Tool: Extundelete
Knowledge about the Ext4 file system:http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/
First, installation
# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/ extundelete-0.2.0.tar.bz2 # tar -xvf extundelete-0.2.0.tar.bz2 # cd extundelete-0.2.0 # mkdir /usr/local/extundelete # ./configure -- prefix=/usr/local/extundelete[[email protected] extundelete-0.2.0]# ./configure --prefix=/ Usr/local/extundeleteconfiguring extundelete 0.2.0configure: error: c++ compiler cannot create executablesSee ' Config.log ' for more details. [[email protected] extundelete-0.2.0]yum install gcc-c++.x86_64 //Installing the Build kit [[email protected] extundelete-0.2.0]./configure --prefix=/usr/local/extundelete [[email protected] extundelete-0.2.0] yum -y install e2fsprogs* # If you are prompted not to find the EXT2FS library, use yum -y install e2fsprogs* installation [[email protected] extundelete-0.2.0] ./configure --prefix=/usr/ Local/extundelete [[email protected] extundelete-0.2.0] make && make install [[email protected] extundelete-0.2.0] make clean # installation is complete. mount the partition below as a test:
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/7B/2B/wKiom1bIOVuA-wbFAAC7u9FfTSE021.png "title=" Sb11.png "alt=" Wkiom1biovua-wbfaac7u9fftse021.png "/>
Third, restore deleted files
1. Immediately umount the file partition to be recovered
# umount/mnt1/loop100m
2. use Extundelete to view files that exist on the partition :
#--inode to find content in an I node, use 2 for search, and if you need to go to directory search, just specify the directory I node
[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 2/loop/disk_ 100M
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Contents of Inode 2:
0000 | Ed-A-db C4-db C4 56 | A...... U.. VI.. V
0010 | DB C4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I.. V............
0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is allocated
group:0
File mode:16877
Low + bits of Owner uid:0
Size in bytes:1024
Access time:1455741781
Creation time:1455741769
Modification time:1455741769
Deletion time:0
Low-bits of Group id:0
Links Count:4
Blocks Count:2
File flags:0
File version (for NFS): 0
File acl:0
Directory acl:0
Fragment address:0
Direct blocks:272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block:0
Double Indirect block:0
Triple Indirect block:0
File name | Inode number | Deleted status
Directory Block 272:
. 2
.. 2
Lost+found 11
Test 12
[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/lo
loop/lost+found/
2.1 Search again for Inod 12 below file
[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/loop/disk _100m
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Contents of Inode 12:
0000 | Ed 5b db C4 b4 db C4 56 |. A...... [.. V... V
0010 | B4 db C4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ... V............
0020 | XX 0a f3 01 00 04 00 00 00 | ................
0030 | at xx xx, B7 0d 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | xx-7e B6 0d 00 00 00 00 00 00 | ..... 2) ~ .....
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is allocated
group:0
File mode:16877
Low + bits of Owner uid:0
Size in bytes:1024
Access time:1455741787
Creation time:1455741876
Modification time:1455741876
Deletion time:0
Low-bits of Group id:0
Links Count:2
Blocks Count:4
File flags:524288
File version (for NFS): 2116629141
File acl:3510
Directory acl:0
Fragment address:0
Direct blocks:127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0
Indirect block:0
Double Indirect block:0
Triple Indirect block:0
File name | Inode number | Deleted status
Directory Block 3511:
. 12
.. 2
Xaa Deleted
Xab Deleted
Xac Deleted
3. recovers files with Inode 12
[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 12/l oop/disk_100m
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Loading Journal Descriptors ... Descriptors loaded.
Writing Output to directory recovered_files/
Unable to restore inode [file.12]: No undeleted copies found in the journal.
[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 13/l oop/disk_100m
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Loading Journal Descriptors ... Descriptors loaded.
Restored Inode to file recovered_files/file.13
[Email protected]/]#
[Email protected]/]#
[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 14/l oop/disk_100m
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Loading Journal Descriptors ... Descriptors loaded.
Restored Inode to file recovered_files/file.14
[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 15/l oop/disk_100m
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Loading Journal Descriptors ... Descriptors loaded.
Restored Inode to file recovered_files/file.15
[Email protected]/]#
[Email protected]/]#
[Email protected]/]#
[Email protected]/]# Mount-o loop/loop/disk_100m/mnt1/loop100m/
[Email protected]/]# ls/mnt1/loop100m/
Lost+found Test
4. View the recovered files:
[[email protected]/]# ls recovered_files/
file.13 file.14 file.15
Follow the information in the recovery process, rename the file back, according to the Orange text control:
Original file name-->> inod-->> file name after recovery
Xaa file.13
Xab file.14
Xac file.15
#mv FILE.13/TEST/XAA
#mv File.14/test/xab
#mv File.15/test/xac
Done
This article is from the "Sea of Boundless" blog, please be sure to keep this source http://plong.blog.51cto.com/3217127/1743705
Recover files that were mistakenly deleted using RM command in EXT4