Extundelete: an open source data recovery tool in Linux

Extundelete: an open source data recovery tool in Linux

In Linux, there are many open-source data recovery tools, including debugfs, R-Linux, ext3grep, and extundelete. ext3grep and extundelete are commonly used, the restoration principles of these two tools are basically the same, but extundelete is more powerful. This article focuses on
 
**************************************** **********
* Lsof recovery *
**************************************** **********
Lsof
The file has just been deleted. To restore it, try lsof first.
# Lsof | grep data. file1
# Cp/proc/xxx/xx/dir/data. file1

Or ps-ef

**************************************** **********
* Extundelete restore *
**************************************** **********

The first thing to do is to unmount the partition where the deleted data is located. If the data in the root partition is deleted by mistake


Yum install gcc ++
Yum install gcc-c ++ gcc-g77

Yum install e2fsprogs e2fsprogs-libs e2fsprogs-devel
[Root @ dg extundelete-0.2.4] #./configure
Refreshing ing extundelete 0.2.4
Writing generated files to disk

Tar xjf extundelete-0.2.4.tar.bz2
Cd extundelete-0.2.4
./Configure
Make & make install

[Root @ dg: extundelete-0.2.4] # make
Make-s all-recursive
Making all in src
Extundelete. cc: 571: Warning: Unused parameter 'flags'
[Root @ dg extundelete-0.2.4] # make install
Making install in src
/Usr/bin/install-c extundelete '/usr/local/bin'

 

--- View help
Root @ dg extundelete-0.2.4] # make install
Making install in src
/Usr/bin/install-c extundelete '/usr/local/bin'
[Root @ dg extundelete-0.2.4] # extundelete -- help
Usage: extundelete [options] [--] device-file
Options:
-- Version,-[vV] Print version and exit successfully.
-- Help, Print this help and exit successfully.
-- Superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
-- Journal Show content of journal.
-- After dtime Only process entries deleted on or after 'dtime '.
-- Before dtime Only process entries deleted before 'dtime '.
Actions:
-- Inode ino Show info on inode 'ino '.
-- Block blk Show info on block 'blk '.
-- Restore-inode ino [, ino,...]
Restore the file (s) with known inode number 'ino '.
The restored files are created in./RECOVERED_FILES
With their inode number as extension (ie, file.12345 ).
-- Restore-file 'path' Will restore file 'path'. 'path' is relative to root
Of the partition and does not start with '/'
The restored file is created in the current
Directory as 'recovered _ FILES/path '.
-- Restore-files 'path' Will restore files which are listed in the file 'path '.
Each filename shocould be in the same format as an option
To -- restore-file, and there shoshould be one per line.
-- Restore-directory 'path'
Will restore directory 'path'. 'path' is relative to
Root directory of the file system. The restored
Directory is created in the output directory as 'path '.
-- Restore-all Attempts to restore everything.
-J journal Reads an external journal from the named file.
-B blocknumber Uses the backup superblock at blocknumber when opening
The file system.
-B blocksize Uses blocksize as the block size when opening the file
System. The number shocould be the number of bytes.
-- Log 0 Make the program silent.
-- Log filename Logs all messages to filename.
-- Log D1 = 0, D2 = filename Custom control of log messages with comma-separated
Examples below: list of options. Dn must be one of info, warn, or
-- Log info, error. Omission of the '= name' results in messages
-- Log warn = 0 with the specified level to be logged to the console.
-- Log error = filename If the parameter is '= 0', logging for the specified
Level will be turned off. If the parameter is
'= Filename', messages with that level will be written
To filename.
-O directory Save the recovered files to the named directory.
The restored files are created in a directory
Named 'recovered _ FILES/'by default.

Options include:
-- Version,-[vV], displays the software version number.
-- Help: displays the software help information.
-- Superblock: displays the superblock information.
-- Journal: displays log information.
-- After dtime, a time parameter, indicates the files or directories deleted after a certain period of time.
-- Before dtime, time parameter, indicates the file or directory that was deleted before a certain period of time.

Actions include:
-- Inode ino: displays information about the node "ino.
-- Block blk: displays information about the data block "blk.
-- Restore-inode ino [, ino,...], the recovery command parameter indicates that the "ino" file of the node is restored. The recovered file is automatically placed in the RESTORED_FILES folder under the current directory and the node number is used as the extension.
-- Restore-file 'path': Recovery command parameter, which indicates to restore the file in the specified path and put the recovered file in the RECOVERED_FILES directory under the current directory.
-- Restore-files 'path'. The recovery command parameter indicates that all files listed in the path will be restored.
-- Restore-all: restore command parameters, indicating that all directories and files will be restored.
-J journal, which indicates reading extended logs from a named file.
-B blocknumber indicates that the previously backed up super block is used to open the file system. It is generally used to check whether the existing super block is the current file.
-B blocksize indicates that the data block size is used to open the file system. It is generally used to view known files.

1> fuser-k/dev/part & umount/dev/disk of the deleted data -- kill the process of accessing the disk, and umount is deleted from the data disk
2> extundelete -- inode 2/dev/disk of the deleted data
3> extundelete -- restore-inode 13/dev/disk with Deleted Data
4> restore to RECOVERD_FILES/


After the data is deleted by mistake, the first thing to do is to unload the partition where the deleted data is located. If the data in the root partition is deleted by mistake,
You need to switch the system to single-user mode and mount the root partition in read-only mode. The reason for this is that after the file is deleted,
Only the sector pointer in the inode node of the file is cleared, and the actual file is stored on the disk. If the disk continues to be mounted in read/write mode,
The data blocks of these deleted files may be re-allocated by the operating system. After these databases are overwritten with new data, the data is actually lost,
The restoration tool cannot go back to the day. So! Mounting a disk in read-only mode can minimize the risk of data overwriting in the database, so as to increase the proportion of successful data recovery.

Delete 1.txt

Method 1: Restore through inode
View the partition in which the file is deleted.
Root @ dg extundelete-0.2.4] # df-h
File System capacity in use available % mount point
/Dev/sda2 44G 3.0G 39G 8%/
Tmpfs 1004 M 76 K 1004 M 1%/dev/shm
/Dev/sda1 194 M 51 M 134 M 28%/boot
# Extundelete/dev/sda4 -- inode 2
Mkdir test

Extundelete/dev/sda4 -- restore-inode 8001 file number

Comparison File
Diff/etc/passwd recover_file/file12
If no output result is displayed, the two files are identical.

Method 2: Restore by file name
Extundelete/dev/sdb1 -- restore-file passwd
A RECOVERED_FILES directory is generated under the current directory, which stores the recovered files.

Method 3: Restore by directory name
Extundelete/dev/sdb1 -- restore-directory/mongodb

Method 4: Restore all deleted files by mistake:
Extundelete/dev/sdb1 -- restore-all
Extundelete can also restore data for a certain period of time. You can use the "-- after" and "-- before" Parameters

Empty files and directories cannot be restored.

Method 4:
Extundelete/dev/sda4 -- restore-all

Extundelete cannot restore Empty files and directories

**************************************** **************************************** *
Use debugfs
Use debugfs to find the inode of the deleted file and restore the idea.
[Root @ hs12 ~] # Debugfs/dev/sdb1
Debugfs 1.41.12 (17-May-2010)

Debugfs:
Debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
0 deleted inodes found.

This article permanently updates the link address: