Linux-rhel6 recover deleted files by mistake

Requires tool Extundelete (can be downloaded to Linux via Xshell upload)

Knowledge Points:

Ifconifig eth0 View IP

FDISK/DEV/SDA Managing Disks

MKFS.EXT4/DEV/SDA4 format SDA4 partition to EXT4 file system partition

mount/dev/cdrom/mnt/Mount Optical Drive

Umount/dev/cdrom Uninstalling the optical drive

Df-th Viewing mount Information

echo $? Returns whether the last command succeeded

LS!$ View the parameters of the previous command

LS *2fs* filter View file

TAR-JXVF??. tar.bz2 extract File-j unzip bzip2 type-X unzip-v detail-F Specify file name

RPM-IVH??. RPM Installation-I installation-V detail information-H with units

Uname-m viewing the number of operating system bits

Diff 1.txt 2.txt Comparison file

md5sum 1.txt 2.txt Comparison file

Configure detection

Make compilation

Make install Installation

Extundelete/dev/??? --inode 2 Viewing recoverable files

Extundelete/dev/??? --restore-[inode/file/directory/all] Recover files


Preparatory work

[[Email protected] ~] #mount/dev/cdrom/mnt/# # #挂载光盘到mnt目录下

[[email protected] ~]# FDISK/DEV/SDA # # #fdsik for Disk Manager

Command (M for help):p # # # ' P ' to see partitioned partitions

Command (M for help): N # # # ' n ' creates a new partition

Command Action
E Extended #扩展分区
P primary partition (1-4) #主分区
P # # # ' P ' select Create Primary partition

First cylinder (1428-2610, default 1428): # # #选择从哪里开始分区, ' enter ' select default

Last cylinder, +cylinders or +size{k,m,g} (1428
-2610,default:2610): +1g # # #选择分区的大小或末位置, ' +1g ' out 1G


Command (M for help): W # # # ' W ' Save partition settings

[[Email protected] ~] #reboot # # #重启后生效

[[Email protected] ~] #mkdir/TMP/SDA4 # # #为新分区创建挂载点

[[Email protected] ~] #mkfs. EXT4/DEV/SDA4 # # #格式化sda4分区为ext4的文件系统分区

[[Email protected] ~] #mount/DEV/SDA4/TMP/SDA4 # # #挂载sda4分区

[[Email protected] ~] #df-th # # #查看挂载信息-T Display System file-H display size units

[[Email protected] ~] #echo $? # # #查看命令是否执行成功

[[Email protected] ~] #cd/TMP/SDA4 # # #进入sda4分区



deleting files

The following are the operations for manufacturing deleted files

[Email protected] sda4]# #cp/etc/passwd/tmp/sda4 # # #拷贝文件到sda4

[Email protected] sda4]# #touch/tmp/sda4/a.txt # # #创建文件

[Email protected] sda4]# #vim/tmp/sda4/a.txt # # #编辑文件

[[email protected] sda4]# #mkdir-P/aa/bb/cc # # #创建目录-P Create parent Directory

[Email protected] sda4]# #cp/tmp/sda4/a.txt/tmp/sda4/aa/

[Email protected] sda4]# #cp/tmp/sda4/a.txt/tmp/sda4/aa/bb

Start Delete

[Email protected] sda4]# #ls/tmp/sda4/# # #查看有哪些文件

[Email protected] sda4]# #mkdir/tmp/back # # #创建备份夹

[Email protected] sda4]# #mkdir/tmp/sda4/*/tmp/back/# # #备份

[[email protected] sda4]# #ls!$ # # # '!$ ' means the last parameter of last command is/tmp/back

[Email protected] sda4]# #rm-rf passwd a a.txt # # #删除文件

Note: Lost+found temporarily not clear its role, do not delete


Installation Tools

The deleted file can be recovered because the file is still in the hard disk, but the name is deleted.
But if there is another data area overlay that adds some additional files, then it won't recover, in order to avoid being overwritten
The first time after being deleted to unmount the partition

[[email protected] sda4] #cd # # #退出分区

[[Email protected] ~] #umount/DEV/SDA4 # # #卸载sda4

Note If you do not exit the partition, you cannot unmount the partition----stand on a bridge that is not detachable

Umount:/tmp/sda4:device is busy.
(In some cases useful info about processes
The device is found by lsof (8) or fuser (1))


[[Email protected] ~] #tar-jxvf soft/extundelete-0.2.4.tar.bz2 # # #解压-j Decompression bzip2 Type-X unzip-v details--F Specify file name

[Email protected] soft]# CD extundelete-0.2.4

[[email protected] extundelete-0.2.4]# LS # # #可以看到有configure的文件

[Email protected] extundelete-0.2.4]# Configure # # #检查环境

Configure:error:Can ' t find EXT2FS library///Missing EXT2FS environment repository

[Email protected] extundelete-0.2.4]# cd/mnt/packages/# # #打开光碟的安装包下载环境

[[email protected] packages]# ls ext2fs # # #没找到
LS: Unable to access ext2fs: No file or directory

[[email protected] packages]# ls *2fs* # # #缩小范围查找类似

[Email protected] packages]# Uname-m # # #查看操作系统位数

[[email protected] Packages] #rpm-ivh e2fsprogs-libs-1.41.12-12.el6.x86_64.rpm # # #安装-I Installation-v details-H with unit

Warning:e2fsprogs-libs-1.41.12-12.el6.x86_64.rpm:header V3 rsa/sha256 Signature, key ID Fd431d51:nokey
Preparing ... ########################################### [100%]
Package e2fsprogs-libs-1.41.12-12.el6.x86_64 is already installed

The above error indicates that the environment is already in place, this is just a lack of relevant development tools devel rather than libs

[[email protected] Packages] #rpm-IVH e2fsprogs-devel-1.41.12-12.el6.x86_64.rpm

Return to the previous folder when you are finished installing

[[email protected] Packages] #cd-

[Email protected] extundelete-0.2.4]#./configure # #检查安装环境

[email protected] extundelete-0.2.4]# make # #编译

[[email protected] extundelete-0.2.4]# make install # #安装


Start recovery

[Email protected] extundelete-0.2.4]# CD ~/test

[Email protected] test]# EXTUNDELETE/DEV/SDA4--inode 2

File name | Inode number | Deleted status
. 2
.. 2
Lost+found 11
Lookd.bat Deleted
Sleep.vbs Deleted
Variable.txt Deleted
Hosts Deleted
A.txt Deleted
AA 8193 Deleted

[Email protected] test]# extundelete/dev/sda4--restore-inode # #恢复lookd. bat to the current directory

[Email protected] test]# diff Recovered_files/file.12/tmp/back/lookd.bat # #对比备份文件是否一致

[Email protected] test]# extundelete/dev/sda4--restore-filenames hosts # #以文件名恢复

[Email protected] test]# extundelete/dev/sda4--restore-directory # #以目录恢复

[Email protected] test]# extundelete/dev/sda4--restore-all # #恢复全部

Linux-rhel6 recover deleted files by mistake