Linux Restore mistakenly delete files

System version: CentOS 6.5 package version: extundelete-0.2.4.tar.gz

Extundelete is a Linux-based data recovery tool that parses file system logs to parse the inode information of all files, thus recovering files that have been mistakenly deleted under the mainstream EXT3,EXT4 file system under Linux.

First, install the Extundelete tool

1. Unpacking the Package
650) this.width=650; "src=" http://s1.51cto.com/wyfs02/M01/7F/40/wKiom1cXbSrDXPi_AABhsp6bEAg198.jpg "title=" 1.jpg " alt= "Wkiom1cxbsrdxpi_aabhsp6beag198.jpg"/>

#注意: When the decompression will be error, need to install "E2fsprogs-devel" corresponding package 650) this.width=650; "Src=" http://s4.51cto.com/wyfs02/M02/7F/3E/ Wkiol1cxbvoda8hlaaaap6j_7s8193.jpg "title=" 2.jpg "alt=" Wkiol1cxbvoda8hlaaaap6j_7s8193.jpg "/>

2. Configuring the Installation

650) this.width=650; "src=" http://s2.51cto.com/wyfs02/M02/7F/40/wKiom1cXbrOTCae1AACD8XvbmTc594.jpg "title=" 3.jpg " alt= "Wkiom1cxbrotcae1aacd8xvbmtc594.jpg"/>

Second, prepare the test environment

1. Create a Test Catalog

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M00/7F/3E/wKioL1cXctCjlkgmAACJH72cVzQ336.jpg "title=" 4.jpg " alt= "Wkiol1cxctcjlkgmaacjh72cvzq336.jpg"/>

, create a "/data" mount point, Mount the/DEV/SDB1 partition to the directory

2. Add some test directories and their files in the "/data" directory

650) this.width=650; "src=" http://s1.51cto.com/wyfs02/M02/7F/3E/wKioL1cXdVGCJsF0AABb5W--1hw111.jpg "title=" 5.jpg " alt= "Wkiol1cxdvgcjsf0aabb5w--1hw111.jpg"/>

Note: An empty directory "B" is created here, and an empty file "file.txt" is available for later testing

3. deleting files and directories

650) this.width=650; "src=" http://s1.51cto.com/wyfs02/M01/7F/3E/wKioL1cXdhGyb_FHAAAkRwBfYGo010.jpg "title=" 6.jpg " alt= "Wkiol1cxdhgyb_fhaaakrwbfygo010.jpg"/>

Iii. Recovery of data

After the data has been mistakenly deleted, the first thing to do is to unload the partition of the deleted data, if the data of the root partition is mistakenly deleted, you need to enter the system into single user mode, and the root partition is mounted in read-only mode. This is because after a file is deleted, only the sector pointer in the Inode node of the file is zeroed out, the actual file is also stored on disk, if the disk continues to mount in read-write mode, the data blocks of these deleted files may be reassigned by the operating system, after these databases are overwritten by new data, The data is really lost and the recovery tool is powerless. So! mount a disk in read-only mode to minimize the risk of data being overwritten in the database to increase the success ratio of recovery data

1. Unmount the partition to be recovered or mount the partition read-only

650) this.width=650; "src=" http://s5.51cto.com/wyfs02/M00/7F/41/wKiom1cXdyKh03N_AAARX3tDksM217.jpg "style=" float: none; "title=" 7.jpg "alt=" Wkiom1cxdykh03n_aaarx3tdksm217.jpg "/>

650) this.width=650; "src=" http://s5.51cto.com/wyfs02/M01/7F/3E/wKioL1cXd-Tg0mk7AAAU8W3hL_0062.jpg "style=" float: none; "title=" 8.jpg "alt=" Wkiol1cxd-tg0mk7aaau8w3hl_0062.jpg "/>

Let's use the "extundelete" tool to view the partitions to be recovered 650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/7F/41/wKiom1cXiLqRvJwMAAAXKL34oMM428.jpg "title=" 9. JPG "alt=" wkiom1cxilqrvjwmaaaxkl34omm428.jpg "/>
650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/7F/3F/wKioL1cXiYrQ0v8oAAAlFhgYZBs697.jpg "title=" 10.jpg "alt=" Wkiol1cxiyrq0v8oaaalfhgyzbs697.jpg "/>

2. Recovering data

Method One: Restore through the inode

First create a directory "/data_rec" to hold the recovered data, and then enter the directory for recovery, the recovered data will be automatically generated in the directory "recovered_files" directory

650) this.width=650; "src=" http://s2.51cto.com/wyfs02/M02/7F/3E/wKioL1cXfY7zw6xqAACSRHBVeDg653.jpg "title=" 12.jpg "alt=" Wkiol1cxfy7zw6xqaacsrhbvedg653.jpg "/>

Compare the recovered data with the original data using the "diff" Command to see if the data in the file is consistent with the deletion, and if there is no hint that the content is exactly the same

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M02/7F/41/wKiom1cXfaDjOWpeAAAsKQAo-oY708.jpg "title=" 13.jpg "alt=" Wkiom1cxfadjowpeaaaskqao-oy708.jpg "/>

Method Two: Recover by file name

650) this.width=650; "src=" http://s2.51cto.com/wyfs02/M01/7F/3E/wKioL1cXf1ajVXgMAADBM2M2VvI656.jpg "title=" 14.jpg "alt=" Wkiol1cxf1ajvxgmaadbm2m2vvi656.jpg "/>

Method Three: Recover from a directory

650) this.width=650; "src=" http://s5.51cto.com/wyfs02/M01/7F/41/wKiom1cXf42Rv5M4AAC-fLnF1dw529.jpg "title=" 15.jpg "alt=" Wkiom1cxf42rv5m4aac-flnf1dw529.jpg "/>

Method Four: Recover All Files

650) this.width=650; "src=" http://s2.51cto.com/wyfs02/M01/7F/41/wKiom1cXhSPBisrvAADWMveSiAE105.jpg "title=" 17.jpg "alt=" Wkiom1cxhspbisrvaadwmvesiae105.jpg "/>

#注: After recovering all the data, we found that the empty directory "B" and the empty file "file.txt" were not created before, so it proves that the empty directory and its empty files cannot be recovered, and the "passwd" file shown here is deleted long ago, not the experimental file

Method Five: Restore to the current time by a specified time

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M01/7F/3F/wKioL1cXhozzkjUDAAE-LALPZwU713.jpg "title=" 16.jpg "alt=" Wkiol1cxhozzkjudaae-lalpzwu713.jpg "/>

#注: If you want to restore a time after the use of the "after" parameter

Production environment, or less use of the "RM" command as well, if you need to modify the relevant service profile, it is best to modify the configuration file after the backup before operation, so as not to cause unnecessary trouble

Linux Restore mistakenly delete files