How to recover a deleted file in aix / jfs?

June 9, 2016 admin Leave a comment

It is possible to recover the file using the fsdb command (filesystem debugger). whe
n,
No new files have been created on the filesystem.
No files have been extended.
The filesystem is able to be unmounted.
Warning: I have test this in my test server. This is undocumented one. You may f
acing the critical problem when you follow the below steps on your systems. So t
ry this at your own risk. Please avoid directly try this with your production se
rvers. Here is the output for your reference.
You can get deleted files inode if you dont have.
#fuser -dV
inode=68 size=34358697984 fd=6
inode=76 size=16106135552 fd=7
inode=65 size=34358697984 fd=16
inode=68 size=34358697984 fd=11
inode=68 size=34358697984 fd=7
inode=68 size=34358697984 fd=6
# lsvg -l testvg
testvg:
LV NAME TYPE LPs PPs PVs LV STATE MOUNT POINT
loglv00 jfs2log 1 1 1 closed/syncd N/A
#
# crfs -a size=256M -v jfs2 -g testvg -m /new create a /new FS
File system created successfully.
261932 kilobytes total disk space.
New File System size is 524288
#
# lsvg -l testvg
testvg:
LV NAME TYPE LPs PPs PVs LV STATE MOUNT POINT
loglv00 jfs2log 1 1 1 closed/syncd N/A
fslv00 jfs2 16 16 1 closed/syncd /new
#
# mount /new mount the /new FS
#
# lsvg -l testvg
testvg:
LV NAME TYPE LPs PPs PVs LV STATE MOUNT POINT
loglv00 jfs2log 1 1 1 open/syncd N/A
fslv00 jfs2 16 16 1 open/syncd /new
#
# cd /new
#
# ls -l
total 0
drwxr-xr-x 2 root system 256 Apr 03 16:47 lost+found
#
# cat >> film Create a file named film
Hi this is the test file. I want to use this file for recovery test
^C#
#
# cat film
Hi this is the test file. I want to use this file for recovery test
#
# ls Cil check the inode number of the file film. That is 4
total 8
4 -rw-rCrC 1 root system 68 Apr 03 16:49 film
3 drwxr-xr-x 2 root system 256 Apr 03 16:47 lost+found
#
#
# rm film remove the file film
#
# ls -l
total 0
drwxr-xr-x 2 root system 256 Apr 03 16:47 lost+found
#
# cd ~
#
# umount /new unmount the /new FS
#
# lsvg -l testvg
testvg:
LV NAME TYPE LPs PPs PVs LV STATE MOUNT POINT
loglv00 jfs2log 1 1 1 closed/syncd N/A
fslv00 jfs2 16 16 1 closed/syncd /new
#
# fsdb /dev/fslv00 use the fsdb <lv_name> to recover the deleted file.
File System: /dev/fslv00
File System Size: 523864 (512 byte blocks)
Aggregate Block Size: 4096
Allocation Group Size: 8192 (aggregate blocks)
> dir 2
idotdot = 2
3 lost+found
>
> i 4 provide the inode number of our deleted file. That is 4
Inode 4 at block 33, offset 0x800:
[1] di_fileset: 16 [18] di_inostamp: 0x4d98ead4
[2] di_number: 4 [19] di_gen: 3940655789
[3] di_size: 0x0000000000000044 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [22] di_ixpxd.addr2: 0x00000021
[6] di_mode: 0x000081a4 di_ixpxd.address: 33
0100644 -rw-rCrC [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x1e8a1025 [26] di_atime.tj_sec:0x000000004d98eb7d
[10] di_ctime.tj_nsec: 0x0ca85614 [27] di_ctime.tj_sec:0x000000004d98ebac
[11] di_mtime.tj_nsec: 0x1af63892 [28] di_mtime.tj_sec:0x000000004d98eb77
[12] di_otime.tj_nsec: 0x03b74a9a [29] di_otime.tj_sec:0x000000004d98eb24
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > m choose m to modify
Please enter: field-number value > 5 1 put the field number is 5, change the
di_nlink value to 1
Inode 4 at block 33, offset 0x800:
[1] di_fileset: 16 [18] di_inostamp: 0x4d98ead4
[2] di_number: 4 [19] di_gen: 3940655789
[3] di_size: 0x0000000000000044 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 1 [22] di_ixpxd.addr2: 0x00000021
[6] di_mode: 0x000081a4 di_ixpxd.address: 33
0100644 -rw-rCrC [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x1e8a1025 [26] di_atime.tj_sec:0x000000004d98eb7d
[10] di_ctime.tj_nsec: 0x0ca85614 [27] di_ctime.tj_sec:0x000000004d98ebac
[11] di_mtime.tj_nsec: 0x1af63892 [28] di_mtime.tj_sec:0x000000004d98eb77
[12] di_otime.tj_nsec: 0x03b74a9a [29] di_otime.tj_sec:0x000000004d98eb24
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > x exit
> quit
#
# fsck -yp /dev/fslv00 run fsck to repaired the inconsistencies.
The current volume is: /dev/fslv00
Primary superblock is valid.
J2_LOGREDO:log redo processing for /dev/fslv00
logredo start at: 1301867616 sec and end at 1301867616 sec
Primary superblock is valid.
*** Phase 1 C Initial inode scan
*** Phase 2 C Process remaining directories
*** Phase 3 C Process remaining files
*** Phase 4 C Check and repair inode allocation map
File system inode map is corrupt (FIXED)
Superblock marked dirty because repairs are about to be written.
*** Phase 5 C Check and repair block allocation map
Block allocation map is corrupt (FIXED)
Inodes not connected to the root directory
tree have been detected. Will reconnect.
File system is clean.
Superblock is marked dirty (FIXED)
All observed inconsistencies have been repaired.
#
# mount /new mount the /new FS
# lsvg -l testvg
testvg:
LV NAME TYPE LPs PPs PVs LV STATE MOUNT POINT
loglv00 jfs2log 1 1 1 open/syncd N/A
fslv00 jfs2 16 16 1 open/syncd /new
#
# cd /new goto the /new FS
#
# ls -l
total 0
drwxr-xr-x 2 root system 256 Apr 03 16:47 lost+found
#
# cd lost+found go to lost+found dir
#
# pwd
/new/lost+found
#
# ls -l
total 8
-rw-rCrC 1 root system 68 Apr 03 16:49 4 you can see the delete
d file in the name of your inode number
#
# cat 4 confirm the file content
Hi this is the test file. I want to use this file for recovery test
#
# mv 4 /new/. move the file to the exact place where it was before
#
# pwd
/new/lost+found
# cd ..
#
# pwd
/new
# ls -l
total 8
-rw-rCrC 1 root system 68 Apr 03 16:49 4
drwxr-xr-x 2 root system 256 Apr 03 16:55 lost+found
#
# cat 4
Hi this is the test file. I want to use this file for recovery test
#
# mv 4 film change the name of the recovered file to the old one.
#
# ls -l
total 8
-rw-rCrC 1 root system 68 Apr 03 16:49 film the deleted file has
been recovered.
drwxr-xr-x 2 root system 256 Apr 03 16:55 lost+found
#
#

Related Posts:
Howto: Recover a file when you dont know inode number in
How to recover a deleted file in Linux ?
AIX: rootvg/disk mirroring
Aix using mkcd and creating a bootable ISO image from mksysb
Logical volumes not being recognized and mounted even
Aixdeletedfilejfsrecover
Post navigation
Previous PostAWS RDS IAM Policy for Read Only Access and DB Logs DownloadNext Po
stHow to recover a deleted file in Linux ?
Leave a Reply