Linux 灾难恢复Linux 发行版本众多，现如今也得到了越来越广泛的应用，同时也面临着系统出现故障的潜在风险，本文将以发行版本 RHEL6 为例详细介绍几种 Linux 灾难恢复技术和方法，以确保 Linux 系统的安全恢复。
在介绍 Linux 灾难恢复方法之前，我们先来了解下 MBR，其全称为 Master Boot Record，即硬盘的主引导记录。它由三个部分组成，主引导程序、硬盘分区表和硬盘有效标志。在总共 512 字节的主引导扇区里主引导程序（Bootloader）占 446 个字节，第二部分是硬盘分区表，占 64 个字节，硬盘有多少分区以及每一分区的大小都记录在其中。第三部分是硬盘有效标志，占 2 个字节。具体如图示：
图 1. MBR 系统硬盘分区表破坏生产环境中的 Linux 服务器可能会因为病毒或者意外断电而引起硬盘分区表被破坏，通常恢复硬盘分区表需要之前我们先备份其分区表的信息，一般我们使用 USB 外接设备来备份主机硬盘的分区表。
在主机上挂载 USB 设备后我们查看系统当前磁盘设备 :
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
| [root@FCoE ~]# fdisk -l
Disk /dev/sda: 43.0 GB, 42991616000 bytes
255 heads, 63 sectors/track, 5226 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00032735
Device Boot Start End Blocks Id System
/dev/sda1 * 1 17 131072 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 17 147 1048576 82 Linux swap / Solaris
Partition 2 does not end on cylinder boundary.
/dev/sda3 147 5227 40803328 83 Linux
Disk /dev/sdb: 2147 MB, 2147483648 bytes
255 heads, 63 sectors/track, 261 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Disk /dev/sdb doesn't contain a valid partition table
|
现在我们在 sdb 这个设备上创建一个新的分区 :
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| [root@FCoE ~]# fdisk /dev/sdb
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel with disk identifier 0xcdd48395.
Changes will remain in memory only, until you decide to write them.
After that, of course, the previous content won't be recoverable.
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
switch off the mode (command 'c') and change display units to
sectors (command 'u').
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-261, default 1):
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-261, default 261):
Using default value 261
Command (m for help): p
Disk /dev/sdb: 2147 MB, 2147483648 bytes
255 heads, 63 sectors/track, 261 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xcdd48395
Device Boot Start End Blocks Id System
/dev/sdb1 1 261 2096451 83 Linux
Command (m for help): w
The partition table has been altered!
Calling ioctl() to re-read partition table.
Syncing disks.
|
在新分区 sdb1 上创建文件系统：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| [root@FCoE ~]# mkfs.ext3 /dev/sdb1
mke2fs 1.41.12 (17-May-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
131072 inodes, 524112 blocks
26205 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=536870912
16 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 24 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
|
挂载新的文件系统：
1
| [root@FCoE ~]# mount /dev/sdb1 /mnt/
|
通常我们通过备份硬盘的 MBR 来备份硬盘分区表：
1
2
3
4
| [root@FCoE ~]# dd if=/dev/sda of=/mnt/sda.mbr bs=512 count=1
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.000777948 s, 658 kB/s
|
现在我们来写零硬盘分区表来实现类似分区表被破坏的结果：
1
2
3
4
| [root@FCoE ~]# dd if=/dev/zero of=/dev/sda bs=1 count=64 skip=446 seek=446
64+0 records in
64+0 records out
64 bytes (64 B) copied, 0.00160668 s, 39.8 kB/s
|
查询硬盘 sda 上的分区信息，发现其已不包含任何分区：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| [root@FCoE ~]# fdisk -l
Disk /dev/sda: 43.0 GB, 42991616000 bytes
255 heads, 63 sectors/track, 5226 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00032735
Device Boot Start End Blocks Id System
Disk /dev/sdb: 2147 MB, 2147483648 bytes
255 heads, 63 sectors/track, 261 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xcdd48395
Device Boot Start End Blocks Id System
/dev/sdb1 1 261 2096451 83 Linux
|
当主机硬盘分区表丢失了之后，再次启动后 GRUB 会因找不到配置文件而进入命令行模式 :
图 2. 分区表丢失 接下来我们挂载 RHEL6 的安装盘，同时也接入我们之前备份的 USB 设备，然后重启主机，选择 CD-ROM 为第一引导设备，启动后选择“Rescue installed system”。
图 3. 选择援救 按照提示，最终我们选择一个 shell。
图 4. 选择 shell 我们查询系统磁盘信息，发现硬盘设备 sda 没有包含任何分区。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| bash-4.1# fdik – l
Disk /dev/sda: 43.0 GB, 42991616000 bytes
255 heads, 63 sectors/track, 5226 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00032735
Device Boot Start End Blocks Id System
Disk /dev/sdb: 2147 MB, 2147483648 bytes
255 heads, 63 sectors/track, 261 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xcdd48395
Device Boot Start End Blocks Id System
/dev/sdb1 1 261 2096451 83 Linux
|
我们来恢复它的硬盘分区表，创建一个目录并且挂载之前备份的 USB 设备，我们看到它的设备名是 /dev/sdb。
1
2
3
| bash-4.1# mount /dev/sdb1 /usb
bash-4.1# ls /usb
lost+found sda.mbr
|
通过原来备份的 sda.mbr 文件来恢复硬盘设备 sda 的硬盘分区表 :
1
2
3
4
| bash-4.1# dd if=/usb/sda.mbr of=/dev/sda bs=1 count=64 skip=446 seek=446
64+0 records in
64+0 records out
64 bytes (64 B) copied, 0.038358 s, 4.6 kB/s
|
再次查询系统磁盘信息：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
| bash-4.1# fdisk -l
Disk /dev/sda: 43.0 GB, 42991616000 bytes
255 heads, 63 sectors/track, 5226 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00032735
Device Boot Start End Blocks Id System
/dev/sda1 * 1 17 131072 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 17 147 1048576 82 Linux swap / Solaris
Partition 2 does not end on cylinder boundary.
/dev/sda3 147 5227 40803328 83 Linux
Disk /dev/sdb: 2147 MB, 2147483648 bytes
255 heads, 63 sectors/track, 261 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xcdd48395
Device Boot Start End Blocks Id System
/dev/sdb1 1 261 2096451 83 Linux
|
硬盘设备 sda 的分区表已经恢复，重启后系统便可正常引导。 |
