dev3 linux删除文件,extundelete工具恢复Linux删除文件

下载相应软件包

wget http://jaist.dl.sourceforge.net/project/e2fsprogs/e2fsprogs/1.41.14/e2fsprogs-1.41.14.tar.gz

wget http://jaist.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

wget http://jaist.dl.sourceforge.net/project/e2fsprogs/e2fsprogs/1.41.14/e2fsprogs-libs-1.41.14.tar.gz

安装顺序：e2fsprogs --> e2fsprogs-libs --> extundelete 逐一编译安装

tar xf e2fsprogs-1.41.14.tar.gz

cd e2fsprogs-1.41.14

./configure

make && make install

cd

tar -xf e2fsprogs-libs-1.41.14.tar.gz

cd e2fsprogs-libs-1.41.14

./configure

make && make install

cd ..

tar -xf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4

./configure

遇到下面的错误

centos configure: error: Can't find ext2fs library

解决办法：yum --y installe2fsprogs.x86_64e2fsprogs-devel.x86_64e2fsprogs-libs.x86_64

make && make install

模拟实验环境：新添加一块硬盘,重新启动系统，对其分区格式化成ext4，将其挂在到/backupdata目录上，建立测试文件和目录。

fdisk /dev/sdb

partprobe /dev/sdb

# mkfs.ext4 /dev/sdb1

# mkdir /backupdata/

# mount /dev/sdb1 /backupdata/

# mkdir /backupdata/gnutool-delete

# cd /backupdata/gnutool-delete

# man 7 man > file1.txt

# man 7 man > file2.txt

# mkdir folder; cd folder; man 7 man >file1.txt

# cd ../

#md5sum file* 获取文件校验码

06da9233bf8c0836e4d45e28dfb2b511 file1.txt

06da9233bf8c0836e4d45e28dfb2b511 file2.txt

# md5sum folder/file1.txt

06da9233bf8c0836e4d45e28dfb2b511 folder/file1.txt

# cd ../

删除测试文件或目录

[root@crushlinux backupdata]# rm -rf gnutool-delete/

将设备卸载或者改成只读,防止数据被覆盖使用

# cd ../

# umount /backupdata/

或者

# mount -o remount,ro /dev/sdb1

查询恢复数据信息，注意这里的--inode 2 这里会扫描分区 ：

[root@crushlinux /]# extundelete /dev/sdb1 --inode 2

NOTICE: Extended attributes are not restored.

File name | Inode number | Deleted status

. 2

.. 2

lost+found 11

gnutool-delete 12 Deleted

Deleted status标记为 Deleted 是已经删除的文件或目录

默认恢复到当前所在目录下的 RECOVERED_FILES 目录中去。准备一个可以读写的分区，注意不要再丢失数据的分区

1、恢复所有文件extundelete /dev/sdb1 �restore-all

[root@crushlinux /]# extundelete /dev/sdb1 --restore-all

NOTICE: Extended attributes are not restored.

Looking through the directory structure for deleted files ...

0 recoverable inodes still lost.

[root@crushlinux /]# cd RECOVERED_FILES/gnutool-delete/

[root@crushlinux gnutool-delete]# ls

file1.txt file2.txt folder

查看校验码与之前所得是否完全一致

[root@crushlinux gnutool-delete]# md5sum file*

06da9233bf8c0836e4d45e28dfb2b511 file1.txt

06da9233bf8c0836e4d45e28dfb2b511 file2.txt

[root@crushlinux gnutool-delete]# md5sum folder/file1.txt

06da9233bf8c0836e4d45e28dfb2b511 folder/file1.txt

2、恢复目录extundelete /dev/sdb1 ―-restore-directory /backupdata/gnutool-delete

[root@puppet backupdata]# mount

/dev/sdb1 on /backupdata type ext4 (rw)

[root@puppet backupdata]# mkdir 123

[root@puppet backupdata]# cd 123

[root@puppet 123]# touch 456 789

[root@puppet 123]# ll

总用量 0

-rw-r--r-- 1 root root 0 5月 7 23:40 456

-rw-r--r-- 1 root root 0 5月 7 23:40 789

[root@puppet backupdata]# ll

总用量 20

drwxr-xr-x 2 root root 4096 5月 7 23:40 123

drwx------ 2 root root 16384 5月 7 23:37 lost+found

[root@puppet backupdata]# rm -rf 123

[root@puppet backupdata]# cd ..

[root@puppet /]# umount /backupdata/

[root@puppet /]# extundelete /dev/sdb1 --inode 2

NOTICE: Extended attributes are not restored.

Triple indirect block: 0

File name | Inode number | Deleted status

. 2

.. 2

lost+found 11

123 12 Deleted

Deleted status标记为 Deleted 是已经删除的文件或目录

3、恢复文件extundelete /dev/sdb1 --restore-files /backupdata/gnutool-delete/file1.txt4、恢复多个文件创建一个空白文件，内容为要恢复的文件列表，一个文件一行

vim restore/backupdata/gnutool-delete/file1.txt/backupdata/gnutool-delete/file2.txt/backupdata/gnutool-delete/folder/file1.txtextundelete /dev/sdb1 ―-restore-files 'restore'5、根据时间恢复假如删除的时间大概是2014-05-04 14：30

[root@crushlinux ~]# date -d "may 04 14:30" +%s1399185000 得出秒数

恢复此时间后删除的所有文件/usr/local/bin/extundelete /dev/sdb1 --after 1399185000 --restore-all

6、根据文件的inode恢复extundelete /dev/sdb1 --restore-inode 77883

7、查看命令帮助extundelete --help

8、通过文件打开的PID和文件的句柄来恢复

环境描述：当前系统中有多个用户登录，其中一个用户对某个文件进行修改，另一个用户对文件执行了删除操作。例如通过cat命令往文件里输入内容[root@rhel6 ~]# cat >> /tmp/restorehellohihaha

而在另一个终端删除这个文件[root@rhel6 ~]# rm -rf /tmp/restore

解决方法：通过文件打开的PID和打开文件的句柄来恢复[root@rhel6 ~]# lsof |grep -i delete |grep restorecat       23308      root    1w      REG    8,5        1473 /tmp/restore (deleted)[root@rhel6 ~]# ls /proc/23308/fdfd/     fdinfo/ [root@rhel6 ~]# cd /proc/23308/fd[root@rhel6 fd]# ls0  1  2[root@rhel6 fd]# cp 1 /tmp/restore[root@rhel6 fd]# cat /tmp/restorehellohihaha

ok文件恢复了

应用总结：extundelete基于整个磁盘的恢复功能较为强大,基于目录和文件的恢复还不够完善。如果误删除了文件，记住对磁盘不要进行任何操作，保留好现场.