Linux下面誤刪除檔案使用extundelete工具恢複介紹，linuxextundelete

Linux下面誤刪除檔案使用extundelete工具恢複介紹，linuxextundelete

作業系統版本：CentOS release 6.4 (Final)      軟體版本：extundelete-0.2.4.tar.bz2

1.使用rz命令上傳extundelete-0.2.4.tar.bz2到/tmp檔案夾下並解壓軟體。

[root@localhost tmp]# tar -jxvf extundelete-0.2.4.tar.bz2

2.進入到extundelete解壓的目錄下面，執行編譯安裝。

[root@localhost test]# cd /tmp[root@localhost tmp]# lsextundelete-0.2.4          lrzsz-0.12.20         pulse-0Wu68Rqve4hxextundelete-0.2.4.tar.bz2  lrzsz-0.12.20.tar.gz  virtual-root.b6Z0Gt[root@localhost tmp]# cd extundelete-0.2.4[root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4configure: error: Can't find ext2fs library   #根據提示找到ext2fs庫檔案進行安裝[root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4Writing generated files to disk

[root@localhost extundelete-0.2.4]# makemake -s all-recursiveMaking all in src[root@localhost extundelete-0.2.4]# make install Making install in src  /usr/bin/install -c extundelete '/usr/local/bin'

3.新添加一塊硬碟/dev/sdb1並劃分區格式化掛載到/test，建立檔案和目錄如下。

[root@localhost /]# tree test
test
├── 1.txt
├── a
│   ├── a.txt
│   └── b
│   ├── a.txt
│   └── c
│   ├── a.txt
│   └── d
├── a.txt
├── hosts
├── kong.txt
├── lost+found
└── passwd

5 directories, 8 files

4.進入到掛載目錄/test，然後刪除掛載點裡面的檔案並卸載磁碟。

[root@localhost /]# rm -rf a a.txt 1.txt hosts kong.txt passwd
[root@localhost /]# ls /test
lost+found
[root@localhost /]# umount /test

5.使用extundelete查看/dev/sdb1目錄和檔案的inode號。

[root@localhost ~]# extundelete /dev/sdb1 --inode 2NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 41 groups loaded.Group: 0Contents of inode 2:0000 | ed 41 00 00 00 10 00 00 f4 6e 9d 5a f2 6e 9d 5a | .A.......n.Z.n.Z0010 | f2 6e 9d 5a 00 00 00 00 00 00 03 00 08 00 00 00 | .n.Z............0020 | 00 00 00 00 00 00 00 00 39 03 00 00 00 00 00 00 | ........9.......0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0080 | 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0090 | bd 68 9d 5a 00 00 00 00 00 00 00 00 00 00 00 00 | .h.Z............00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................Inode is AllocatedFile mode: 16877Low 16 bits of Owner Uid: 0Size in bytes: 4096Access time: 1520266996Creation time: 1520266994Modification time: 1520266994Deletion Time: 0Low 16 bits of Group Id: 0Links count: 3Blocks count: 8File flags: 0File version (for NFS): 0File ACL: 0Directory ACL: 0Fragment address: 0Direct blocks: 825, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0Indirect block: 0Double indirect block: 0Triple indirect block: 0File name                                       | Inode number | Deleted status.                                                 2..                                                2lost+found                                        111.txt                                             12             Deleteda                                                 8017           Deletedhosts                                             13             Deletedpasswd                                            14             Deleteda.txt                                             15             Deletedkong.txt                                          16             Deleted

6.使用extundelete命令進行檔案和目錄的恢複。

(1)通過inode號恢複（檔案名稱會有變更）；

[root@localhost test]# extundelete /dev/sdb1 --restore-inode 12NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 41 groups loaded.Loading journal descriptors ... 101 descriptors loaded.[root@localhost test]# lsRECOVERED_FILES[root@localhost test]# cd RECOVERED_FILES/[root@localhost RECOVERED_FILES]# lsfile.12[root@localhost RECOVERED_FILES]# cat file.12 1111

(2)通過檔案名稱恢複；

[root@localhost RECOVERED_FILES]# extundelete /dev/sdb1 --restore-file passwdNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 41 groups loaded.Loading journal descriptors ... 101 descriptors loaded.Successfully restored file passwd[root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/[root@localhost RECOVERED_FILES]# cat passwdroot:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

(3)通過目錄名稱恢複(空目錄是不會被恢複的);

[root@localhost test]# extundelete /dev/sdb1 --restore-directory aNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 41 groups loaded.Loading journal descriptors ... 101 descriptors loaded.Searching for recoverable inodes in directory a ... 13 recoverable inodes found.Looking through the directory structure for deleted files ... 7 recoverable inodes still lost.[root@localhost test]# lsRECOVERED_FILES[root@localhost test]# cd RECOVERED_FILES/[root@localhost RECOVERED_FILES]# lsa[root@localhost RECOVERED_FILES]# tree aa├── a.txt└── b    ├── a.txt    └── c        └── a.txt2 directories, 3 files

(4)恢複所有檔案和目錄，不包括空檔案和空目錄；

[root@localhost test]# extundelete /dev/sdb1 --restore-allNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 41 groups loaded.Loading journal descriptors ... 101 descriptors loaded.Searching for recoverable inodes in directory / ... 13 recoverable inodes found.Looking through the directory structure for deleted files ... 1 recoverable inodes still lost.[root@localhost test]# lsRECOVERED_FILES[root@localhost test]# cd RECOVERED_FILES/[root@localhost RECOVERED_FILES]# ls1.txt  a  a.txt  hosts  kong.txt  passwd[root@localhost RECOVERED_FILES]# tree.├── 1.txt├── a│   ├── a.txt│   └── b│       ├── a.txt│       └── c│           └── a.txt├── a.txt├── hosts├── kong.txt└── passwd