Install and use data recovery software extundelete in CentOS 6.5

Install and use data recovery software extundelete in CentOS 6.5

Install and use data recovery software extundelete in CentOS 6.5

I. Installation

(1) first extundelete software depends on e2fsprogs e2fsprogs-libs e2fsprogs-devel Software Package

(2) download extundelete, official website is http://extundelete.sourceforge.net/current stable version is extundelete-0.2.4

[Root @ local app] # tar jxvf extundelete-0.2.4.tar.bz2

[Root @ localapp] # cd extundelete-0.2.4

[Root @ localapp] #./configure result Writing generated files to disk

[Root @ localapp] # make result extundelete. cc: 571: Warning: Unused parameter 'flags'

[Root @ localapp] # make install

Result:/usr/bin/install-c extundelete '/usr/local/bin'

(3) unzip and install

(4) After the installation is complete, you can recover the data.

Ii. Practical Methods

(1) Command Format: extundelete [options' option '] [action 'COMMAND'] device-file' device file'

(2) extundelete-help

Parameters:

-- Version,-[vV] displays the Software version Number

-- Help: displays software help information.

-- Superblock: displays super block information

-- Journal: displays log information.

-- After dtime, a time parameter, indicating the files or directories deleted after a certain period of time

-- Before dtime, time parameter, indicates the file or directory that was deleted before a certain period of time.

Action:

-- Inode ino: displays node ino information.

-- Block blk: displays data block blk information.

-- Restore-inode ino [, ino,…] Recovery command parameter, indicating to restore the "ino" file of the node. The recovered file will automatically

Stored in the RESTORED_FILES folder in the current directory. Use the node number as the extension.

-- Restore-file 'path': restores the file in the specified path and places the recovered file in

Under the RECOVERED_FILES directory

-- Restore-files 'path'. The recovery command parameter indicates that all files listed in the path will be restored.

-- Restore-all: restore command parameters, indicating that all directories and files will be restored.

-J journal indicates reading extended logs from a named file

-B blocknumber indicates to use the previously backed up super to open the file system. It is generally used to view the existing super fast

Is it the current file?

-B blocksize: used to open the file system by setting the size of the data block. It is generally used to view the file with known size.

Iii. extundelete data recovery process

After the data is deleted by mistake, the first thing to do is to unmount the disk or disk partition where the deleted data is located. If the data in the root partition of the system is deleted by mistake, you need to enter the system into a single user, in addition, the root directory is mounted in read-only mode. The reason for this is that after deletion, only the sector pointer in the inode node of the file is cleared, and the actual file is stored on the disk, if the disk is mounted in read-only mode, the data blocks of these deleted files may be reassigned by the operating system. After these data blocks are overwritten by new data, the data is lost, and the recovery tool cannot be recovered.

(1) restore a single file using extundelete. Taking the ext4 file system environment as an example, I add a disk device as/dev/sdb4.

[Root @ local desktop] # mkdir/data

[Root @ local desktop] # mkfs. ext4/dev/sdb4

[Root @ local desktop] # mount/dev/sdb4/data/

[Root @ local desktop] # cp/etc/passwd/data/

[Root @ local data] # cp-r/root/app/extundelete-0.2.4/data/

[Root @ local data] # md5sum passwd

90a8c0bb0bea88d6ce2ab252bd55ecfc passwd

[Root @ local data] # rm-rf/data /*

(2) detach a disk partition

[Root @ local data] # cd

[Root @ local ~] # Umount/data/

(3) run the extundelete command to check the recoverable data information of the/dev/sdb4 partition. Generally, the inode value of the "root" directory is

2. When a partition is mounted to a directory, the inode value of the "root" directory is 2.

[Root @ local ~] # Extundelete/dev/sdb4 -- inode 2

.........

