Method, device, and computer program product for recovering data

1 . A method for recovering data, comprising:

generating, by a processor, raw snapshots of a storage system, wherein each of the snapshots of the storage system has a snapshot ID;

determining, based on the raw snapshots and by the processor, at least one of attacked data blocks in the storage system, wherein the data block of the storage system has a data block ID;

determining, based on the data block ID of each data block of the at least one of the attacked data blocks and by the processor, a first target snapshot having a corresponding snapshot ID, wherein the first target snapshot has a latest unattacked replica corresponding to the data block;

recovering, by the processor, the data block corresponding to the first target snapshot by loading the first target snapshot separately for each data block;

in response to creating a new snapshot in the storage system and by the processor, obtaining a current snapshot ID and a next snapshot ID in the storage system;

allocating, by the processor, the current snapshot ID to the new snapshot;

using, by the processor, the next snapshot ID as the current snapshot ID; and

increasing, by the processor, the next snapshot progressively as a new next snapshot ID.

2 . The method according to claim 1 , further comprising:

in response to a data block in the storage system being changed, obtaining a current snapshot ID of the storage system to serve as a data block ID for the changed data block; and

in response to allocating a new data block in the storage system, obtaining a current snapshot ID of the storage system to serve as a data block ID for the new data block.

3 . The method according to claim 2 , wherein determining a first target snapshot having a corresponding snapshot ID comprises:

determining a second target snapshot having a snapshot ID that is the same as the data block ID of the at least one of the attacked data blocks; and

using the previous snapshot of the second target snapshot as the first target snapshot.

4 . The method according to claim 3 , wherein determining a first target snapshot having a corresponding snapshot ID further comprises:

in response to the storage system not having the first target snapshot or the second target snapshot, determining that the at least one of the attacked data blocks cannot be recovered.

5 . The method according to claim 2 , further comprising:

determining, based on an association between the data blocks of the storage system, a data block group containing the at least one of the attacked data blocks;

determining a third target snapshot having a latest unattacked replica of the data block group; and

recovering a data block group corresponding to the third target snapshot by loading the third target snapshot separately for each data block group.

6 . The method according to claim 5 , wherein the association between the data blocks of the storage system comprises:

files corresponding to the data blocks of the storage system being consistent; and

the files corresponding to the data blocks of the storage system being associated.

7 . The method according to claim 5 , wherein determining a third target snapshot having a latest unattacked replica of the data block group comprises:

determining in the data block group an attacked data block having a minimum data block ID;

determining a fourth target snapshot having a snapshot ID that is the same as the minimum data block ID of the data block group; and

using the previous snapshot of the fourth target snapshot as the third target snapshot.

8 . The method according to claim 7 , wherein determining a third target snapshot having a latest unattacked replica of the data block group further comprises:

in response to the storage system not having the third target snapshot or the fourth target snapshot, determining that the data block group containing the at least one of the attacked data blocks cannot be recovered.

9 . The method according to claim 1 , wherein determining at least one of attacked data blocks in the storage system comprises:

in response to detecting that at least one file in the storage system is attacked, determining an inode of at least one of the attacked files;

determining, based on the inode of the at least one of the attacked files, a file number of the at least one of the attacked files and a block number of the at least one of the attacked data blocks; and

determining, based on the file number and the block number, the at least one of the attacked data blocks.

10 . An electronic device, comprising:

at least one processor; and

memory coupled to the at least one processor and having instructions stored thereon, wherein the instructions, when executed by the at least one processor, cause the electronic device to perform actions comprising:

generating raw snapshots of a storage system, wherein each of the snapshots of the storage system has a snapshot ID;

determining, based on the raw snapshots, at least one of attacked data blocks in the storage system, wherein the data block of the storage system has a data block ID;

determining, based on the data block ID of each data block of the at least one of the attacked data blocks, a first target snapshot having a corresponding snapshot ID, wherein the first target snapshot has a latest unattacked replica corresponding to the data block; and

recovering the data block corresponding to the first target snapshot by loading the first target snapshot separately for each data block;

wherein the actions further comprise:

in response to creating a new snapshot in the storage system, obtaining a current snapshot ID and a next snapshot ID in the storage system;

allocating the current snapshot ID to the new snapshot;

using the next snapshot ID as the current snapshot ID; and

increasing the next snapshot progressively as a new next snapshot ID.

