Extundelete Anti-removal Tool usage instructions

In the Linux system, believe that all the experience of deleting files, RM-RF can delete all files. When you delete some important data, how should I get it back?

The Extundelete is a powerful Linux data recovery tool that restores files in the ext3 and Ext4 file systems.

Do not panic after deleting files by mistake, the first thing to do is to unmount the partition or to re-mount the partition read-only.

Installing Extundelete

# yum Install gcc-c++ E2fsprogs-devel

# CD extundelete-0.2.4

# make

# make Install

See What the SDB1 partition is

# ls

Wan Wanyu xiaoming #wan为文件, Wanyu and xiaoming as directories

Simulated accidental deletion

# rm/back/*-RF

Re-mount the SDB1 partition as read-only

# Mount-o REMOUNT,RO/DEV/SDB1

finds the deleted file starting with the second inode number of the current partition

# Extundelete--inode 2/DEV/SDB1

 notice:extended attributes are not restored. Loading filesystem metadata ... 160 groupsloaded. Group: 0contents of inode 2:0000 | ed 41 00 00 00 10  00 00 07 a7 a2 5531 a7 a2 55 | . A......... U1. u0010 | 31 a7 a2 55 00 00 00 00 00 00 02 0008  00 00 00 | 1..u ....... 0020 | 00 00 00 00 1f 00 00 00 21 24 00 0000  00 00 00 | ........! $...... 0030 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 0040 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 0050 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 0060 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 0070 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 0080 | 1c 00 00 00 fc 53 e0 b0 fc 53 e0 b05c  e7 9e 3a |  S ... S.. \..:0 090 | fc a2 a2 55 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, ..... U ....... 00a0 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 00b0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00  |&NBSP, .......... 00c0 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 00d0 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 00e0 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 |&NBSP, .......... 00f0 | 00 00 00 00 00 00 00 00 00 00 00 0000  00 00 00 | ................ Inode is AllocatedFile mode:  16877low 16 bits of owner uid: 0size in bytes: 4096access  time: 1436722951creation time: 1436722993modification time: 1436722993deletion time: 0low 16 bits of group  id: 0links count: 2blocks count: 8file flags: 0file version   (FOR NFS):  0file acl: 0directory acl: 0fragment address: 0direct  blocks: 9249, 0, 0, 0, 0, 0, 0, 0,0, 0, 0,  0indirect block: 0double indirect block: 0triple indirect block: 0  File name                                         | Inodenumber | Deleted status.                                                   2..                                                  2wanyu                                               1048577         deletedxiaoming                                           786433         deletedwan                                                 11              Deleted

Recovering individual files

# EXTUNDELETE/DEV/SDB1--restore-file Wan

# ls recovered_files/

Wan

Recovering a single directory

# EXTUNDELETE/DEV/SDB1--restore-directory/wanyu

# ls recovered_files/wanyu/

Inittab Wan Xiaoming Yu

Restore the file corresponding to the inode number

# EXTUNDELETE/DEV/SDB1--restore-inode 11

# ls recovered_files/

file.11 Wan Wanyu

Recovery Res_file the files displayed in

# Vim Res_file

Wan

# EXTUNDELETE/DEV/SDB1--restore-files Res_file

Notice: extended attributes are notrestored. Warning: ext3_feature_incompat_recover isset. the partition should be unmounted toundelete any files without  Further data loss. If the partition is not currently mounted,this message indicatesit  was improperly unmounted, and you shouldrun fsck before  Continuing. If you decide to continue, extundelete mayoverwrite some of the  deletedfiles and make recovering those filesimpossible.  You  Should unmount thefile system and check it with fsck beforeusing  extundelete. would you like to continue?  (y/n) yloading filesystem metadata   160 groupsloaded. loading journal descriptors ...  172descriptors loaded. Successfully restored file wan

Recover All Files

# EXTUNDELETE/DEV/SDB1--restore-all

This article is from the "on the Road" blog, please be sure to keep this source http://mingxiao.blog.51cto.com/8124243/1675338

Extundelete Anti-removal Tool usage instructions