[server data recovery] case of file loss caused by misoperation of Apple Xsan file system files
海境超备  2024-08-21 14:36   published in China

macOS服务器上使用的都是苹果Xsan文件系统,一般也可以说成Xsan宗卷,是目前Apple为最高需求的大小型计算环境设计的 64 位簇文件系统。该文件系统属于日志型文件系统,大的结构方式类似于常见的EXT4,但是又是独立区分的,可以参照下图:

苹果1.png

2)Xsan阵列崩溃与误操作导致文件丢失的恢复方案区别
The most common faults of Xsan file system are array crash, which is the best way to deal with. It only needs to be easily recovered according to the normal RAID mode, which is very simple for professional data recovery companies, however, for the Xsan file system to run normally, only a variety of misoperations delete or lost files, in this case, a deeper solution is needed to solve, because currently, there is no software tool on the market that can support Xsan file system scanning and recovery. Currently, the Xsan file systems that have been recovered from overstandby in the sea are all found by peers or data recovery is not satisfactory for many times. Finally, they are "introduced" by merchants or peers. The specific reason is also very simple, data recovery companies that cannot parse the file system directly use RAW recovery to extract files, so that some of the continuously stored small files can be recovered, but only the content, no directory and name. And for Xsan, this recovery method can only extract a small portion of continuously stored small files.
2.恢复方案
1) normal RAW recovery
新建2个测试文件,CS0011大小为100M,CS0022大小为1M
the file header of CS0011 is...
CS0022的文件头为E6B58BE8AF95E69687E4BBB630303232
You can restore the CS0022 file through RAW recovery, but you cannot restore the CS0011 file stored in segments, as shown in the following figure:

文件CS0011如下图所示:

if you restore a file through RAW, you cannot obtain the file storage list. You can only restore the file based on the assumption that the file is stored continuously. If you restore a file through RAW, you can only restore one of the nine files. Therefore: the restored File is invalid and cannot be opened. The file is damaged.
2)Xsan文件系统目录恢复
To prevent misoperation of lost files from being overwritten by newly written files, stop any write operations to the Xsan file system, mount the member space of Xsan into a secure recovery environment through optical fiber ports;
重组Xsan的阵列,将各个成员使用软件工具重新组合,模拟出正常的Xsan文件系统的环境。上面两个步骤属于恢复Xsan文件系统的正常操作,重点在于下面的解析;
use the data recovery tool to parse the file system area, find the missing file directory structure, and manually extract data based on the list data.
三:案例总结
Xsan is a 64-bit Cluster File system designed by Apple for large and small computing environments that meet the highest demand for data availability. This professional technology enables multiple Mac desktops and Xserve systems to share RAID storage volumes through high-speed fiber channel networks. Each client can directly read and write data on the central file system, thus enhancing team collaboration and improving user efficiency. Xsan allows multiple computers to simultaneously access TB or PB data stored in XserveRAID through high-speed fiber optic channels. The high-performance storage network Xsan makes full use of the powerful 64-bit file system in Mac OS X system, enabling dozens of systems on the SAN to read and write shared storage content simultaneously.

Replies(
Sort By   
Reply
Reply