Manual data recovery

Goal

  • Downloading a snapshot of an instance
  • Repairing the filesystem and mount it to extract data

Prerequisites

Optional: temporary work environment

Click here to show details

Temporary work environment

For this tutorial, we need a Linux environment and the OpenStack client in the SysEleven cloud. If you do not have that yet, you can create it with the following commands:

wget https://raw.githubusercontent.com/syseleven/heat-examples/master/kickstart/kickstart.yaml
...
openstack stack create -t kickstart.yaml --parameter key_name=<ssh key name> <stack name> --wait
...

Now we need to connect to the created instance.

ssh syseleven@<server-ip>

The following commands need to be executed in the ssh session.

We also need the OpenStack credentials (openrc-file).
You can download the file here.

source openrc

Create and download a snapshot

To recover data from an existing instance, we have to create a snapshot first.

WARNING: Creating instance snapshots of your server will make it unresponsive for a period of time (depending on the disk size).

openstack server image create <server uuid> --name <snapshot name> --wait

We can download the snapshot now. This can take a while.

openstack image save --file snapshot.qcow2 <snapshot name>

We can access the snapshot's contents via nbd.

sudo apt-get install -y qemu-utils
sudo modprobe nbd
sudo qemu-nbd --connect /dev/nbd0 snapshot.qcow2

Let's list the partitions.

$ sudo fdisk -l /dev/nbd0
Disk /dev/nbd0: 50 GiB, 53687091200 bytes, 104857600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x974bb19a

Device      Boot Start       End   Sectors Size Id Type
/dev/nbd0p1 *     2048 104857566 104855519  50G 83 Linux

To repair the filesystem, use fsck.

# Using the option -y, fsck will repair without asking.
sudo fsck -f /dev/nbd0p1
[...]

Now we can mount the filesystem.

sudo mount /dev/nbd0p1 /mnt/

Conclusion

Now the data is accessible on /mnt/.
If it's an ext filesystem you should have a look in /mnt/lost+found.