Learn a little more (12)--use Extundelete to recover deleted files from Linux by mistake

Generally speaking, we should regularly back up the important files (such as the configuration file under/etc), so as to avoid accidental deletion of important files in abnormal state such as drunk hands. However, if the accident really happens, and we do not make a backup, then try to manually recover it, the file recovery software used here is extundelete .

1. re-mount the partition as read-only state:

This is the first step in recovering files and one of the most critical steps. If we mistakenly delete the file as /data/catalina.out , the/data directory is /dev/sdb5 mount point, because the write operation to the partition may cause us to recover the file failure, So to re-mount the partition as read-only:

[Email protected] ~]# Mount-o REMOUNT,RO/DEV/SDB5

The execution of this command is likely to have an error message, generally for information such as directory occupancy, as follows:

Mount:/data isbusy

At this point, use the fuser command to see which users of those processes are using the directory:

[Email protected] ~]# Fuser-mv/data

USER PID ACCESS COMMAND

/data:mysql 4345 F.C. Mysqld

It is not difficult to find out that the MYSQLD command uses this directory to end a process with the killall command without knowing how to turn off MySQL:

[Email protected] ~]# Killall mysqld

Then mount again to succeed:

[Email protected] ~]# Mount-o REMOUNT,RO/DEV/SDB5

Verify that the partition is not writable by creating a new file under the /data directory:

[Email protected] ~]# Touch/data/testfile.txt

Touch:cannottouch '/data/testfile.txt ': Read-only file system

The above information indicates that the/data directory has become read-only at this time.

2. Install extundelete:

Exundelete official website http://extundelete.sourceforge.net, download slower on the above, we use the following http: // NCHC.DL.SOURCEFORGE.NET/PROJECT/EXTUNDELETE/EXTUNDELETE/0.2.4/EXTUNDELETE-0.2.4.TAR.BZ2:

[Email protected] ~]# cd/usr/local/src[[email protected] src]# wget http://nchc.dl.sourceforge.net/project/ Extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2[[email protected] src]# tar jxf extundelete-0.2.4.tar.bz2[[ Email protected] src]# CD extundelete-0.2.4

The./configure process requires the use of the Gcc-c++ Library and the E2fsprogs-devel Library, which is installed using yum:

[email protected] ~]# Yum install-y gcc-c++ e2fsprogs-devel

after the library file installation is complete,./configure , make , makeinstall :

[Email protected] extundelete-0.2.4]#/configure--prefix=/usr/local/extundelete[[email protected] extundelete-0.2.4]# make && make install

3. Recover files using extundelete:

[Email protected] ~]# Cd/usr/local/extundelete

(1) to view the deletion status of files under the specified partition:

[Email protected] extundelete]#/BIN/EXTUNDELETE/DEV/SDB5--inode 2

File name | Inode number | Deleted status

. 2

.. 2

Lost+found 11

MySQL 49153

Catalina.out Deleted

. CATALINA.OUT.SWP Deleted

. CATALINA.OUT.SWX Deleted

wherecatalina.out is the file that we mistakenly deleted, and now its status is deleted, use the following command to recover the file:

[Email protected] extundelete]#/BIN/EXTUNDELETE/DEV/SDB5--restore-file catalina.out

Notice:extendedattributes is not restored.

Loadingfilesystem metadata ... Groups loaded.

Loading journaldescriptors ... 4735 descriptors loaded.

Block 796156 isallocated.

successfullyrestored file Catalina.out

The above information indicates that the file recovered successfully and the recovered file is located in the current directory. in Recovered_files:

[[email protected] extundelete]# ls recovered_files

Catalina.out

Note:

If you want to restore the files on the entire partition, use the following command:

[Email protected] extundelete]#/BIN/EXTUNDELETE/DEV/SDB5--restore-all

4. Closure of work:

Don't forget to be happy when you are successful, and remember to accidentally delete the file where the partition is still read-only and re-mount it as read-write:

[Email protected] ~]# Mount-o REMOUNT,RW/DEV/SDB5

Move the deleted files to the original location:

[Email protected] ~]# mv/usr/local/extundelete/recovered_files/catalina.out/data/

Finally, the lessons learned, do a good job of backup, as far as possible to avoid accidental deletion, because after the deletion can recover who is not sure, at the same time, the disk to do partition, if all in the / partition, want to restore more difficult.

Supplemental:fuser Command

This command shows which program is currently using a file on disk, a mount point, or even a network port, and gives detailed information about the program process. Common parameters:

-m Specifies the partition or mount point to view

-V lists details such as the user that the process belongs to, the process-related commands, and so on, if the parameter is not used, only the PID is listed

-U lists the users that the process belongs to

- K sends the KILL-9 signal to the end of the process associated with the current directory or mount point, using -signaln to specify additional semaphores, but when-signal and -K are used simultaneously, the former fails

If you want to see a process that uses a/DEV/SDB5 partition now, the partition's mount point is /data :

[Email protected] ~]# FUSER-MV/DEV/SD5//or [[email protected] ~]# Fuser-mv/data

This article is from the "barrel of fake dog excrement" blog, please be sure to keep this source http://xitongjiagoushi.blog.51cto.com/9975742/1649628

Learn a little more (12)--use Extundelete to recover deleted files from Linux by mistake