Introduction to the method of recovering the deleted files of ECS Linux by Cloud Server

Cloud Server ECS Linux, rm-rf means that once deleted files are irretrievable. However, if you do not have a file overwrite operation, you can first try to recover the file in a related way. This article gives a brief description of this.

Https://help.aliyun.com/knowledge_detail/41197.html?spm=5176.7841174.2.6.uqC1as

Try data recovery with Extundelete

Description

• The following is the CentOS 6.5 ext4 file system as an experimental environment with tools for Extundelete.
• During the actual online recovery process, do not install Extundelete to the disk where the files were mistakenly deleted, so there is a chance that the data that needs to be recovered will be completely overwritten. We recommend adding a disk to install Extundelete to this disk, and then do the following. This method is not suitable for deleting files in the system disk partition because subsequent operations to undelete files are performed on the Umount device partition.

1. Check the system dependency package.

If you do not have the above output information, please install it with yum.

2. Download and install the software.

wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2tar -jxvf extundelete-0.2.4.tar.bz2cd extundelete-0.2.4./configure && make && make install

Verify that the installation is successful.

3. Remove the zip file below/mnt navicatformysql.zip

4. View the files that were deleted.

1). The disk partition needs to be uninstalled before viewing

2). When a partition is typically mounted to a directory, the Inode value for this "root" directory is 2. To view all the files in the root directory, we look at this section of partition Inode 2 for execution:

2

The files that are marked as deleted are deleted.

5. Restore the files on the device.

The default deleted files are restored to the Recovered_files directory in the current directory.

6. Verify that the recovery is successful.

Upload the compressed package for verification.

The MD5 value is the same and the recovery succeeds.

Use tool Ext3grep to try to recover

The kit used here is ext3grep. The system must be installed by default on e2fsprogs-libs-1.39-23.el5e, 2fsprogs-devel-1.39-23.el5, e2fsprogs-1.39-23.el5 these software

[[Email protected] ~]# Rpm-qa|grep e2fsprogse2fsprogs-libs-1.39-23.el5e2fsprogs-devel-1.39-23.el5e2fsprogs-1.39-23.el5 [[email protected] ~]# ll ext3grep-0.10.2.tar.gz-rw-r--r--1 root root236364 Oct172011 ext3grep-0.10. 2.tar.gz[[email protected] ~]# tar zxvf ext3grep-0.10.2.tar.gz[[email  Protected] ~]# CD ext3grep-0.10.2[[email protected] ext3grep- 0.10.2]#./configure [Email  protected] Ext3grep-0.10. 2]# make && make install[[email protected] ~]# ll /usr/local/bintotal 2656-rwxr-xr-x 1 root root 2709704 Oct 15 04:46 Ext3grep//This sentence is the executable file             

Examples of operations:

[[Email protected] ~]# mkdir/data//ixdba/[[email protected] data]# dd If=/dev/zero of=data-disk bs=1m count=105[[email protected] data]# MKFS.EXT3 Data-disk//File system formatted as EXT3, enter Y[[email protected] data at the prompt that appears# Mount-o loop/data/data-disk/ixdba///mount [[email protected] data]# cp/etc/host*/ixdba///Go inside and put the file [[email protected] data]# cp/etc/passwd/ixdba/[[email protected] data]# cd/ixdba/[[email protected] data]# RM-RF *//create deleted action [[email protected] data]# Cd/data/[[email protected] data]# Ext3grep/data/data-disk--ls--inode 2//view lost files [[email protected] data]# Ext3grep/data/data-disk--restore-file passwd//Just restore passwd this file [[email protected] data]# Ext3grep/data/data-disk--restore-all//Recovery action, full recovery [[email protected] data]# Lsdata-disk Data-disk.ext3grep.stage1 data-disk.ext3grep.stage2 restored_files[[email protected] data]# ll restored_files///All recovered files are all stored in this folder, and all are found back total48-rw-r--r--1 root rootOct1506:host.conf-rw-r--r--1 root root187 Oct :hosts-rw-r--r-- 1 root root 161 Oct  :hosts.allow-rw-r--r-- 1 root Roo T 347 Oct  :hosts.denydrwx------ 2 root root 4096 Oct  :Lost+fou nd-rw-r--r-- 1 root root 1635 Oct  :passwd
                                           

Cloud Server ECS Linux Accidental Deletion File Recovery method Introduction