在linux系统中，相信都有误删文件的经历，rm -rf 可删除一切文件。当删除了一些重要数据，应该如何找回呢？
extundelete是一款强大的linux数据恢复工具，可恢复ext3和ext4文件系统中的文件。
误删文件后千万不要慌，第一件要做的事就是卸载分区或以只读方式重新挂载分区。
安装extundelete
# yum install gcc-c++ e2fsprogs-devel
# cd extundelete-0.2.4
# make
# make install
查看sdb1分区有哪些内容
# ls
wan wanyu xiaoming #wan为文件，wanyu和xiaoming为目录
模拟误删
# rm /back/* -rf
以只读方式重新挂载sdb1分区
# mount -o remount,ro /dev/sdb1
以当前分区第二个inode号开始查找被删除的文件
# extundelete --inode 2 /dev/sdb1
NOTICE:Extended attributes are not restored. Loading filesystem metadata ... 160 groupsloaded. Group: 0 Contents of inode 2: 0000 | ed 41 00 00 00 10 00 00 07 a7 a2 5531 a7 a2 55 | .A.........U1..U 0010 | 31 a7 a2 55 00 00 00 00 00 00 02 0008 00 00 00 | 1..U............ 0020 | 00 00 00 00 1f 00 00 00 21 24 00 0000 00 00 00 | ........!$...... 0030 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 0040 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 0050 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 0060 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 0070 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 0080 | 1c 00 00 00 fc 53 e0 b0 fc 53 e0 b05c e7 9e 3a | .....S...S..\..: 0090 | fc a2 a2 55 00 00 00 00 00 00 00 0000 00 00 00 | ...U............ 00a0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 00b0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 00c0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 00d0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 00e0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ 00f0 | 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 | ................ Inode is Allocated File mode: 16877 Low 16 bits of Owner Uid: 0 Size in bytes: 4096 Access time: 1436722951 Creation time: 1436722993 Modification time: 1436722993 Deletion Time: 0 Low 16 bits of Group Id: 0 Links count: 2 Blocks count: 8 File flags: 0 File version (for NFS): 0 File ACL: 0 Directory ACL: 0 Fragment address: 0 Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0,0, 0, 0, 0 Indirect block: 0 Double indirect block: 0 Triple indirect block: 0 File name | Inodenumber | Deleted status . 2 .. 2 wanyu 1048577 Deleted xiaoming 786433 Deleted wan 11 Deleted
恢复单个文件
# extundelete /dev/sdb1 --restore-file wan
# ls RECOVERED_FILES/
Wan
恢复单个目录
# extundelete /dev/sdb1 --restore-directory/wanyu
# ls RECOVERED_FILES/wanyu/
inittab wan xiaoming yu
恢复inode号对应的文件
# extundelete /dev/sdb1 --restore-inode 11
# ls RECOVERED_FILES/
file.11 wan wanyu
恢复res_file中显示的文件
# vim res_file
wan
# extundelete /dev/sdb1 --restore-files res_file
NOTICE: Extended attributes are notrestored. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER isset. The partition should be unmounted toundelete any files without further data loss. If the partition is not currently mounted,this message indicates it was improperly unmounted, and you shouldrun fsck before continuing. If you decide to continue, extundelete mayoverwrite some of the deleted files and make recovering those filesimpossible. You should unmount the file system and check it with fsck beforeusing extundelete. Would you like to continue? (y/n) y Loading filesystem metadata ... 160 groupsloaded. Loading journal descriptors ... 172descriptors loaded. Successfully restored file wan
恢复所有文件
# extundelete /dev/sdb1 --restore-all
