the computer program, the processor executes the method of the first embodiment, so that the principle and technical effects are similar to those of the first embodiment, and are not described herein again. It will be appreciated by those skilled in the art that the architecture shown in fig. 2 is merely a block diagram of some of the architecture relevant to the present inventive arrangements and is not limiting of the computing devices to which the present inventive arrangements may be applied, and that a particular computing device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.
In a preferred embodiment, the logic instructions in the memory described above may be implemented in the form of software functional units and stored in a computer readable storage medium when sold or used as a stand alone product. Based on this understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present application. The storage medium includes various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), and an optical disk.
In a preferred embodiment, the processor may be a Central Processing Unit (CPU), a Digital Signal Processor (DSP), or other general purpose processor, which is not limited herein.
In a fourth embodiment, the present embodiment provides a computer-readable storage medium storing one or more programs, the one or more programs comprising computer instructions, which when executed by a computer, cause the computer to perform the method provided by the first embodiment.
In a preferred embodiment, the computer-readable storage medium may be a tangible device that retains and stores instructions for use by an instruction execution device, such as, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination of the foregoing. The computer-readable storage medium stores computer program instructions that cause a computer to perform the method provided by the first embodiment described above.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In the description of the present specification, reference to the terms "one preferred embodiment," "further," "specifically," "in the present embodiment," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the embodiments of the present specification. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.
It should be noted that the above-mentioned embodiments are merely for illustrating the technical solution of the present invention, and not for limiting the same, and although the present invention has been described in detail with reference to the above-mentioned embodiments, it should be understood by those skilled in the art that the technical solution described in the above-mentioned embodiments may be modified or some technical features may be equivalently replaced, and these modifications or substitutions do not make the essence of the corresponding technical solution deviate from the spirit and scope of the technical solution of the embodiments of the present invention.

Claims (10)

