centos rm檔案刪除恢複

標籤：centos   恢複   rm   extundelete   

系統是centos 6.5 x64位系統

rm檔案刪除之後，恢複比較麻煩。

可以使用extundelete進行恢複

目前最新版本是0.2.4

extundelete 首頁：http://extundelete.sourceforge.net/

下載軟體

wget http://fossies.org/linux/misc/extundelete-0.2.4.tar.gz

安裝組件

yum install -y e2fsprogs e2fsprogs-devel e2fsprogs-libs

安裝extundelete

tar zxvf extundelete-0.2.4.tar.gz -C /usr/src/

cd /usr/src/extundelete-0.2.4/

./configure

make

make install

恢複的時候，需要卸載分區。如果你需要的恢複的檔案在根分區，那麼需要在另外一台伺服器進行恢複。

所以我掛載了一個測試分區

[[email protected] ~]# df -hT

Filesystem                   Type   Size  Used Avail Use% Mounted on

/dev/mapper/VolGroup-lv_root ext4    29G  1.2G   26G   5% /

tmpfs                        tmpfs  246M     0  246M   0% /dev/shm

/dev/sda1                    ext4   485M   33M  427M   8% /boot

/dev/sdb1                    ext4  1008M   18M  940M   2% /test

寫入檔案，內容是111

[[email protected] ~]# vi /test/1.txt

刪除檔案

[[email protected] ~]# rm -rf /test/*

結束使用某分區的進程樹

[[email protected] ~]# fuser -k /test

卸載分區

[[email protected] ~]# umount /test/

使用extundelete查看分區上存在的檔案

--inode 為尋找某i節點中的內容，使用2則說明為搜尋，如果需要進入目錄搜尋，只須要指定目錄I節點即可

[[email protected] ~]# extundelete --inode 2 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 a9 bf 75 55 a8 bf 75 55 | .A........uU..uU

0010 | a8 bf 75 55 00 00 00 00 00 00 02 00 08 00 00 00 | ..uU............

0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........I.......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 28 6d b5 65 28 6d b5 65 78 80 59 bf | ....(m.e(m.ex.Y.

0090 | 6c bf 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | l.uU............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1433780137

Creation time: 1433780136

Modification time: 1433780136

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11             Deleted

.1.txt.swp                                        12             Deleted

1.txt                                             13             Deleted

從以上資訊，可以看出，需要恢複的檔案1.txt的I節點為13

恢複檔案

--restore-inode 恢複指定的I節點檔案，預設全將恢複出來的檔案放在當前路徑 RECOVERED_FILES/ 目錄下，檔案名稱為 file.I節點號

[[email protected] ~]# extundelete --restore-inode 13 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Loading journal descriptors ... 23 descriptors loaded.

查看目錄是否有檔案

[[email protected] ~]# ll RECOVERED_FILES/

total 4

-rw-r--r-- 1 root root 4 Jun  9 00:33 file.13

查看檔案內容

[[email protected] ~]# cat RECOVERED_FILES/file.13

111

重新掛載分區，恢複檔案，查看檔案內容

[[email protected] ~]# mount /dev/sdb1 /test/

[[email protected] ~]# mv RECOVERED_FILES/file.13 /test/1.txt

[[email protected] ~]# cat /test/1.txt

111

本文出自 “隕落星空” 部落格，請務必保留此出處http://xiao987334176.blog.51cto.com/2202382/1659746

centos rm檔案刪除恢複