Data Recovery soft Extundelete and extundelete

Data Recovery soft Extundelete and extundelete

1 Overview

As an O & M personnel, it is the fundamental responsibility to ensure data security. Therefore, when maintaining the system, you must be careful and careful, but sometimes data may be deleted by mistake, how can we recover data quickly and effectively?

1> How to Use the rm-rf command

In Linux, you can use rm-rf to delete any data directly from the hard disk without any prompts. in Linux, there is no function similar to the recycle bin in Windows, this means that data cannot be recovered after being deleted. Therefore, you must be cautious when using this command. When using the rm command, the safe way is to put the command parameters behind it, in this way, the most secure way to ensure data security in enterprises is to back up data. Although backup is not omnipotent, it is absolutely impossible without backup, all data tools have certain limitations and cannot completely restore all data. Therefore, backup is the core, auxiliary Functions of data recovery tools are a required principle for O & M;

2> similarities and differences between extundelete and ext3grep

In Linux, there are many open-source data recovery tools, including debugfs, R-Linux, ext3grep, and extundelete. ext3grep and extundelete are commonly used, the restoration of these two tools is basically the same, but exturndelete is more powerful;

Exturndelete is a data recovery tool based on Linux. It parses inode information of all files by analyzing the logs of the file system, in this way, the mainstream ext3 ext4 file systems in Linux can be recovered by mistake, while ext3grep can only restore the ext3 file system. In terms of recovery speed, extundelete is much faster, because the extundelete recovery mechanism scans inode and recovers data at the same time, and supports delayed file recovery, but directory recovery, inode recovery, block recovery, complete Disk Recovery, etc, the ext3grep is slightly insufficient. It needs to first scan all inode information of the data to be restored before restoring the data. Therefore, the recovery speed is relatively slow, directory recovery and time recovery are not supported;

3> principle of extundelete Restoration

Before using extundelete to restore data, you can use the "ls-id" command in Linux to query the inode value of a file or directory, for example, to view the inode value of the Directory, you can enter ls-id/to view the inode value of the root directory. The inode value of the root directory is 2, when using extundelete to restore a file, it does not depend on the specific file format. First, extundelete obtains all file information in the current file system through the inode information of the file system, including existing and deleted files. The information includes the file name and inode. Then, the inode information is used in combination to query the location of the block where the inode is located, including the direct block and indirect block information, finally, use the dd command to back up the information to restore the data file;

2. Use of extundelete

1> install extundelete

Extundelete official address is http://extundelete.sourceforge.net/its current stability is extundelete-0.2.4.tar.bz2,

Before installing extundelelete, you need to install e2fsprogs and the e2fsprogs-libs in two dependent packages, e2fsprogs and e2fsprogs-libs installation is very simple,

Install the dependency package:

# Yum-y install e2fsprogs e2fsprogs-libs e2fslibs-dev e2fslibs-dev e2fsprogs-devel

On the Internet, YUM or the official default YUM can directly install e2fsprogs.

# Tar-xvf extundelete-0.2.4.tar.bz2

# Cd extundelete-0.2.4

#./Configure & make install

If a warning occurs, ignore it.

2> extundelelte

Add another hard disk/dev/sdb partition to/dev/sdb1

# Mkdir/datazeng

# Mount/dev/sdb1/datazeng

# Vim/datazeng/1.txt

# Cp/etc/passwd/datazeng

# Cp-rf/boot/grub // datazeng/

# Sync; Note: when creating a file or copying a file, the file will be first marked in the memory, and the data will be stored on the disk during sync; otherwise, the recovery will fail,

# Rm/datazeng/*-rf start to delete data

# After deleting umount/dev/sdb1, You Need To unmount the partition immediately,

This step is very important, and the disk should be mounted as read-only as soon as possible after the file is deleted by mistake; the earlier the operation, the higher the chance of recovery success;

# Extundelete/dev/sdb1 -- inode 2: Start to query the recoverable data of/dev/sdb1.

# Extundelete/dev/sdb1 -- restore-file passwd start to restore a single data,

Use the-resotre-file parameter

NOTICE: Extended attributes are not restored.

Loading filesystem metadata... 64 groups loaded.

Loading journal descriptors... 37 descriptors loaded.

Successfully restored file passwd

[Root @ master/] # ls RECOVERED_FILES/

Passwd

 

Extundelete: The parameter used to restore a single file is "-restore-file". Note that "-restore-file" is followed by the file recovery path, which is the relative path of the file, the relative path is relative to the original file storage path, for example:

The original file storage path is/datazeng/passwd, so no absolute path is required for restoration. Directly add the relative path;

The original file storage path is/datazeng/test/1.txt. When the file is restored, add test/1.txt to the parameter;

After the file is restored successfully, the extundelete command creates a RECOVERED_FILES directory under the directory where the command is executed by default. This directory is used to store the recovered files. Therefore, the current directory of the extundelete command must be writable;

3> extundelelte restore a single directory

[Root @ master/] # extundelete/dev/sdb1 -- restore-directory/grub

NOTICE: Extended attributes are not restored.

Loading filesystem metadata... 64 groups loaded.

Loading journal descriptors... 65 descriptors loaded.

Searching for recoverable inodes in directory/grub...

20 recoverable inodes found.

Looking through the directory structure for deleted files...

5 recoverable inodes still lost.

[Root @ master/] # ls RECOVERED_FILES/

Grub

4> extundelelte restore all deleted data by mistake

[Root @ master/] # extundelete/dev/sdb1 -- restore-all

NOTICE: Extended attributes are not restored.

Loading filesystem metadata... 64 groups loaded.

Loading journal descriptors... 65 descriptors loaded.

Searching for recoverable inodes in directory /...

20 recoverable inodes found.

Looking through the directory structure for deleted files...

0 recoverable inodes still lost.

[Root @ master/] # ls RECOVERED_FILES/

Grub passwd

5> extundelelte

After recovering deleted data after a certain time period, before restores the deleted data before a certain period of time.

[Root @ master/] # date + % s

1409111629

# Extundelete -- before 1409111629 -- restore-all/dev/sdb1

Error: I am prompted that the test is performed every time. For convenience, after the test is completed, mkfs. ext4/dev/sdb1 re-mount, write data, delete, uninstall, and test again;

If a partition is formatted twice, after data is filled in, the manually created data cannot be recovered. Only data copied by CP can be recovered, if you want to perform a new test, remove the newly added hard disk from the VM, add the disk again, perform partitioning and testing;

Note that this software has many bugs, especially for large file recovery. There are still many defects. And cannot guarantee 100% recovery, so it can only be used for fire fighting;