1.一种基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,包括:1. A method for recovering data based on a damaged NetApp WAFL file system, comprising: S1、判断NetApp WAFL文件系统的RAID阵列信息是否损坏,并根据RAID阵列信息重建存储池设备;S1. Determine whether the RAID array information of the NetApp WAFL file system is damaged, and rebuild the storage pool device according to the RAID array information; S2、解析存储池设备中文件系统元数据并判断文件系统元数据是否存在,若存在,则进入S3,若没有获取到文件系统元数据或获取的文件系统元数据损坏,则进入S8;S2, parsing the file system metadata in the storage pool device and determining whether the file system metadata exists. If so, proceeding to S3; if the file system metadata is not obtained or the obtained file system metadata is damaged, proceeding to S8; S3、基于文件系统元数据读取用户节点表数据,并判断用户节点表数据是否存在,若存在则进入S4,若没有获取到用户节点表数据或获取的用户节点表数据损坏,则进入S9;S3, reading the user node table data based on the file system metadata, and determining whether the user node table data exists, if so, proceeding to S4, if not or damaged, proceeding to S9; S4、读取文件系统根节点数据,并判断根节点数据是否存在,若存在则进入S5,若没有获取到文件系统根节点数据或获取的文件系统根节点数据损坏,则进入S10;S4, read the file system root node data, and determine whether the root node data exists, if it exists, enter S5, if the file system root node data is not obtained or the obtained file system root node data is damaged, enter S10; S5、解析节点数据块映射,并判断节点类型,若获取的节点类型是文件则完成文件解析,若获取的节点类型是目录项则进入S6,当获取的目录项数据损坏,则进入S11;S5, parsing the node data block mapping and determining the node type. If the obtained node type is a file, the file parsing is completed. If the obtained node type is a directory entry, the process proceeds to S6. If the obtained directory entry data is damaged, the process proceeds to S11. S6、解析目录项对应的节点数据,获取文件节点类型,遍历目录项内的文件,完成文件解析;S6. Parse the node data corresponding to the directory entry, obtain the file node type, traverse the files in the directory entry, and complete the file parsing; S7、重复上述S2-S6遍历存储池设备中所有硬盘,解析完整文件系统;S7, repeating the above S2-S6 to traverse all hard disks in the storage pool device and parse the complete file system; S8、通过搜索关键字“AB、FB、B8或DA”从存储池设备中查找到所有文件系统元数据,返回S3;S8, searching for the keyword "AB, FB, B8 or DA" to find all file system metadata from the storage pool device, and returning to S3; S9、通过搜索关键字“4D、42、46或49”从存储池设备中查找到所有用户节点表数据块,返回S4;S9, searching for the keyword "4D, 42, 46 or 49" to find all the user node table data blocks from the storage pool device, and returning to S4; S10、通过从存储池设备中搜索全部用户节点表数据,找到节点唯一编号为2的节点为文件系统根节点,返回S5;S10, by searching all user node table data from the storage pool device, find that the node with the unique node number of 2 is the file system root node, and return to S5; S11、通过搜索关键字“43、56、58 或00”从存储池设备中查找所有目录数据块,返回S6。S11. Search for all directory data blocks from the storage pool device by searching for the keyword "43, 56, 58 or 00", and return to S6. 2.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,判断NetApp WAFL文件系统的RAID阵列信息是否损坏,并根据RAID阵列信息重建存储池设备,具体为:2. The data recovery method based on the damaged NetApp WAFL file system according to claim 1 is characterized in that it is judged whether the RAID array information of the NetApp WAFL file system is damaged, and the storage pool device is rebuilt according to the RAID array information, specifically: S101、读取NetApp WAFL文件系统的RAID阵列信息,通过查找存储每块磁盘的头部中是否有“44、49、41或52”关键字判断RAID阵列信息是否损坏,其中,44、49、41或52是字节数据,如果有其中一个则表明RAID阵列信息存在,一个都没有则表示的RAID阵列信息损坏;S101, reading the RAID array information of the NetApp WAFL file system, and determining whether the RAID array information is damaged by searching whether there is a keyword "44, 49, 41, or 52" in the header of each disk, where 44, 49, 41, or 52 is byte data. If any one of them exists, it indicates that the RAID array information exists, and if none of them exists, it indicates that the RAID array information is damaged; S102、若RAID阵列信息损坏,则分析每一块硬盘中数据的分布规律,计算出RAID阵列信息;S102, if the RAID array information is damaged, analyzing the distribution pattern of the data in each hard disk to calculate the RAID array information; S103、通过RAID阵列信息将存储中所有的硬盘组合成一个大的存储池设备即通过RAID阵列信息将所有硬盘虚拟成一个大的硬盘。S103, combining all the hard disks in the storage into a large storage pool device through the RAID array information, that is, virtualizing all the hard disks into a large hard disk through the RAID array information. 3.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,解析存储池设备中的文件系统元数据并判断文件系统元数据是否存在,具体为:通过搜索关键字“AB、FB、B8或DA”查找文件系统元数据并解析,若搜索不到上述任一关键字则认为没有获取到文件系统元数据或获取的文件系统元数据损坏。3. According to claim 1, the data recovery method based on the damage of NetApp WAFL file system is characterized in that the file system metadata in the storage pool device is parsed and it is determined whether the file system metadata exists, specifically: the file system metadata is searched and parsed by searching for keywords "AB, FB, B8 or DA". If any of the above keywords cannot be found, it is considered that the file system metadata is not obtained or the obtained file system metadata is damaged. 4.