CentOS RM File Removal recovery

System is the CentOS 6.5 x64 bit system

After the RM file is deleted, recovery is cumbersome.

Can be recovered using Extundelete

Currently the latest version is 0.2.4

Extundelete Home: http://extundelete.sourceforge.net/

Download software

wget http://fossies.org/linux/misc/extundelete-0.2.4.tar.gz

Installing components

Yum install-y e2fsprogs e2fsprogs-devel e2fsprogs-libs

Installing extundelete

Tar zxvf extundelete-0.2.4.tar.gz-c/usr/src/

cd/usr/src/extundelete-0.2.4/

./configure

Make

Make install

When recovering, you need to unmount the partition. If you need to recover files in the root partition, then you need to restore on another server.

So I mounted a test partition.

[Email protected] ~]# df-ht

Filesystem Type Size used Avail use% mounted on

/dev/mapper/volgroup-lv_root ext4 29G 1.2G 26G 5%/

Tmpfs tmpfs 246M 0 246M 0%/dev/shm

/DEV/SDA1 ext4 485M 33M 427M 8%/boot

/DEV/SDB1 ext4 1008M 18M 940M 2%/test

Write to file, content is 111

[Email protected] ~]# vi/test/1.txt

deleting files

[Email protected] ~]# rm-rf/test/*

End a process tree that uses a partition

[Email protected] ~]# fuser-k/test

Unmount partition

[Email protected] ~]# umount/test/

Use Extundelete to view files that exist on a partition

--inode to find content in an I node, use 2 for search, and if you need to go to directory search, only specify the directory I node

[Email protected] ~]# extundelete--inode 2/dev/sdb1

notice:extended attributes is not restored.

Loading FileSystem metadata ... 8 groups loaded.

group:0

Contents of Inode 2:

0000 | Ed, xx, XX, A9 BF, A8 BF 75 55 |. A........uu. Uu

0010 | A8 BF 75 55 00 00 00 00 00 00 02 00 08 00 00 00 |.. Uu............

0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........ I ...

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c (6d B5)-6d B5 | .... (M.E (m.ex.y.

0090 | 6c BF 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | L.uu .......

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is allocated

File mode:16877

Low + bits of Owner uid:0

Size in bytes:4096

Access time:1433780137

Creation time:1433780136

Modification time:1433780136

Deletion time:0

Low-bits of Group id:0

Links Count:2

Blocks Count:8

File flags:0

File version (for NFS): 0

File acl:0

Directory acl:0

Fragment address:0

Direct blocks:73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block:0

Double Indirect block:0

Triple Indirect block:0

File name | Inode number | Deleted status

. 2

.. 2

Lost+found Deleted

.1.TXT.SWP Deleted

1.txt Deleted

From the above information, it can be seen that the file needs to be recovered 1.txt I node is 13

Recover files

--restore-inode Restore the specified I node file, the default is to put the recovered files in the current path recovered_files/directory, file name. I node number

[Email protected] ~]# extundelete--restore-inode 13/dev/sdb1

notice:extended attributes is not restored.

Loading FileSystem metadata ... 8 groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

See if a directory has files

[Email protected] ~]# ll recovered_files/

Total 4

-rw-r--r--1 root root 4 June 9 00:33 file.13

View File Contents

[Email protected] ~]# cat recovered_files/file.13

111

Re-mount partitions, recover files, view file contents

[Email protected] ~]# mount/dev/sdb1/test/

[Email protected] ~]# MV Recovered_files/file.13/test/1.txt

[Email protected] ~]# cat/test/1.txt

111

This article is from the "Falling Star" blog, make sure to keep this source http://xiao987334176.blog.51cto.com/2202382/1659746

CentOS RM File Removal recovery