經(jīng)過(guò)本人測(cè)試該工具支持ext3和ext4文件系統(tǒng)
當(dāng)發(fā)現(xiàn)某個(gè)分區(qū)的數(shù)據(jù)被誤刪除后驳规，要做的第一件事是立刻卸載被誤刪除文件所在的分區(qū)，或者重新以只讀方式掛載此分區(qū)艾君。
這么做的原因其實(shí)很簡(jiǎn)單：刪除一個(gè)文件采够，就是將文件inode節(jié)點(diǎn)中的扇區(qū)指針清除，同時(shí)冰垄，釋放這些數(shù)據(jù)對(duì)應(yīng)的數(shù)據(jù)塊蹬癌，而真實(shí)的文件還存留在磁盤(pán)分區(qū)中。但是這些被刪除的文件不一定會(huì)一直存留在磁盤(pán)中虹茶，當(dāng)這些釋放的數(shù)據(jù)塊被操作系統(tǒng)重新分配時(shí)逝薪，那些被刪除的數(shù)據(jù)就會(huì)被覆蓋。因此蝴罪，在數(shù)據(jù)誤刪除后董济，馬上卸載文件所在分區(qū)可以降低數(shù)據(jù)塊中數(shù)據(jù)被覆蓋的風(fēng)險(xiǎn)，進(jìn)而提高成功恢復(fù)數(shù)據(jù)的機(jī)率要门。
1. 創(chuàng)建文件系統(tǒng)
[root@zw_test_26_74 /]#? mkfs -t ext4 /dev/sdb3
2.查看文件系統(tǒng)類(lèi)型
[root@zw_test_26_74 /]# blkid /dev/sdb3? --查看文件系統(tǒng)類(lèi)型
/dev/sdb3: UUID="b786e8d1-e8ac-4681-ad3a-ff7a39c07146" TYPE="ext4"
也可以用下面方法查看
[root@zw_test_26_74 ~]# file -s /dev/sdb3
/dev/sdb3: Linux rev 1.0 ext4 filesystem data (extents) (huge files)
3.創(chuàng)建一個(gè)delete目錄虏肾，并掛載到剛創(chuàng)建的文件系統(tǒng)上，并創(chuàng)建文件欢搜，然后刪除文件
[root@zw_test_26_74 /]# mkdir delete
[root@zw_test_26_74 /]# mount /dev/sdb3 /delete
[root@zw_test_26_74 /]# cd /delete
[root@zw_test_26_74 delete]# ls
lost+found
[root@zw_test_26_74 delete]# vi zw.txt????? --添加一些內(nèi)容
[root@zw_test_26_74 delete]# rm -rf zw.txt
4.下載
extundelete 主頁(yè)：http://extundelete.sourceforge.net/
下載地址：http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2?? --0.2.4版本
[root@zw_test_26_74 /]# wget ?http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
[root@zw_test_26_74 /]# tar -xvf extundelete-0.2.4.tar.bz2
[root@zw_test_26_74 extundelete-0.2.4]# cd /extundelete-0.2.4
[root@zw_test_26_74 extundelete-0.2.4]# ./configure --prefix=/usr/local/extundelete? && make && make install
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library
這是因?yàn)閑xtundelete依賴e2fsprogs封豪。
[root@zw_test_26_74 extundelete-0.2.4]# yum -y install e2fsprogs? e2fsprogs-devel
安裝e2fsprogs后再次configure 成功。
[root@zw_test_26_74 extundelete-0.2.4]# ./configure? --prefix=/usr/local/extundelete? && make && make install
Configuring extundelete 0.2.4
Writing generated files to disk
make -s all-recursive
Making all in src
Making install in src
/usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'
5.查看工具版本
[root@zw_test_26_74 /]# cd /usr/local/extundelete/bin
[root@zw_test_26_74 bin]# ./extundelete -v
extundelete version 0.2.4
libext2fs version 1.41.12
Processor is little endian.
6.卸載分區(qū)炒瘟，注意如果是/ 根目錄的刪了吹埠，把磁盤(pán)掛載到其他機(jī)器做恢復(fù)
[root@zw_test_26_74 ~] fuser -k /delete???????? <-- 結(jié)束使用某分區(qū)的進(jìn)程樹(shù)
[root@www ~]# umount /delete??????????????????? <-- 卸載分區(qū)
[root@zw_test_26_74 ~]#? umount /dev/sdb3
7.使用extundelete查看分區(qū)上存在的文件
extundelete --inode 2 /dev/sdb2
# --inode 為查找某i節(jié)點(diǎn)中的內(nèi)容，使用2則說(shuō)明為搜索疮装，如果需要進(jìn)入目錄搜索缘琅，只須要指定目錄I節(jié)點(diǎn)即可
[root@zw_test_26_74 bin]#? extundelete --inode 2 /dev/sdb3
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 26 groups loaded.
Contents of inode 2:
0000 | ed 41 00 00 00 04 00 00 01 7b c6 56 05 7b c6 56 | .A.......{.V.{.V
0010 | 05 7b c6 56 00 00 00 00 00 00 03 00 02 00 00 00 | .{.V............
0020 | 00 00 00 00 20 00 00 00 e3 10 00 00 00 00 00 00 | .... ...........
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1455848193
Creation time: 1455848197
Modification time: 1455848197
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 2
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 4323, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name?????????????????????????????????????? | Inode number | Deleted status
Directory block 4323:
.???????????????????????????????????????????????? 2
..??????????????????????????????????????????????? 2
lost+found??????????????????????????????????????? 11
zw.txt???????????????????????????????????????????14???????????? Deleted
.zw.txt.swp?????????????????????????????????????? 13???????????? Deleted
zw.txt~?????????????????????????????????????????? 12???????????? Deleted
上面標(biāo)記為deleted的,zw.txt 就是我誤刪的數(shù)據(jù)
8. 恢復(fù)：
root@zw_test_26_74 bin]# extundelete --restore-all? /dev/sdb3
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 26 groups loaded.
Loading journal descriptors ... 47 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ...
1 recoverable inodes found.
Looking through the directory structure for deleted files ...
Restored inode 14 to file RECOVERED_FILES/zw.txt
0 recoverable inodes still lost.
[root@zw_test_26_74 bin]# ll
total 1164
-rwxr-xr-x 1 root root 1187047 Feb 19 10:10 extundelete
drwxr-xr-x 2 root root??? 4096 Feb 19 11:20 RECOVERED_FILES
[root@zw_test_26_74 bin]# cd RECOVERED_FILES/
[root@zw_test_26_74 RECOVERED_FILES]# ll
total 4
-rw-r--r-- 1 root root 150 Feb 19 11:20zw.txt
可以看到zw.txt 已經(jīng)恢復(fù)到RECOVERED_FILES 目錄下了。
9.擴(kuò)展命令：
--restore-inode 12????????????? # --restore-inode 按指定的I節(jié)點(diǎn)恢復(fù)
--restore-file zw.txt?????????? # --restore-file 按指定的文件名恢復(fù)
--extundelete --restore-all???? # --restore-all? 是全部恢復(fù) 斩个，默認(rèn)全將恢復(fù)出來(lái)的文件放在當(dāng)前路徑 RECOVERED_FILES/ 目錄下胯杭，文件名為 file.I節(jié)點(diǎn)號(hào)
注意: RECOVERED_FILES目錄生成在當(dāng)前執(zhí)行命令的目錄下面啦！
轉(zhuǎn)載于:https://blog.51cto.com/sf1314/2055026
