Data Recovery Soft Extundelete Introduction

I. Overview

As an operator, to ensure that the security of the data is the fundamental responsibility, so in the maintenance of the system, to be careful and careful, but sometimes it is inevitable that the data was mistakenly deleted, this time how to quickly and effectively recover data?

1.1. How to use the RM–RF command

Under the Linux system, how the data can be removed directly from the hard disk via RM–RF, without any hint, and Linux under the Windows Recycle Bin function, also means that the data after deletion by conventional means is not recoverable, so use this command to be very cautious, When using the RM command, the more secure method is to put the command parameters back, so that there is a reminder,

Then in the enterprise in fact, the safest way to ensure data is to do backup, although backup is not omnipotent, but no backup is absolutely not, any data tools have certain limitations, can not guarantee the full recovery of all the data, therefore, the backup as the core, The function assistance of data recovery tool is a kind of criterion that operation must stick to.

1.2. Similarities and differences of Extundelete and Ext3grep

Under Linux, there are many sources of data recovery tools based on open source, common Debugfs,r-linux,ext3grep,

Extundelete, and so on, more commonly used have ext3grep and extundelete, the recovery of these two tools is basically the same, just exturndelete more powerful features,

Exturndelete is a Linux-based data recovery tool, which parses the file system log, resolves all the file inode information, so that the main Linux under the mainstream ext3 Ext4 file system was mistakenly deleted files, And Ext3grep can only restore Ext3 file system Recovery, in the recovery speed, extundelete much faster, because the extundelete recovery mechanism is to scan inode and recovery data at the same time, and support delay file recovery, but each directory recovery, Inode Recovery, block recovery, full disk recovery, and so on, and ext3grep is slightly inadequate, it needs to scan all the inode information to recover data before starting to recover the data, so it is relatively slow in recovery speed, and does not support directory recovery function, Time recovery, etc...

1.3, the principle of extundelete recovery

Before the introduction of using Extundelete to recover data, a simple introduction to the Inode knowledge, under Linux can be "ls-id" command to query the Inode value of a file or directory, such as viewing the Inode value of the directory, you can enter: Ls–id/ To view the Inode value for the root directory

It can be concluded that the inode value of the root directory is 2, when using Extundelete to recover the file does not rely on a specific file format, first extundelete through the file system Inode information to obtain the current file system of all the file information, including the existence and deleted files, This information includes the file name and Inode, and then uses the Inode information to query the location of the block where the inode resides, including direct blocks, indirect blocks and so on, and finally, using the DD command to back up the information, thereby recovering the data file.

1.4, Installation Extundelete

Extundelete official address for http://extundelete.sourceforge.net/its current stable version is extundelete-0.2.4.tar.bz2,

Before installing Extundelelete, you need to install the e2fsprogs and E2fsprogs-libs two a dependency package,

E2fsprogs and E2fsprogs-libs are easy to install,

To install a dependency package:

# yum-y Install e2fsprogs e2fsprogs-libs e2fslibs-dev E2fslibs-dev e2fsprogs-devel

Online yum or official default yum source

# TAR-XVF EXTUNDELETE-0.2.4.TAR.BZ2

#cd extundelete-0.2.4

#./configure && make && make install

Can be ignored if a warning is present.

1.5. Extundelelte Restore Individual files

Add one more hard drive/dev/sdb into the/DEV/SDB1

# Mkdir/datazeng

# Mount/dev/sdb1/datazeng

# Vim/datazeng/1.txt

# Cp/etc/passwd/datazeng

# cp–rf/boot/grub//datazeng/

# sync;sync;sync; Note that creating a file or copying a file will first be marked in memory, sync when the data falls to disk, or it will fail to recover.

# rm/datazeng/*-RF Start deleting data

# umount/dev/sdb1 After deleting delete, need to unload this partition immediately,

This step is important and you should mount the disk as read-only as soon as possible after deleting the file by mistake. The sooner you do it, the greater the chance of success in recovery.

# EXTUNDELETE/DEV/SDB1--inode 2 start querying/DEV/SDB1 recoverable data

# EXTUNDELETE/DEV/SDB1--restore-file passwd start recovering individual data,

Using the-resotre-file parameter

notice:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Panax Notoginseng descriptors loaded.

Successfully restored file passwd

[[email protected]/]# ls recovered_files/

passwd

Extundelete The parameter to recover a single file is "-restore-file" , it's important to note that "-restore-file" The following specifies the recovery file path, which is the relative path to the file, relative to the original file storage path, such as:

the original file storage path is/DATAZENG/PASSWD , you do not need to add an absolute path when recovering. Direct plus relative path can be

the path to the original file store is/datazeng/test/1.txt then when recovering, add test/1.txt directly behind the parameters. can be

after the file recovery is successful, Extundelete The command creates a recovered_files in the directory where the command is executed by default directory, this directory is used to store the recovered files, so execute Extundelete the command current directory must be writable.

1.6. Extundelelte Restore a single directory

[Email protected]/]# EXTUNDELETE/DEV/SDB1--restore-directory/grub

notice:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Searching for recoverable inodes in Directory/grub ...

Recoverable inodes found.

Looking through the directory structure for deleted files ...

5 recoverable inodes still lost.

[[email protected]/]# ls recovered_files/

Grub

1.7, Extundelelte recover all data deleted by mistake

[Email protected]/]# EXTUNDELETE/DEV/SDB1--restore-all

notice:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Searching for recoverable inodes in directory/...

Recoverable inodes found.

Looking through the directory structure for deleted files ...

0 recoverable inodes still lost.

[[email protected]/]# ls recovered_files/

Grub passwd

1.8, Extundelelte restore a time of

After recovering deleted data after a certain time, before restores data that was deleted before a certain time period

[Email protected]/]# date +%s

1409111629

# extundelete--before 1409111629--restore-all/dev/sdb1

Error: Tip Every time you do a test. A bit of people for convenience. After the test is complete. In

MKFS.EXT4/DEV/SDB1 is re-hung in. After the data is written, it is removed, uninstalled. In the test.

If a partition is formatted 2 times, populating it with data will appear, and the data you manually set up will not be recoverable.

Only the data can be recovered by the CP copied elsewhere, and you want to re-test it. Please remove the newly added hard drive from the virtual machine. In the re-increment. to partition. Test

Note that there are many bugs in this software. Especially for some large files to recover. There is also a big flaw. And there is no guarantee of 100% recovery, so only fire can be used

Data Recovery Soft Extundelete Introduction