Recover files that were mistakenly deleted using RM command in EXT4

Tool: Extundelete

Knowledge about the Ext4 file system:http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/

First, installation

#  wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/ extundelete-0.2.0.tar.bz2 # tar -xvf extundelete-0.2.0.tar.bz2 #  cd  extundelete-0.2.0 #  mkdir /usr/local/extundelete #  ./configure -- prefix=/usr/local/extundelete[[email protected] extundelete-0.2.0]# ./configure --prefix=/ Usr/local/extundeleteconfiguring extundelete 0.2.0configure: error: c++ compiler  cannot create executablesSee  ' Config.log '  for more details. [[email  protected] extundelete-0.2.0]yum install gcc-c++.x86_64 //Installing the Build kit   [[email  protected] extundelete-0.2.0]./configure --prefix=/usr/local/extundelete [[email  protected] extundelete-0.2.0]  yum -y install e2fsprogs* #  If you are prompted not to find the EXT2FS library, use  yum -y install e2fsprogs*  installation  [[email protected] extundelete-0.2.0] ./configure --prefix=/usr/ Local/extundelete [[email protected] extundelete-0.2.0] make && make  install [[email protected] extundelete-0.2.0] make clean  #  installation is complete.     mount the partition below as a test:

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/7B/2B/wKiom1bIOVuA-wbFAAC7u9FfTSE021.png "title=" Sb11.png "alt=" Wkiom1biovua-wbfaac7u9fftse021.png "/>

Third, restore deleted files

1. Immediately umount the file partition to be recovered

# umount/mnt1/loop100m

2. use Extundelete to view files that exist on the partition :

#--inode to find content in an I node, use 2 for search, and if you need to go to directory search, just specify the directory I node

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 2/loop/disk_ 100M

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Contents of Inode 2:

0000 | Ed-A-db C4-db C4 56 | A...... U.. VI.. V

0010 | DB C4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I.. V............

0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is allocated

group:0

File mode:16877

Low + bits of Owner uid:0

Size in bytes:1024

Access time:1455741781

Creation time:1455741769

Modification time:1455741769

Deletion time:0

Low-bits of Group id:0

Links Count:4

Blocks Count:2

File flags:0

File version (for NFS): 0

File acl:0

Directory acl:0

Fragment address:0

Direct blocks:272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block:0

Double Indirect block:0

Triple Indirect block:0

File name | Inode number | Deleted status

Directory Block 272:

. 2

.. 2

Lost+found 11

Test 12

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/lo

loop/lost+found/

2.1 Search again for Inod 12 below file

[Email protected]/]#/usr/local/extundelete/bin/extundelete--inode 12/loop/disk _100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Contents of Inode 12:

0000 | Ed 5b db C4 b4 db C4 56 |. A...... [.. V... V

0010 | B4 db C4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ... V............

0020 | XX 0a f3 01 00 04 00 00 00 | ................

0030 | at xx xx, B7 0d 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | xx-7e B6 0d 00 00 00 00 00 00 | ..... 2) ~ .....

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is allocated

group:0

File mode:16877

Low + bits of Owner uid:0

Size in bytes:1024

Access time:1455741787

Creation time:1455741876

Modification time:1455741876

Deletion time:0

Low-bits of Group id:0

Links Count:2

Blocks Count:4

File flags:524288

File version (for NFS): 2116629141

File acl:3510

Directory acl:0

Fragment address:0

Direct blocks:127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0

Indirect block:0

Double Indirect block:0

Triple Indirect block:0

File name | Inode number | Deleted status

Directory Block 3511:

. 12

.. 2

Xaa Deleted

Xab Deleted

Xac Deleted

3. recovers files with Inode 12

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 12/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Writing Output to directory recovered_files/

Unable to restore inode [file.12]: No undeleted copies found in the journal.

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 13/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.13

[Email protected]/]#

[Email protected]/]#

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 14/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.14

[Email protected]/]#/usr/local/extundelete/bin/extundelete--restore-inode 15/l oop/disk_100m

warning:extended attributes is not restored.

Loading FileSystem metadata ... Groups loaded.

Loading Journal Descriptors ... Descriptors loaded.

Restored Inode to file recovered_files/file.15

[Email protected]/]#

[Email protected]/]#

[Email protected]/]#

[Email protected]/]# Mount-o loop/loop/disk_100m/mnt1/loop100m/

[Email protected]/]# ls/mnt1/loop100m/

Lost+found Test

4. View the recovered files:

[[email protected]/]# ls recovered_files/

file.13 file.14 file.15

Follow the information in the recovery process, rename the file back, according to the Orange text control:

Original file name-->> inod-->> file name after recovery

Xaa file.13

Xab file.14

Xac file.15

#mv FILE.13/TEST/XAA

#mv File.14/test/xab

#mv File.15/test/xac

Done

This article is from the "Sea of Boundless" blog, please be sure to keep this source http://plong.blog.51cto.com/3217127/1743705

Recover files that were mistakenly deleted using RM command in EXT4