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,基于文件系统元数据读取用户节点表数据,并判断用户节点表数据是否存在,具体为:通过搜索关键字“4D、42、46或49”查找用户节点表数据块,若搜索不到上述任一关键字则没有获取到用户节点表数据或获取的用户节点表数据损坏。4. The data recovery method based on the damaged NetApp WAFL file system according to claim 1 is characterized in that the user node table data is read based on the file system metadata, and it is determined whether the user node table data exists, specifically: the user node table data block is searched by searching for keywords "4D, 42, 46 or 49". If any of the above keywords cannot be found, the user node table data is not obtained or the obtained user node table data is damaged. 5.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,读取文件系统根节点数据,并判断根节点数据是否存在,具体为:解析文件系统根节点数据,搜索用户节点表数据,找到节点唯一编号为2的节点为文件系统根节点数据,若没有找到根节点,则认为没有获取到文件系统根节点数据或获取的文件系统根节点数据损坏。5. According to claim 1, the data recovery method based on the damaged NetApp WAFL file system is characterized in that the file system root node data is read and whether the root node data exists is determined, specifically: the file system root node data is parsed, the user node table data is searched, and the node with the unique node number of 2 is found as the file system root node data. If the root node is not found, it is considered that the file system root node data is not obtained or the obtained file system root node data is damaged. 6.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,解析节点数据块映射,并判断节点类型,具体为:判断节点类型标志位是0表示目录项,1表示文件。6. The data recovery method based on the damaged NetApp WAFL file system according to claim 1 is characterized by parsing the node data block mapping and determining the node type, specifically: determining that the node type flag is 0 for a directory entry and 1 for a file. 7.根据权利要求1所述的基于NetApp WAFL文件系统损坏的数据恢复方法,其特征在于,判断获取的目录项数据是否损坏是通过搜索关键字“43、56、58 或00”查找目录数据块,若搜索不到上述任一关键字则认为获取的目录项数据损坏。7. The data recovery method based on the damaged NetApp WAFL file system according to claim 1 is characterized in that the determination of whether the acquired directory entry data is damaged is to search for the directory data block by searching for the keywords "43, 56, 58 or 00", and if any of the above keywords cannot be found, it is considered that the acquired directory entry data is damaged. 8.一种基于NetApp WAFL文件系统损坏的数据恢复装置,其特征在于,该装置包括:8. A data recovery device based on a damaged NetApp WAFL file system, characterized in that the device comprises: 第一单元,被配置为判断NetApp WAFL文件系统的RAID阵列信息是否损坏,并根据RAID阵列信息重建存储池设备;The first unit is configured to determine whether RAID array information of the NetApp WAFL file system is damaged, and rebuild the storage pool device according to the RAID array information; 第二单元,被配置为解析存储池设备中文件系统元数据并判断文件系统元数据是否存在;The second unit is configured to parse the file system metadata in the storage pool device and determine whether the file system metadata exists; 第三单元,被配置为基于文件系统元数据读取用户节点表数据,并判断用户节点表数据是否存在;A third unit is configured to read the user node table data based on the file system metadata and determine whether the user node table data exists; 第四单元,被配置为读取文件系统根节点数据,并判断根节点数据是否存在;The fourth unit is configured to read the root node data of the file system and determine whether the root node data exists; 第五单元,被配置为解析节点数据块映射,并判断节点类型,若是获取的节点类型是文件则完成文件解析,若获取的节点类型是目录项则进行目录项解析;The fifth unit is configured to parse the node data block mapping and determine the node type. If the obtained node type is a file, the file parsing is completed; if the obtained node type is a directory entry, the directory entry parsing is performed; 第六单元,被配置为解析目录项对应的节点数据,获取文件节点类型,遍历目录项内的文件,完成文件解析;The sixth unit is configured to parse the node data corresponding to the directory entry, obtain the file node type, traverse the files in the directory entry, and complete the file parsing; 第七单元,被配置为遍历存储池设备中所有硬盘,解析完整文件系统。The seventh unit is configured to traverse all hard disks in the storage pool device and parse the complete file system. 9.一种电子设备,其特征在于,包括:至少一个处理器以及所述处理器通信连接的存储器;其中,所述存储器存储有可被所述处理器执行的指令,所述指令被所述处理器执行,以使所述处理器能够执行根据权利要求1-7中任一项所述的方法。9. An electronic device, characterized in that it comprises: at least one processor and a memory communicatively connected to the processor; wherein the memory stores instructions executable by the processor, and the instructions are executed by the processor so that the processor can execute the method according to any one of claims 1-7. 10.一种存储一个或多个程序的计算机可读存储介质,其特征在于,所述一个或多个程序包括计算机指令,所述计算机指令用于使计算机执行根据权利要求1-7中任一项所述的方法。10. A computer-readable storage medium storing one or more programs, wherein the one or more programs include computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.
CN202411808463.0A 2024-12-10 2024-12-10 Data recovery method, device, equipment and medium based on NetApp WAFL file system damage Pending CN119739562A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202411808463.0A CN119739562A (en) 2024-12-10 2024-12-10 Data recovery method, device, equipment and medium based on NetApp WAFL file system damage

