文件删除，需要进行恢复。 https://blog.csdn.net/weiguang1017/article/details/52239685
- lsof 文件刚刚被删除，想要恢复，先尝试lsof. #lsof |grep data.file1
cp /proc/xxx/xxx/xx /dir/data.file1
如果lsof不能看到文件，那么就需要使用恢复软件进行恢复。 要做的第一件事是立刻卸载被误删除文件所在的分区，或者重新以只读方式挂载此分区。 umount /dev/part 或 mount -o remount,ro /dev/part 删除一个文件，就是将文件inode(inode 是操作系统寻找文件的目录，起到索引作用) 节点中的扇区指针清除，同时，释放这些数据对应的数据块， 而真实的文件还存留在磁盘分区中。但是这些被删除的文件不一定会一直存留在磁盘中，当这些 释放的数据块被操作系统重新分配时，这些被删除的数据就会被覆盖。因此要立刻卸载分区。
-
ext3grep 该工具只能用于ext3文件系统，操作步骤不详细介绍. 1> unmount /dev/part 2> ext3grep /dev/part --ls --inode 2 ##列出可恢复文件信息 3>ext3grep /dev/part --restore-inode N 4>恢复到 RESTORED_FILES/ 更多命令查看 ext3grep --help
-
extundelete 该工具可以恢复ext3,ext4. http://extundelete.sourceforge.net/
1>fuser -k /dev/part && unmunt /dev/part 2>extundelete --inode 2 /dev/part 3>extundelete --restore-inode 13 /dev/part 4>恢复到 RECOVERD_FILES/
root@grid1 ~]# extundelete --help Usage: extundelete [options] [--] device-file Options: --version, -[vV] Print version and exit successfully. --help, Print this help and exit successfully. --superblock Print contents of superblock in addition to the rest. If no action is specified then this option is implied. --journal Show content of journal. --after dtime Only process entries deleted on or after 'dtime'. --before dtime Only process entries deleted before 'dtime'. Actions: --inode ino Show info on inode 'ino'. --block blk Show info on block 'blk'. --restore-inode ino[,ino,...] Restore the file(s) with known inode number 'ino'. The restored files are created in ./RECOVERED_FILES with their inode number as extension (ie, file.12345). --restore-file 'path' Will restore file 'path'. 'path' is relative to root of the partition and does not start with a '/' The restored file is created in the current directory as 'RECOVERED_FILES/path'. --restore-files 'path' Will restore files which are listed in the file 'path'. Each filename should be in the same format as an option to --restore-file, and there should be one per line. --restore-directory 'path' Will restore directory 'path'. 'path' is relative to the root directory of the file system. The restored directory is created in the output directory as 'path'. --restore-all Attempts to restore everything. -j journal Reads an external journal from the named file. -b blocknumber Uses the backup superblock at blocknumber when opening the file system. -B blocksize Uses blocksize as the block size when opening the file system. The number should be the number of bytes. --log 0 Make the program silent. --log filename Logs all messages to filename. --log D1=0,D2=filename Custom control of log messages with comma-separated Examples below: list of options. Dn must be one of info, warn, or --log info,error error. Omission of the '=name' results in messages --log warn=0 with the specified level to be logged to the console. --log error=filename If the parameter is '=0', logging for the specified level will be turned off. If the parameter is '=filename', messages with that level will be written to filename. -o directory Save the recovered files to the named directory. The restored files are created in a directory named 'RECOVERED_FILES/' by default.
看上面的命令就很容易理解，各个参数的作用。
5.note 1> 对于空文件，不会进行恢复 2> 可以恢复mysql表， 由于myisam是单独3个文件，恢复出来就能使用。 3> 建议innodb，设置innodb_file_per_table 为 ON，这样也就能恢复单表数据。 4> 从上面可以看出，恢复工具这能恢复分区，所以，建议为应用软件单独划区进行安装， 存放数据。
