Linux Restore misoperation Delete files

Overview

In the operation of Linux system operations, often encountered due to careless operations, operation errors and other causes of file data loss, especially for customers in the enterprise some novice. Of course, this refers to the total deletion, that is, can not be recovered through the "Recycle Bin" situation, such as the use of "RM-RF" to delete data for the Ext file system under Linux, the available recovery tools are Debugfs, Ext3grep, Extundelete and so on. In this post, for example, Extundelete is an open source Linux data Recovery tool that supports EXT3, EXT4 file systems

Why does the deleted data recover?

If you look up a file, first find the I node from the meta information, and then find the data in the block through the I node.

If you delete a file, just delete the filename, but the source file is not deleted, because the data in the source data block still exists, if you write data again, it is possible to overwrite the source data block, resulting in the inability to recover data, so at this point should stop everything, unload the Mount directory, proceed to prepare for recovery work.

System environment

Centos6.5 Operating System

Self-built Local.repo local Yum source, mounted under/MNT/SR0

Dependency Package: Rpm-ivh e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm

RPM-IVH libcom_err-devel-1.41.12-18.el6.x86_64.rpm

RPM-IVH e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm

SOURCE package: extundelete-0.2.4.tar.gz Baidu cloud download Password: Lrf2

Build steps

⑴ Install dependency Package e2fsprogs-libs, E2fsprogs-devel, where e2fsprogs-devel is dependent on libcom_err-devel

[Email protected] packages]# RPM-IVH e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm

[Email protected] packages]# RPM-IVH libcom_err-devel-1.41.12-18.el6.x86_64.rpm

[Email protected] packages]# RPM-IVH e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm

⑵ Installing the compiler

[Email protected] ~]# yum-y install gcc gcc-c++

⑶ unzip the source package and compile the installation

[Email protected] ~]# TAR-XVF extundelete-0.2.4.tar.gz-c/usr/src/#解压

[Email protected] extundelete-0.2.4]#./configure

[email protected] extundelete-0.2.4]# make #配置文件转换成二进制执行文件

[[email protected] extundelete-0.2.4]# make install #安装

⑷ mount, write test file

[Email protected] ~]# mount/dev/sdb1/mnt/sdb1/

[Email protected] ~]# cd/mnt/sdb1/

[[email protected] sdb1]# echo "This is a" > a.txt

[[email protected] sdb1]# echo "This is B" > B.txt

[[email protected] sdb1]# echo "This is C" > c.txt

[[email protected] sdb1]# echo "This is D" > D.txt

[[email protected] sdb1]# extundelete/dev/sdb1--inode * Start with the I-Node 2 directory, the first top-level directory, the root

⑸ deleting files, simulating tests

[Email protected] sdb1]# RM-RF a b #模拟误删除

[[Email protected] sdb1]# CD

[Email protected] ~]# UMOUNT/DEV/SDB1 #误删除之后立即卸载, it is important to be able to operate on the partition now!!!!!

[[email protected] ~]# extundelete/dev/sdb1--restore-all #针对/sdb1 partition, recover all deleted data

[[Email protected] ~]# CD recovered_files/The current directory has a recovered_files is the directory where the data is restored

⑹ cutting data into the source directory

[Email protected] recovered_files]# mount/dev/sdb1/mnt/sdb1/#重新挂载

[Email protected] recovered_files]# mv a B/MNT/SDB1

Linux Restore misoperation Delete files