Recover files mistakenly deleted from Linux
Delete files and folders
RM-RF file name or directory name
-R Recursive Delete (can delete things in directory and directory)
-F forcibly removed EXT4 file system to delete files can be restored: extundelete
Windows recover deleted files by mistake: Final data v2.0 and Easyrecovery The Linux file system consists of three parts: file name, Inode,block
A.txt-->inode, block
The file name contains the metadata information that actually holds the data
To view the inode number:
Common sense: Each file has at least one inode number.
[Email protected] ~]# ls-i a.txt
393788 A.txt View the file attributes in the Inode; To view what is included in the Inode through the Stat command
[Email protected] ~]# stat a.txt #查看inode信息:
File: ' A.txt '
size:1720 blocks:8 IO block:4096 Regular file
device:802h/2050dinode:393788 links:1
Access: (0644/-rw-r--r--) Uid: (0/root) Gid: (0/root)
access:2015-10-25 10:21:07.368552471 +0800
modify:2015-10-25 10:21:02.773527478 +0800
change:2015-10-25 10:21:02.773527478 +0800
Block blocks: Where data is actually stored
Block 2M Data 101M
Why is deletion faster than replication?
Create
Delete
How to avoid accidental deletion of the contents of the file is overwritten???
To unmount a partition that requires recovery of a file: or to mount it in a read-only manner Combat: Recover deleted files on RHEL6
Download Extundelete
http://sourceforge.net/Open source Software Release Center
To prepare the test partition:
[Email protected]/]# FDISK/DEV/SDB1 #创建一个sdb1分区
[Email protected] ~]# partx-a/DEV/SDA #获得新分区表
Format the Ext4 file system
Mount Copy some of the test files and then delete the files:
[Email protected] ~]# CP/ETC/PASSWD/SDB1
[Email protected] ~]# CP/ETC/HOSTS/SDB1
[[email protected] ~]# echo AAA > A.txt
[Email protected] ~]# mkdir-p/sdb1/a/b/c
[email protected] ~]# CP a.txt/sdb1/a/
[email protected] ~]# CP a.txt/sdb1/a/b/
[Email protected] ~]# Touch/sdb1/a/b/kong.txt Install the tree command:
[[Email protected]~]# rpm-ivh/mnt/packages/tree-1.5.3-2.el6.x86_64.rpm
[Email protected] ~]# TREE/SDB1
To delete a file:
[Email protected] ~]# CD/SDB1
[[email protected] sdb1]# ls
A hosts Lost+found passwd
[Email protected] sdb1]# RM-RF a hosts passwd
How to avoid accidental deletion of the contents of the file is overwritten???
To unmount a partition that requires recovery of a file: or to mount it in a read-only manner
Upload Extundelete to Linux:
Upload extundelete files from Windows to Linux, install Xmanager v4 or CRT
[Email protected] ~]# rpm-ivh/mnt/packages/lrzsz-0.12.20-27.1.el6.x86_64.rpm
After installation, there is the RZ command and SZ command
RZ: Upload files from windows to Linux
SZ: Upload files from Linux to Windows
Unzip and install the Extundelet
[Email protected] extundelete-0.2.4]# tar jxvf extundelete-0.2.4.tar.bz2 [Email protected] ~]# CD extundelete-0.2.4
[[email protected] extundelete-0.2.4]# ls
ACINCLUDE.M4 autogen.sh Configure Depcomp LICENSE makefile.in README
ACLOCAL.M4 config.h.in configure.ac install-sh makefile.am missing src
[Email protected] extundelete-0.2.4]#/configure #检查系统安装环境
Configuring Extundelete 0.2.4
Configure:error:Can ' t find ext2fs Library Solve:
[[Email protected]]# rpm-ivh/mnt/packages/e2fsprogs-devel-1.41.12-11.el6.x86_64.rpm
Warning:/mnt/packages/e2fsprogs-devel-1.41.12-11.el6.x86_64.rpm:header V3 rsa/sha256 Signature, key ID fd431d51: Nokey
Preparing ... ########################################### [100%]
1:e2fsprogs-devel ########################################### [100%] [[email protected] extundelete-0.2.4]# make #编译 to compile the source code into an executable binary file.
-j 4 compiles at the same time using the 4 process, increasing the compilation speed or compiling with the 4-core CPU at the same time.
[[email protected] extundelete-0.2.4]# make install #安装
Start recovery:
Method 1: Restore via Inode node
Method Two: Restore by file name
Method Three: Restore a directory, such as all files under directory A:
Method Four: Recover all the files [Email protected] ~]# mkdir test #创建一个目录使用于存放恢复的数据
[Email protected] ~]# CD test/
To view the deleted file name through the Inode node:
[Email protected] test]# EXTUNDELETE/DEV/SDB1--inode 2
Method 1: Restore via Inode node
[Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-inode 12
[[email protected] test]# diff/etc/passwd recovered_files/file.12 # no output, same as description
Method Two, restore by file name
[Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-file passwd
Method Three: Restore a directory, such as all files under directory A:
[Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-directory A
[Email protected] test]# tree recovered_files/a/
├──a.txt
└──b
└──a.txt
Method Four: Recover all the files
[Email protected] test]# EXTUNDELETE/DEV/SDB1--restore-all [Email protected] test]# tree recovered_files/
recovered_files/
├──a
│├──a.txt
│└──b
│└──a.txt
├──hosts
└──passwd This is the data before the deletion:
[Email protected] ~]# tree/tmp/sda4/
/tmp/sda4/
├──a
│├──a.txt
│└──b
│├──a.txt
│├──c #空目录
│└──kong.txt #空文件
├──hosts
├──lost+found
└──passwd Can extundelete automatically create empty files and directories when recovering files?
Answer: No.
REHL7 XFS System is available
Summarize:
Method 1: Restore via Inode node
Method Two: Restore by file name
Method Three: Restore a directory, such as all files under directory A:
Method Four: Recover all the files |