11 . The device according to claim 10 , wherein the actions further comprise:

in response to a data block in the storage system being changed, obtaining a current snapshot ID of the storage system to serve as a data block ID for the changed data block; and

in response to allocating a new data block in the storage system, obtaining a current snapshot ID of the storage system to serve as a data block ID for the new data block.

12 . The device according to claim 11 , wherein determining a first target snapshot having a corresponding snapshot ID comprises:

determining a second target snapshot having a snapshot ID that is the same as the data block ID of the at least one of the attacked data blocks; and

using the previous snapshot of the second target snapshot as the first target snapshot.

13 . The device according to claim 12 , wherein determining a first target snapshot having a corresponding snapshot ID further comprises:

in response to the storage system not having the first target snapshot or the second target snapshot, determining that the at least one of the attacked data blocks cannot be recovered.

14 . The device according to claim 11 , wherein the actions further comprise:

determining, based on an association between the data blocks of the storage system, a data block group containing the at least one of the attacked data blocks;

determining a third target snapshot having a latest unattacked replica of the data block group; and

recovering a data block group corresponding to the third target snapshot by loading the third target snapshot separately for each data block group.

15 . The device according to claim 14 , wherein the association between the data blocks of the storage system comprises:

files corresponding to the data blocks of the storage system being consistent; and

the files corresponding to the data blocks of the storage system being associated.

16 . The device according to claim 14 , wherein determining a third target snapshot having a latest unattacked replica of the data block group comprises:

determining in the data block group an attacked data block having a minimum data block ID;

determining a fourth target snapshot having a snapshot ID that is the same as the minimum data block ID of the data block group; and

using the previous snapshot of the fourth target snapshot as the third target snapshot.

17 . The device according to claim 16 , wherein determining a third target snapshot having a latest unattacked replica of the data block group further comprises:

in response to the storage system not having the third target snapshot or the fourth target snapshot, determining that the data block group containing the at least one of the attacked data blocks cannot be recovered.

18 . The device according to claim 10 , wherein determining at least one of attacked data blocks in the storage system comprises:

in response to detecting that at least one file in the storage system is attacked, determining an inode of at least one of the attacked files;

determining, based on the inode of the at least one of the attacked files, a file number of the at least one of the attacked files and a block number of the at least one of the attacked data blocks; and

determining, based on the file number and the block number, the at least one of the attacked data blocks.

19 . A computer program product having a non-transitory computer readable medium which stores a set of instructions to recover data; the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:

generating raw snapshots of a storage system, wherein each of the snapshots of the storage system has a snapshot ID;

determining, based on the raw snapshots, at least one of attacked data blocks in the storage system, wherein the data block of the storage system has a data block ID;

determining, based on the data block ID of each data block of the at least one of the attacked data blocks, a first target snapshot having a corresponding snapshot ID, wherein the first target snapshot has a latest unattacked replica corresponding to the data block; and

recovering the data block corresponding to the first target snapshot by loading the first target snapshot separately for each data block; and

in response to creating a new snapshot in the storage system, obtaining a current snapshot ID and a next snapshot ID in the storage system;

allocating the current snapshot ID to the new snapshot;

using the next snapshot ID as the current snapshot ID; and

increasing the next snapshot progressively as a new next snapshot ID.

20 . The computer program product according to claim 19 , wherein determining at least one of attacked data blocks in the storage system comprises:

in response to detecting that at least one file in the storage system is attacked, determining an inode of at least one of the attacked files;

determining, based on the inode of the at least one of the attacked files, a file number of the at least one of the attacked files and a block number of the at least one of the attacked data blocks; and

determining, based on the file number and the block number, the at least one of the attacked data blocks.