Recover files mistakenly deleted from Linux Delete files and folders RM-RF file name or directory name -R Recursive Delete (can delete things in directory and directory) -F forcibly removed EXT4 file system to delete files can be restored: extundelete Windows recover deleted files by mistake: Final data v2.0 and Easyrecovery The Linux file system consists of three parts: file name, Inode,block A.txt-->inode, block The file name contains the metadata information that actually holds the data
To view the inode number: Common sense: Each file has at least one inode number. [Email protected] ~]# ls-i a.txt 393788 A.txt View the file attributes in the Inode; To view what is included in the Inode through the Stat command [Email protected] ~]# stat a.txt #查看inode信息: File: ' A.txt ' size:1720 blocks:8 IO block:4096 Regular file device:802h/2050dinode:393788 links:1 Access: (0644/-rw-r--r--) Uid: (0/root) Gid: (0/root) access:2015-10-25 10:21:07.368552471 +0800 modify:2015-10-25 10:21:02.773527478 +0800 change:2015-10-25 10:21:02.773527478 +0800 Block blocks: Where data is actually stored Block 2M Data 101M
Why is deletion faster than replication?
Create
Delete
How to avoid accidental deletion of the contents of the file is overwritten??? To unmount a partition that requires recovery of a file: or to mount it in a read-only manner Combat: Recover deleted files on RHEL6 Download Extundelete http://sourceforge.net/Open source Software Release Center To prepare the test partition: [Email protected]/]# FDISK/DEV/SDB1 #创建一个sdb1分区 [Email protected] ~]# partx-a/DEV/SDA #获得新分区表
Format the Ext4 file system
Mount Copy some of the test files and then delete the files: [Email protected] ~]# CP/ETC/PASSWD/SDB1 [Email protected] ~]# CP/ETC/HOSTS/SDB1 [[email protected] ~]# echo AAA > A.txt [Email protected] ~]# mkdir-p/sdb1/a/b/c [email protected] ~]# CP a.txt/sdb1/a/ [email protected] ~]# CP a.txt/sdb1/a/b/ [Email protected] ~]# Touch/sdb1/a/b/kong.txt Install the tree command: [[Email protected]~]# rpm-ivh/mnt/packages/tree-1.5.3-2.el6.x86_64.rpm [Email protected] ~]# TREE/SDB1 To delete a file: [Email protected] ~]# CD/SDB1 [[email protected] sdb1]# ls A hosts Lost+found passwd [Email protected] sdb1]# RM-RF a hosts passwd
How to avoid accidental deletion of the contents of the file is overwritten??? To unmount a partition that requires recovery of a file: or to mount it in a read-only manner
Upload Extundelete to Linux: Upload extundelete files from Windows to Linux, install Xmanager v4 or CRT [Email protected] ~]# rpm-ivh/mnt/packages/lrzsz-0.12.20-27.1.el6.x86_64.rpm After installation, there is the RZ command and SZ command RZ: Upload files from windows to Linux SZ: Upload files from Linux to Windows
Unzip and install the Extundelet [Email protected] extundelete-0.2.4]# tar jxvf extundelete-0.2.4.tar.bz2 [Email protected] ~]# CD extundelete-0.2.4 [[email protected] extundelete-0.2.4]# ls ACINCLUDE.M4 autogen.sh Configure Depcomp LICENSE makefile.in README ACLOCAL.M4 config.h.in configure.ac install-sh makefile.am missing src [Email protected] extundelete-0.2.4]#/configure #检查系统安装环境 Configuring Extundelete 0.2.4 Configure:error:Can ' t find ext2fs Library Solve: [[Email protected]]# rpm-ivh/mnt/packages/e2fsprogs-devel-1.41.12-11.el6.x86_64.rpm Warning:/mnt/packages/e2fsprogs-devel-1.41.12-11.el6.x86_64.rpm:header V3 rsa/sha256 Signature, key ID fd431d51: Nokey Preparing ... ########################################### [100%] 1:e2fsprogs-devel ########################################### [100%] [[email protected] extundelete-0.2.4]# make #编译 to compile the source code into an executable binary file. -j 4 compiles at the same time using the 4 process, increasing the compilation speed or compiling with the 4-core CPU at the same time. [[email protected] extundelete-0.2.4]# make install #安装
Start recovery: Method 1: Restore via Inode node Method Two: Restore by file name Method Three: Restore a directory, such as all files under directory A: Method Four: Recover all the files [Email protected] ~]# mkdir test #创建一个目录使用于存放恢复的数据 [Email protected] ~]# CD test/ To view the deleted file name through the Inode node: [Email protected] test]# EXTUNDELETE/DEV/SDB1--inode 2
Method 1: Restore via Inode node [Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-inode 12 [[email protected] test]# diff/etc/passwd recovered_files/file.12 # no output, same as description
Method Two, restore by file name [Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-file passwd Method Three: Restore a directory, such as all files under directory A: [Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-directory A [Email protected] test]# tree recovered_files/a/ ├──a.txt └──b └──a.txt
Method Four: Recover all the files [Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-all [Email protected] test]# tree recovered_files/ recovered_files/ ├──a │├──a.txt │└──b │└──a.txt ├──hosts └──passwd This is the data before the deletion: [Email protected] ~]# tree/tmp/sda4/ /tmp/sda4/ ├──a │├──a.txt │└──b │├──a.txt │├──c #空目录 │└──kong.txt #空文件 ├──hosts ├──lost+found └──passwd Can extundelete automatically create empty files and directories when recovering files? Answer: No. REHL7 XFS System is available Summarize: Method 1: Restore via Inode node Method Two: Restore by file name Method Three: Restore a directory, such as all files under directory A: Method Four: Recover all the files |