File name | Inode number | Deleted status

. 2

.. 2

Lost + found 11 Deleted

Passwd 12 Deleted

Extundelete-0.2.4 131073 Deleted

(4) restore a single file. The parameter for restoring a single file is -- restore-file. Note that

The file recovery path is specified, which is the relative path of the file. The relative path is relative to the original storage path.

If the storage path is/data/passwd, the parameter is directly followed by a pass. If the original path is/data/

Extundelete-0.2.4/config. h then write extundelete-0.2.4/config. h after the parameter.

[Root @ local ~] # Extundelete/dev/sdb4 -- restore-file passwd

NOTICE: Extended attributes are not restored.

Loading filesystem metadata... 40 groups loaded.

Loading journal descriptors... 52 descriptors loaded.

Successfully restored file passwd

[Root @ local ~] # Cd RECOVERED_FILES/

[Root @ local RECOVERED_FILES] # ls

Passwd

[Root @ local RECOVERED_FILES] # md5sum passwd

90a8c0bb0bea88d6ce2ab252bd55ecfc passwd

Restore a single directory through extundelete

(1) You can use the-restore-directory option to restore data in the specified directory and want to restore data under/data/extundelete-0.2.4.

[Root @ local extundelete-0.2.4] # extundelete/dev/sdb4 -- restore-directory extundelete-0.2.4

[Root @ local extundelete-0.2.4] # cd RECOVERED_FILES/

[Root @ local RECOVERED_FILES] # ls

Extundelete-0.2.4

[Root @ local RECOVERED_FILES] # du-sh extundelete-0.2.4/

4.8 M extundelete-0.2.4/

We can see that the directory extundelete-0.2.4 has been restored.

Restore all accidentally deleted data through extundelete

(1) When a large amount of data needs to be restored, one-by-one recovery is very cumbersome. In this case, you can use -- restore-all to restore all files or folders.

[Root @ local ~] # Cd/

[Root @ local/] # ls

App cgroup etc lib64 misc opt sbin sys var

Bin data home lost + found mnt proc selinux tmp

Boot dev lib media net root srv usr

[Root @ local/] # extundelete/dev/sdb4 -- restore-all

[Root @ local/] # ls

App cgroup etc lib64 misc opt root srv usr

Bin data home lost + found mnt proc sbin sys var

Boot dev lib media net RECOVERED_FILES selinux tmp

[Root @ local/] # cd RECOVERED_FILES/

[Root @ local RECOVERED_FILES] # ls

Extundelete-0.2.4 passwd

[Root @ local RECOVERED_FILES] # du-sh extundelete-0.2.4/

4.8 M extundelete-0.2.4/

Restore data for a certain period of time through extundelete

(1) When the deleted data volume is very large, a lot of data is useless. In this case, we need to restore the data for a short period of time,

Extundelete provides the -- after and -- before parameters.

First, assume that you have created extundelete-0.2.4.tar.bz2 in the/datapartition, delete the file, and then unload it.

To start data restoration within one hour, perform the following operations:

[Root @ local data] # cp/root/extundelete-0.2.4.tar.bz2/data/

[Root @ local data] # ls

Extundelete-0.2.4.tar.bz2

[Root @ local data] # date + % s

1447823133

[Root @ local data] # rm-extundelete-0.2.4.tar.bz2

[Root @ local data] # cd

[Root @ local ~] # Umount/data

[Root @ local ~] # Date + % s

1447823221

[Root @ local ~] # Cd/data/

[Root @ local data] # ls

[Root @ local data] # extundelete -- after 1447819621 -- restore-all/dev/sdb4

[Root @ local data] # ls

[Root @ local data] # cd RECOVERED_FILES/

[Root @ local RECOVERED_FILES] # ls

Extundelete-0.2.4.tar.bz2

Note: you can see that the deleted file has been restored. Note that the after parameter is followed by the total number of seconds. The start time is "00:00:00 UTC". You can use the date + % s command to change the current time. after converting to the total number of seconds, you need to use 1447823221 minus 60*60 = 3600 to restore the data one hour ago.

Extundelete in Linux