EXT4中恢复使用rm命令误删除的文件
1. 需要准备的压缩包
[root@SYS-20140609-7-50 soft]# ll extundelete-0.2.0.tar.bz2
-rw-r--r-- 1 root root 97851 Jun 11 20:33 extundelete-0.2.0.tar.bz2
下载地址: http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2
2. 环境准备
2.1 查看操作系统版本
[root@SYS-20140609-7-50 soft]# lsb_release -a
LSB Version: :core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description: Red Hat Enterprise Linux Server release 6.2 (Santiago)
Release: 6.2 ###操作系统版本为6.2
Codename: Santiago
2.2 查看文件属性
[root@SYS-20140609-7-50 soft]# df -TP
Filesystem Type 1024-blocks Used Available Capacity Mounted on
/dev/mapper/VolGroup-lv_root ext4 2652784 1674164 843864 67% /
tmpfs tmpfs 1958768 0 1958768 0% /dev/shm
/dev/sda1 ext4 495844 36837 433407 8% /boot
/dev/sdb1 ext4 20635700 3692092 15895372 19% /data
此操作系统都是ext4的文件格式
3. 安装软件包
[root@SYS-20140609-7-50 soft]# ll extundelete-0.2.0.tar.bz2
-rw-r--r-- 1 root root 97851 Jun 11 20:33 extundelete-0.2.0.tar.bz2
3.1 解压
[root@SYS-20140609-7-50 soft]# tar jxvf extundelete-0.2.0.tar.bz2
3.2 进入目录
[root@SYS-20140609-7-50 soft]# cd extundelete-0.2.0
3.3 进入编译
3.3.1
[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure
Configuring extundelete 0.2.0
configure: error: C++ compiler cannot create executables ###如果出现这样的情况 ----yum -y install gcc*
See `config.log' for more details.
3.3.2
[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure
Configuring extundelete 0.2.0
configure: error: Can't find ext2fs library ####如果出现这样的情况
[root@SYS-20140609-7-50 extundelete-0.2.0]# rpm -qa | grep e2fsprogs
e2fsprogs-libs-1.41.12-11.el6.x86_64
e2fsprogs-1.41.12-11.el6.x86_64
这样需要再安装一下软件包
[root@SYS-20140609-7-50 extundelete-0.2.0]# yum -y install e2fsprogs*
再次查看e2fsprogs*
[root@SYS-20140609-7-50 extundelete-0.2.0]# rpm -qa | grep e2fsprogs
e2fsprogs-libs-1.41.12-11.el6.x86_64
e2fsprogs-1.41.12-11.el6.x86_64
e2fsprogs-devel-1.41.12-11.el6.x86_64
再次进行安装软件
[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure
Configuring extundelete 0.2.0
Writing generated files to disk #####现在说明是成功状态
[root@SYS-20140609-7-50 extundelete-0.2.0]# make
make -s all-recursive
Making all in src
[root@SYS-20140609-7-50 extundelete-0.2.0]# make install
Making install in src
/usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'
出现此步说明安装成功
4. 执行删除操作
4.1 查看磁盘分区
[root@SYS-20140609-7-50 extundelete-0.2.0]# df -lP
Filesystem 1024-blocks Used Available Capacity Mounted on
/dev/mapper/VolGroup-lv_root 2652784 1906628 611400 76% /
tmpfs 1958768 0 1958768 0% /dev/shm
/dev/sda1 495844 36837 433407 8% /boot
/dev/sdb1 20635700 3696120 15891344 19% /data ####打算用/data作为试验对像
4.2 删除12345.txt文件
[root@SYS-20140609-7-50 data]# vi 12345.txt
[root@SYS-20140609-7-50 data]# ls
4.3 查看文件内容
[root@SYS-20140609-7-50 data]# cat 12345.txt
dklfjadslkfjalskfjadlskfjdaksdfjlksdafjlaskdfjlksda
4.4 删除文件
12345.txt lost+found rhel6_2 Shell soft
[root@SYS-20140609-7-50 data]# rm -rf 12345.txt
5. 数据恢复
5.1 卸载需要恢复文件的分区
[root@SYS-20140609-7-50 extundelete-0.2.0]# df -lP <-- 查看磁盘空间
Filesystem 1024-blocks Used Available Capacity Mounted on
/dev/mapper/VolGroup-lv_root 2652784 1906628 611400 76% /
tmpfs 1958768 0 1958768 0% /dev/shm
/dev/sda1 495844 36837 433407 8% /boot
/dev/sdb1 20635700 3696120 15891344 19% /data
[root@SYS-20140609-7-50 ~]# fuser -k /data <-- 结束使用某分区的进程树
[root@SYS-20140609-7-50 ~]# umount /data <-- 卸载分区
5.2 使用extundelete查看分区上存在的文件
[root@SYS-20140609-7-50 ~]# extundelete --inode 2 /dev/sdb1 # --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 48 1e 99 53 b8 fd 98 53 | .A......H..S...S
0010 | b8 fd 98 53 00 00 00 00 00 00 06 00 08 00 00 00 | ...S............
0020 | 00 00 00 00 15 00 00 00 21 24 00 00 00 00 00 00 | ........!$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 00 00 00 00 00 00 00 00 11 10 00 00 00 00 00 00 | ................
0090 | 00 00 00 00 00 00 00 00 48 10 95 53 48 10 95 53 | ........H..SH..S
00a0 | 48 10 95 53 00 00 00 00 00 00 00 00 00 00 00 00 | H..S............
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1402543688
Creation time: 1402535352
Modification time: 1402535352
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 6
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
Directory block 9249:
. 2
.. 2
lost+found 11
rhel6_2 655361
soft 131073
Shell 1048577
.12345.txt.swp 12 Deleted ----为删除文件
12345.txt 13 Deleted ----为删除文件
5.3 现在进行恢复Deleted 12345.txt
[root@SYS-20140609-7-50 ~]# extundelete --restore-inode 13 /dev/sdb1 # --restore-inode 恢复指定的I节点文件，默认全将恢复
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Loading journal descriptors ... 2430 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Restored inode 13 to file RECOVERED_FILES/file.13
5.4 进入此RECOVERED_FILES目录查看
[root@SYS-20140609-7-50 RECOVERED_FILES]# ls
file.13 <---此文件就是被删除的文件
5.5 挂载目录，恢复文件
[root@SYS-20140609-7-50 RECOVERED_FILES]# mount /dev/sdb1 /data
[root@SYS-20140609-7-50 RECOVERED_FILES]# cd /data
[root@SYS-20140609-7-50 data]# ls
lost+found rhel6_2 Shell soft
[root@SYS-20140609-7-50 data]# cp /root/RECOVERED_FILES/file.13 ./12345.txt
[root@SYS-20140609-7-50 data]# ls
12345.txt lost+found rhel6_2 Shell soft
[root@SYS-20140609-7-50 data]# cat 12345.txt
dklfjadslkfjalskfjadlskfjdaksdfjlksdafjlaskdfjlksda <----恢复成功
[root@SYS-20140609-7-50 data]#
注：命令操作方法
number 1: 恢复一个文件
# extundelete /dev/sdd1 --restore-file del1.txt
number 2:恢复一个目录
# extundelete /dev/sdd1 --restore-directory /backupdate/deldate
number 3: 恢复一个磁盘上所有文件
# extundelete /dev/sdd1 --restore-all
