Extundelete linux data recovery tool, extundeletelinux

Extundelete linux data recovery tool, extundeletelinux

1. Introduction to extundelete

1. extundelete file recovery tool. The most powerful tool is ext3/ext4 dual-format partition recovery.

2. During the actual online recovery process, do not install extundelete on the hard disk where the file you accidentally deleted is located. This will have a chance to completely overwrite the data to be restored.

3. extundelete still has a lot of incompleteness. The Restoration function based on the entire disk is relatively powerful, and the Restoration Based on directories and files is not powerful enough.

4. After the extundelete operation is completed, a RECOVERED_FILES directory is generated in the current directory, which contains the recovered files and folders.

5. before using any file restoration tool, unmount or mount the partitions to be restored as read-only to prevent data from being overwritten.

Umount/dev/partition

Mount-o remount, ro/dev/partition

6. Maintaining good habits is definitely easier than restoring data.

Ii. Installation

0. yum install e2fsprogs * e2fslibs *-y

1. wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

2. tar-axf extundelete-0.2.4.tar.bz2-C/usr/local/src

3. cd/usr/local/src/extundelete-0.2.4

4../configure -- prefix =/usr/local/extundelete

5. make & make install

6. ln-s/usr/local/extundelete/bin/*/usr/local/bin/

Iii. Commands

Usage: extundelete [options] [--] device-file

Options:

-- Superblock: prints the super block information of the specified partition. If no parameter is added, this option is default.

Extundelete -- superblock/dev/sda3 <---> extundelete/dev/sda1

-- Journal: displays the log information of a block, which is the same as that of superblock.

Extundelete -- journal/dev/sda1

-- After dtime: Only data deleted after the specified time (dtime) is restored.

Assume that the deletion time is about.

Date-d "Jul 11 16: 30" + % s

Returns 1531297800 seconds.

Restore all files deleted after this time

Extundelete/dev/sdb1 -- after 1234567890 -- restore-all

-- Before dtime: Only data deleted before the specified time [dtime] (timestamp) is restored.

-- Inode ino: displays the inode of a partition as x. Generally, it is used to view all files in the partition.

Extundelete -- inode 2/dev/sda1

-- Block blk displays the block x information of a partition.

-- Restore-inode ino [, ino,...] restore one or more files with the specified inode number. The recovered files are saved in RECOVERED_FILES in the current directory. The file name is [file. $ inode]

Extundelete/dev/sda1 -- restore-inode 13,14

-- Restore-file 'filename' restore the specified file (Deleted). The file is located in RECOVERED_FILES/$ filename in the current directory. The file name is still the original one.

Extundelete/dev/sda1 -- restore-file initramfs-2.6.32-358.el6.x86_64.img

-- Restore-files 'read _ filename' restore the content of the specified file (actually exists). The file is located in RECOVERED_FILES/$ filename under the current directory. The file name is still the original one.

Extundelete/dev/sda1 -- restore-files test_restore.txt

-- Restore-directory 'dir-name' restore the specified directory. The file is located in RECOVERED_FILES/$ dir-name under the current directory. The file name is still the original one.

Extundelete/dev/sda1 -- restore-files grub

-- Restore-all: restores all deleted data in a partition. The file name is still the original one.

Extundelete/dev/sda1 -- restore-all