Linux command Line Delete file restore (Ubuntu) __linux

Under the Linux system, the command "RM-RF" can remove any data directly from the hard drive, without any hint, and Linux does not have the same function as Windows Recycle Bin, which means that the data cannot be recovered by conventional means after deletion. So use this command very carefully. When using the RM command, it is safer to put the command parameters behind, so that there is a reminder. In fact, there is a way, that will be deleted by the MV command to move to the system under the/tmp directory, and then write a script to perform regular cleanup operations, which can reduce the risk of accidentally deleting data to some extent.

In fact, the best way to ensure data security is to do backup, although the backup is not omnipotent, but no backup is absolutely not. Any data recovery tool has some limitations, can not guarantee the complete recovery of all the data, therefore, the backup as the core, the data Recovery tool as a support is the operational personnel must adhere to a guideline.

1, the restoration principle of extundelete

Before introducing the use of extundelete to recover data, briefly introduce the knowledge about the inode. Under Linux, you can view the Inode value of a file or directory through the "Ls-id" command, for example, to view the Inode value of the root directory, and enter:

Therefore, the inode value of the root directory is 2.

When you use Extundelete to recover files without relying on a particular file format, first extundelete will obtain information about all the files in the current file system, including existing and deleted files, through the file system's Inode information (typically 2 in the root directory). This information includes the filename and inode. Then, the inode information is used to query the block location of the inode, including direct blocks, indirect blocks and other information. Finally, the DD command is used to back up the information to recover the data file.

2. Installation Extundelete

Extundelete's official website is http://extundelete.sourceforge.net/, whose current stable version is extundelete-0.2.4. You need to install the e2fsprogs and e2fsprogs-libs two dependent packages before installing Extundelete. E2fsprogs and E2fsprogs-libs installation is very simple, do not introduce here. But the dependencies that need to be installed for Ubuntu systems are

Executive: #sudo apt-get install E2fslibs-dev

The above instructions only download and install extundelete-0.2.4, but also need to download extundelete-0.2.4.tar.bz2 on the official website.

Then install extundelete-0.2.4, as follows:

# tar JXVF extundelete-0.2.4.tar.bz2

# CD extundelete-0.2.4

#./configure

# make

# make Install

After the Extundelete is successfully installed, a extundelete executable file is generated in the system. The use of Extundelete is very simple, you can use the "Extundelete--help" to obtain this software usage.

The following is the process of retrieving the deleted file USB_CAMERA.C:

A, viewing file system types and partitions

My file system type is EXT3/EXT4 for Ext4,extundelete supported, while EXT3GREP only supports recovery of ext3 file system. The user file system is in the/dev/sdal root file system, and the RM file is also here.

B, implementation: # Extundelete--inode 2/dev/sda1

Among them,--inode 2 is to find the files in the current directory and the files that are being RM out. Start with the root directory.

The files I deleted are placed in the/win7files directory.

C, # Extundelete--inode 1438977/etv/sda1

The Win7files node number is 1438977,--inode1438977 is to view the files in the/win7file directory and the deleted files. Go down in turn until you find the USB_CAMERA.C node number. The execution code is as follows:

#extundelete--inode 2/dev/sda1 (the command has been executed in the previous step)

# Extundelete--inode 1438977/etv/sda1

# Extundelete--inode 1438977/dev/sda1

# Extundelete--inode 1453508/dev/sda1

# Extundelete--inode 1455584/dev/sda1

D, # Extundelete--restore-inode 1455587/dev/sda1

The setup.sh node number is 1455587,--restore-inode1455587 to restore this node file.

E, view recovery results

A recovered_files directory is generated under the root directory, and the recovered file is in that directory. file.1455587 The Lord is the USB_CAMERA.C to be restored. I restored the same file two times, where there was a file.1455587 and file.1455587.v1.