Delete Ext4 File System in CentOS and restore

1. install the software (extundelete depends on the system's e2fsprogs three software packages)

[Root @ redhat1 home] # mkdir/mnt/cdrom -- create a CD Mount directory

[Root @ redhat1 home] # mount/dev/cdrom/mnt/cdrom-attach a cd
Mount: block device/dev/sr0 is write-protected, mounting read-only
[Root @ redhat1 home] # vim/etc/yum. repos. d/base. repo -- configure the local source of the system

[Base]
Name = base
Baseurl = file: // mnt/cdrom
Enabled = 1
Gpgcheck = 1
Gpgkey = file: /// mnt/cdrom/RPM-GPG-KEY-REDHAT-6

[Root @ redhat1 home] # yum install e2fs * -- install the dependency package of extundelete

[Root @ redhat1 home] # rpm-aq | grep e2fs -- check whether the software package is installed
E2fsprogs-devel-1.41.12-14.el6.i686
E2fsprogs-libs-1.41.12-14.el6.i686
E2fsprogs-1.41.12-14.el6.i686

[Root @ redhat1 home] # wgethttp: // response

[Root @ redhat1 home] # tar xvf extundelete-0.2.4.tar.bz2 -- extract the package

[Root @ redhat1 home] # cd extundelete-0.2.4 -- enter the package

[Root @ redhat1 ext3grep-0.10.2] #./configure -- prefix =/usr/local/extundelete & make install -- install software

[Root @ redhat1 ext3grep-0.10.2] # ll/usr/local/| grep ext -- check that the software is successfully installed
Drwxr-xr-x. 3 root 4096 Dec 2 17:24 extundelete

[Root @ redhat1 ext3grep-0.10.2] #

2. Create a block device and mount the system

[Root @ redhat1 home] # dd if =/dev/zero of = 123 bs = 1 M count = 100 -- create a block device in the home directory 123
100 + 0 records in
100 + 0 records out
104857600 bytes (105 MB) copied, 0.634943 s, 165 MB/s

[Root @ redhat1 home] # mkfs. ext4 123 -- format the block Device

Mke2fs 1.41.12 (17-May-2010)
123 is not a block special device.
Proceed anyway? (Y, n) y -- input y to confirm
Filesystem label =
OS type: Linux
Block size = 1024 (log = 0)
Fragment size = 1024 (log = 0)
Stride = 0 blocks, Stripe width = 0 blocks
25688 inodes, 102400 blocks
5120 blocks (5.00%) reserved for the super user
First data block = 1
Maximum filesystem blocks = 67371008
13 block groups
8192 blocks per group, 8192 fragments per group
1976 inodes per group
Superblock backups stored on blocks:
8193,245 77, 40961,573 45, 73729

Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 27 mounts or
180 days, whichever comes first. Use tune2fs-c or-I to override.

[Root @ redhat1 home] # mkdir/mnt/123 -- create a directory mounted to the block Device

[Root @ redhat1 home] # mount 123/mnt/123-o loop -- mount block device 123 to/mnt/123

[Root @ redhat1 home] # df-TH -- check whether the directory is mounted
Filesystem Type Size Used Avail Use % Mounted on
/Dev/mapper/VolGroup-lv_root
Ext4, 20G, 3.8G, 16G, 20%/
Tmpfs 262 M 0 262 M 0%/dev/shm
/Dev/sda1 ext4 508 M 32 M 451 M 7%/boot
Df: '/mnt/cdrom': No such file or directory
/Dev/sr0 iso9660 3.2G 3.2G 0 100%/mnt
/Home/123 ext4 102 M 5.8 M 91 M 7%/mnt/123 -- the device is mounted

3. add and delete files

[Root @ redhat1 home] # cp-a/etc/passwd/etc/shadow/etc/group/mnt/123/-- move the file to the device

[Root @ redhat1 ~] # Ll/mnt/123/-- check whether a file exists

Total 19
-Rw-r --. 1 root 712 Dec 2 14:39 group
Drwx ------. 2 root 12288 Dec 4 lost + found
-Rw-r --. 1 root 1509 Dec 2 14:39 passwd
----------. 1 root 976 Dec 2 shadow
[Root @ redhat1 home] # sync -- Synchronize files

[Root @ redhat1 home] # rm-rf/mnt/123/passwd/mnt/123/shadow -- delete a file

[Root @ redhat1 home] # sync -- Synchronize files

[Root @ redhat1 home] # umount/mnt/123 -- uninstall the device

4. Restore the deleted file

Cd/usr/local/extundelete/bin -- enter the Software Directory

[Root @ redhat1 bin] #./extundelete -- ls -- inode 2/home/123 -- view the file details of the block device/home/123
./Extundelete: unrecognized option '-- ls'
NOTICE: Extended attributes are not restored.
Loading filesystem metadata... 13 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 04 00 fe c6 9e 52 58 c7 9e 52 |. A ......... RX. R
0010 | 58 c7 9e 52 00 00 00 00 00 03 00 00 00 00 00 | X... R ............
0020 | 00 00 00 00 05 00 00 00 10 01 00 00 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bits: 1024
Access time: 1386137342
Creation time: 1386137432
Modify time: 1386137432
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 2
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name | Inode number | Deleted status
. 2
.. 2
Lost + found 11
Passwd 12 Deleted -- Delete is the file we just Deleted
Shadow 13 Deleted
Group 14
[Root @ redhat1 bin] #./extundelete -- restore-file passwd/home/123 -- use the file name to restore the file
NOTICE: Extended attributes are not restored.
Loading filesystem metadata... 13 groups loaded.
Loading journal descriptors... 27 descriptors loaded.
Successfully restored file passwd -- recovery successful

[Root @ redhat1 bin] #./extundelete -- restore-inode 13/home/123 -- use the node number to restore the file
NOTICE: Extended attributes are not restored.
Loading filesystem metadata... 13 groups loaded.
Loading journal descriptors... 27 descriptors loaded.

[Root @ redhat1 bin] #./extundelete -- restore-all/home/123 -- restore all deleted files
NOTICE: Extended attributes are not restored.
Loading filesystem metadata... 13 groups loaded.
Loading journal descriptors... 27 descriptors loaded.
Searching for recoverable inodes in directory /...
2 recoverable inodes found.
Looking through the directory structure for deleted files...
0 recoverable inodes still lost.
[Root @ redhat1 bin] # ll RECOVERED_FILES/-- View All recovered files
Total 20
Drwxr-xr-x. 2 root 4096 Dec 3 16:21 123
-Rw-r --. 1 root 976 Dec 4 14:18 file.13
-Rw-r --. 1 root 1509 Dec 4 14:16 passwd
-Rw-r --. 1 root 1509 Dec 4 14:20 passwd. v1
-Rw-r --. 1 root 976 Dec 4 14:20 shadow
[Root @ redhat1 bin] #

!!!!!! I wish you success.