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202411808463.0A CN119739562A (en) 2024-12-10 2024-12-10 Data recovery method, device, equipment and medium based on NetApp WAFL file system damage

Publications (1)

Publication Number Publication Date
CN119739562A true CN119739562A (en) 2025-04-01

Family

ID=95127534

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202411808463.0A Pending CN119739562A (en) 2024-12-10 2024-12-10 Data recovery method, device, equipment and medium based on NetApp WAFL file system damage

Country Status (1)

Country Link
CN (1) CN119739562A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1103895A2 (en) * 1999-11-17 2001-05-30 Finaldata Inc. Disk data recovery method
CN1688981A (en) * 2002-08-09 2005-10-26 网络装置公司 Storage virtualization by layering virtual disk objects on a file system
CN102110156A (en) * 2011-02-22 2011-06-29 清华大学 Method and device for extracting metadata of file system based on selective scanning
CN102349053A (en) * 2009-01-09 2012-02-08 网络存储技术公司 System and method for redundancy-protected aggregates
CN104272263A (en) * 2012-02-29 2015-01-07 网络装置公司 Fragmentation control for deduplication

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1103895A2 (en) * 1999-11-17 2001-05-30 Finaldata Inc. Disk data recovery method
CN1688981A (en) * 2002-08-09 2005-10-26 网络装置公司 Storage virtualization by layering virtual disk objects on a file system
CN102349053A (en) * 2009-01-09 2012-02-08 网络存储技术公司 System and method for redundancy-protected aggregates
CN102110156A (en) * 2011-02-22 2011-06-29 清华大学 Method and device for extracting metadata of file system based on selective scanning
CN104272263A (en) * 2012-02-29 2015-01-07 网络装置公司 Fragmentation control for deduplication

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
钱镜洁;: "exFAT文件系统的解析和数据恢复", 电信科学, no. 2, 20 November 2010 (2010-11-20) *

Similar Documents

Publication Publication Date Title
US11734364B2 (en) Method and system for document similarity analysis
CN101694668B (en) Method and device for determining similarity of web page structure
EP2812815B1 (en) Web page retrieval method and device
CN111597297B (en) Item recall method, system, electronic device, and readable storage medium
JP5616444B2 (en) Method and system for document indexing and data querying
CN106909609B (en) Method for determining similar character strings, method and system for searching duplicate files
US8423885B1 (en) Updating search engine document index based on calculated age of changed portions in a document
CN111125298A (en) Method, equipment and storage medium for reconstructing NTFS file directory tree
US20090024616A1 (en) Content retrieving device and retrieving method
JP6726690B2 (en) Performing multidimensional search, content-associative retrieval, and keyword-based retrieval and retrieval on losslessly reduced data using basic data sieves
CN114625696B (en) File recovery method and device, electronic equipment and storage medium
CN107085615B (en) Text deduplication system, method, server and computer storage medium
US10198441B1 (en) Real-time duplicate detection of videos in a massive video sharing system
CN113420219B (en) Method, device, electronic device and readable storage medium for querying information error correction
CN113918807B (en) Data recommendation method, device, computing device and computer-readable storage medium
CN114816518A (en) Simhash-based open source component screening and identifying method and system in source code
CN114090673A (en) Data processing method, equipment and storage medium for multiple data sources
CN119739562A (en) Data recovery method, device, equipment and medium based on NetApp WAFL file system damage
JP6212639B2 (en) retrieval method
US10970285B2 (en) Grid topology change in a distributed data grid when iterating on the contents of the data grid
US11126592B2 (en) Rapid indexing of document tags
CN110543622A (en) Text similarity detection method and device, electronic equipment and readable storage medium
CN113836906B (en) Tender generation method, device and server
CN116842173A (en) Semantic understanding-based patent summary information generation method and system
JP3552318B2 (en) Document search method and system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination