How to recover a Linux system by mis-deleting files

Reference http://wandiankafei.blog.51cto.com/10878910/1716201

Scenario 1) Now let me introduce you to using Extundelete to recover files (for rhel6. X-System Ext4)

Installation:

Download extundelete-0.2.4.tar.bz2 wget http://netassist.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/ EXTUNDELETE-0.2.4.TAR.BZ2TAR-JXVF extundelete-0.2.4.tar.bz2 CD extundelete-0.2.4./configure (This step appears in error, see below) yum Install e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm

Then execute again, success

Make && make install

Recovery:

EXTUNDELETE/DEV/SDA4--inode 2 (see the file you deleted)

To restore a single directory:

EXTUNDELETE/DEV/SDB1--restore-directory/mongodb # #mongodb是一个目录

Recover all deleted files:

EXTUNDELETE/DEV/SDB1--restore-all

Restore a single file:

EXTUNDELETE/DEV/SDB1--restore-file A.txt

Scenario 2) use Lsof to bring a mysterious feature to your own

Principle: Most information related to lsof is stored in a directory named after the PID of the process

If the/var/log/messages file is deleted due to misoperation, then the method to restore the/var/log/messages file

As follows:

First use lsof to see if there is currently a process open/var/logmessages file, as follows:

# lsof |grep/var/log/messages

Syslogd 1283 root 2w REG 3,3 5381017 1773647/var/log/messages (Deleted)

From the above information you can see that the PID 1283 (syslogd) Open file has a file descriptor of 2. You can also see/var/log

/messages has been marked for deletion.

Recovery:

Cat /PROC/1283/FD/2 >/var/log/messages Recovery Success

This method of recovering deleted files is useful for many applications, especially log files and databases.

This article is from the "Drifting Away" blog, make sure to keep this source http://825536458.blog.51cto.com/4417836/1878118

How to recover a Linux system by mis-deleting files