Recover files that were mistakenly deleted using RM command in EXT4

Source: Internet
Author: User

Tool: Extundelete


Knowledge about the Ext4 file system:http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/


First, installation

#  wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/ extundelete-0.2.0.tar.bz2 # tar -xvf extundelete-0.2.0.tar.bz2 #  cd  extundelete-0.2.0 #  mkdir /usr/local/extundelete #  ./configure -- prefix=/usr/local/extundelete[[email protected] extundelete-0.2.0]# ./configure --prefix=/ Usr/local/extundeleteconfiguring extundelete 0.2.0configure: error: c++ compiler  cannot create executablesSee  ' Config.log '  for more details. [[email  protected] extundelete-0.2.0]yum install gcc-c++.x86_64 //Installing the Build kit   [[email  protected] extundelete-0.2.0]./configure --prefix=/usr/local/extundelete [[email  protected] extundelete-0.2.0]  yum -y install e2fsprogs* #  If you are prompted not to find the EXT2FS library, use  yum -y install e2fsprogs*  installation  [[email protected] extundelete-0.2.0] ./configure --prefix=/usr/ Local/extundelete [[email protected] extundelete-0.2.0] make && make  install [[email protected] extundelete-0.2.0] make clean  #  installation is complete.     mount the partition below as a test:

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/7B/2B/wKiom1bIOVuA-wbFAAC7u9FfTSE021.png "title=" Sb11.png "alt=" Wkiom1biovua-wbfaac7u9fftse021.png "/>


Third, restore deleted files


1. Immediately umount the file partition to be recovered

# umount/mnt1/loop100m

2. use Extundelete to view files that exist on the partition :

#--inode to find content in an I node, use 2 for search, and if you need to go to directory search, just specify the directory I node

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 2/loop/disk_ 100M

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Contents of Inode 2:

0000 | Ed-A-db C4-db C4 56 | A...... U.. VI.. V

0010 | DB C4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I.. V............

0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................


Inode is allocated

group:0

File mode:16877

Low + bits of Owner uid:0

Size in bytes:1024

Access time:1455741781

Creation time:1455741769

Modification time:1455741769

Deletion time:0

Low-bits of Group id:0

Links Count:4

Blocks Count:2

File flags:0

File version (for NFS): 0

File acl:0

Directory acl:0

Fragment address:0

Direct blocks:272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block:0

Double Indirect block:0

Triple Indirect block:0


File name | Inode number | Deleted status

Directory Block 272:

. 2

.. 2

Lost+found 11

Test 12

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/lo

loop/lost+found/

2.1 Search again for Inod 12 below file

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/loop/disk _100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Contents of Inode 12:

0000 | Ed 5b db C4 b4 db C4 56 |. A...... [.. V... V

0010 | B4 db C4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ... V............

0020 | XX 0a f3 01 00 04 00 00 00 | ................

0030 | at xx xx, B7 0d 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | xx-7e B6 0d 00 00 00 00 00 00 | ..... 2) ~ .....

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................


Inode is allocated

group:0

File mode:16877

Low + bits of Owner uid:0

Size in bytes:1024

Access time:1455741787

Creation time:1455741876

Modification time:1455741876

Deletion time:0

Low-bits of Group id:0

Links Count:2

Blocks Count:4

File flags:524288

File version (for NFS): 2116629141

File acl:3510

Directory acl:0

Fragment address:0

Direct blocks:127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0

Indirect block:0

Double Indirect block:0

Triple Indirect block:0


File name | Inode number | Deleted status

Directory Block 3511:

. 12

.. 2

Xaa Deleted

Xab Deleted

Xac Deleted

3. recovers files with Inode 12

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 12/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Writing Output to directory recovered_files/

Unable to restore inode [file.12]: No undeleted copies found in the journal.

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 13/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.13

[Email protected]/]#

[Email protected]/]#

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 14/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.14

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 15/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.15

[Email protected]/]#

[Email protected]/]#

[Email protected]/]#

[Email protected]/]# Mount-o loop/loop/disk_100m/mnt1/loop100m/

[Email protected]/]# ls/mnt1/loop100m/

Lost+found Test


4. View the recovered files:

[[email protected]/]# ls recovered_files/

file.13 file.14 file.15


Follow the information in the recovery process, rename the file back, according to the Orange text control:

Original file name-->> inod-->> file name after recovery

Xaa file.13

Xab file.14

Xac file.15


#mv FILE.13/TEST/XAA

#mv File.14/test/xab

#mv File.15/test/xac


Done

This article is from the "Sea of Boundless" blog, please be sure to keep this source http://plong.blog.51cto.com/3217127/1743705

Recover files that were mistakenly deleted using RM command in EXT4

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.