一、背景
在案件侦查工作中，技术取证是还原案件事实的关键环节。某涉案单位使用的数据库集群，因案发后运维环境被破坏、人为清除管理信息等原因，导致整个集群的管理体系和元数据全部丢失无法获取任何有效的集群配置信息。因为仅从涉案服务器中提取到TiKV数据节点上残存的数据存储文件进行还原集群数据，本案例用测试环境进行还原模拟。
二、原集群信息
三、sysbench造数
造数停止最终表数据行数
四、三台kv机器数据物理拷贝到/data1路径
sudo mkdir -p /data1/tidb-data/tikv-20160
sudo mkdir -p /data1/tidb-deploy/tikv-20160
sudo chown -R tidb:tidb /data1
cp -rp /data/tidb-data/tikv-20160/* /data1/tidb-data/tikv-20160
cp -rp /data/tidb-deploy/tikv-20160/* /data1/tidb-deploy/tikv-20160
五、从 TiKV 日志获取 Cluster ID
[2025/12/17 09:38:33.738 +08:00] [INFO] [server.rs:369] ["connect to PD cluster"] [cluster_id=7178791184496835276]
六、销毁原有集群和tiup数据
七、重新部署集群，kv指定拷贝的/data1路径
[tidb@tidb80 tidb]$ tiup cluster deploy tidb-test v6.1.0 config.yaml
tiup is checking updates for component cluster ...
Starting component `cluster`: /home/tidb/.tiup/components/cluster/v1.10.2/tiup-cluster deploy tidb-test v6.1.0 config.yaml
+ Detect CPU Arch Name
- Detecting node 192.168.2.81 Arch info ... Done
- Detecting node 192.168.2.82 Arch info ... Done
- Detecting node 192.168.2.83 Arch info ... Done
- Detecting node 192.168.2.80 Arch info ... Done
+ Detect CPU OS Name
- Detecting node 192.168.2.81 OS info ... Done
- Detecting node 192.168.2.82 OS info ... Done
- Detecting node 192.168.2.83 OS info ... Done
- Detecting node 192.168.2.80 OS info ... Done
Please confirm your topology:
Cluster type: tidb
Cluster name: tidb-test
Cluster version: v6.1.0
Role Host Ports OS/Arch Directories
---- ---- ----- ------- -----------
pd 192.168.2.81 2379/2380 linux/x86_64 /data/tidb-deploy/pd-2379,/data/tidb-data/pd-2379
pd 192.168.2.82 2379/2380 linux/x86_64 /data/tidb-deploy/pd-2379,/data/tidb-data/pd-2379
pd 192.168.2.83 2379/2380 linux/x86_64 /data/tidb-deploy/pd-2379,/data/tidb-data/pd-2379
tikv 192.168.2.81 20160/20180 linux/x86_64 /data1/tidb-deploy/tikv-20160,/data1/tidb-data/tikv-20160
tikv 192.168.2.82 20160/20180 linux/x86_64 /data1/tidb-deploy/tikv-20160,/data1/tidb-data/tikv-20160
tikv 192.168.2.83 20160/20180 linux/x86_64 /data1/tidb-deploy/tikv-20160,/data1/tidb-data/tikv-20160
tidb 192.168.2.80 4000/10080 linux/x86_64 /data/tidb-deploy/tidb-4000
prometheus 192.168.2.80 9090/12020 linux/x86_64 /data/tidb-deploy/prometheus-9090,/data/tidb-data/prometheus-9090
grafana 192.168.2.80 3000 linux/x86_64 /data/tidb-deploy/grafana-3000
alertmanager 192.168.2.80 9093/9094 linux/x86_64 /data/tidb-deploy/alertmanager-9093,/data/tidb-data/alertmanager-9093
Attention:
1. If the topology is not what you expected, check your yaml file.
2. Please confirm there is no port/directory conflicts in same host.
Do you want to continue? [y/N]: (default=N)
提示数据文件报错
八、三台kv/data1路径修改last_tikv.toml配置文件
vi /data1/tidb-data/tikv-20160/last_tikv.toml
主要修改项:
[log.file]
filename = "/data1/tidb-deploy/tikv-20160/log/tikv.log"
[storage]
data-dir = "/data1/tidb-data/tikv-20160"
[raftstore]
raftdb-path = "/data1/tidb-data/tikv-20160/raft"
[raft-engine]
dir = "/data1/tidb-data/tikv-20160/raft-engine"
[log-backup]
temp-path = "/data1/tidb-data/tikv-20160/log-backup-tmp"
九、使用 pd-recover修改重置当前cluster ID
重启pd
tiup cluster restart tidb-test -R pd
十、启动集群，验证数据
[tidb@tidb80 tidb]$ tiup cluster start tidb-test
[tidb@tidb80 tidb]$ tiup cluster display tidb-test
tiup is checking updates for component cluster ...
Starting component `cluster`: /home/tidb/.tiup/components/cluster/v1.10.2/tiup-cluster display tidb-test
Cluster type: tidb
Cluster name: tidb-test
Cluster version: v6.1.0
Deploy user: tidb
SSH type: builtin
Dashboard URL: http://192.168.2.81:2379/dashboard
Grafana URL: http://192.168.2.80:3000
ID Role Host Ports OS/Arch Status Data Dir Deploy Dir
-- ---- ---- ----- ------- ------ -------- ----------
192.168.2.80:9093 alertmanager 192.168.2.80 9093/9094 linux/x86_64 Up /data/tidb-data/alertmanager-9093 /data/tidb-deploy/alertmanager-9093
192.168.2.80:3000 grafana 192.168.2.80 3000 linux/x86_64 Up - /data/tidb-deploy/grafana-3000
192.168.2.81:2379 pd 192.168.2.81 2379/2380 linux/x86_64 Up|UI /data/tidb-data/pd-2379 /data/tidb-deploy/pd-2379
192.168.2.82:2379 pd 192.168.2.82 2379/2380 linux/x86_64 Up /data/tidb-data/pd-2379 /data/tidb-deploy/pd-2379
192.168.2.83:2379 pd 192.168.2.83 2379/2380 linux/x86_64 Up|L /data/tidb-data/pd-2379 /data/tidb-deploy/pd-2379
192.168.2.80:9090 prometheus 192.168.2.80 9090/12020 linux/x86_64 Up /data/tidb-data/prometheus-9090 /data/tidb-deploy/prometheus-9090
192.168.2.80:4000 tidb 192.168.2.80 4000/10080 linux/x86_64 Up - /data/tidb-deploy/tidb-4000
192.168.2.81:20160 tikv 192.168.2.81 20160/20180 linux/x86_64 Up /data1/tidb-data/tikv-20160 /data1/tidb-deploy/tikv-20160
192.168.2.82:20160 tikv 192.168.2.82 20160/20180 linux/x86_64 Up /data1/tidb-data/tikv-20160 /data1/tidb-deploy/tikv-20160
192.168.2.83:20160 tikv 192.168.2.83 20160/20180 linux/x86_64 Up /data1/tidb-data/tikv-20160 /data1/tidb-deploy/tikv-20160
Total nodes: 10
