天天看點
傳回

誤删linux檔案恢複

Linux下檔案誤删除，使用extundelete恢複測試過程

extundelete下載下傳官網位址：https://pkgs.org/download/extundelete

  • 給虛拟主機添加一塊磁盤，磁盤為/dev/sdb 
[root@localhost bin]# cat /proc/scsi/scsi 
Attached devices:
Host: scsi2 Channel: 00 Id: 00 Lun: 00
  Vendor: VMware   Model: Virtual disk     Rev: 1.0 
  Type:   Direct-Access                    ANSI  SCSI revision: 02
Host: scsi1 Channel: 00 Id: 00 Lun: 00
  Vendor: NECVMWar Model: VMware IDE CDR10 Rev: 1.00
  Type:   CD-ROM                           ANSI  SCSI revision: 05
[root@localhost bin]# echo "scsi add-single-device 2 0 1 0">/proc/scsi/scsi
[root@localhost bin]# fdisk -l
[root@localhost bin]# fdisk /dev/sdb 
[root@localhost bin]# partprobe /dev/sdb
[root@localhost bin]# mkfs.xfs /dev/sdb1
[root@localhost bin]# mount /dev/sdb1 /mnt/
  • 執行誤操作： 
[root@localhost mnt]# ls
redis-4.0.11  redis-4.0.11.tar.gz
[root@localhost mnt]# rm -rf redis-4.0.11*
  • 将誤操作所在分區進行隻讀保護

如果确定檔案被誤删，在沒有備份的情況下請馬上對分區實施寫入保護（預防新的寫入覆寫誤删的塊資料，是以權限給隻讀）：

[root@localhost /]# mount -o remount,ro /dev/sdb1 
[root@localhost /]# mount -o remount,ro /mnt/
  • 安裝部署資料恢複工具extundelete

安裝依賴包

[root@localhost /]# yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
[root@localhost /]# cd /app/soft/
[root@localhost soft]# wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
[root@localhost soft]# tar -jxvf extundelete-0.2.4.tar.bz2
[root@localhost soft]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost extundelete-0.2.4]# make
make -s all-recursive
Making all in src
extundelete.cc: In function ‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’:
extundelete.cc:1272:29: warning: narrowing conversion of ‘search_flags’ from ‘int’ to ‘ext2_ino_t {aka unsigned int}’ inside { } [-Wnarrowing]
    buf, match_name2, priv, 0};
                             ^
[root@localhost extundelete-0.2.4]# make install
Making install in src
  /bin/install -c extundelete '/usr/local/bin'
[root@localhost extundelete-0.2.4]# extundelete -v
extundelete version 0.2.4
libext2fs version 1.42.9
Processor is little endian.
[root@localhost extundelete-0.2.4]# extundelete --help

其中，參數（options）有：

--version, -[vV]，顯示軟體版本号。

--help，顯示軟體幫助資訊。

--superblock，顯示超級塊資訊。

--journal，顯示日志資訊。

--after dtime，時間參數，表示在某段時間之後被删的檔案或目錄。

--before dtime，時間參數，表示在某段時間之前被删的檔案或目錄。

動作（action）有：

--inode ino，顯示節點“ino”的資訊。

--block blk，顯示資料塊“blk”的資訊。

--restore-inode ino[,ino,...]，恢複指令參數，表示恢複節點“ino”的檔案，恢複的檔案會自動放在目前目錄下的RESTORED_FILES檔案夾中，使用節點編号作為擴充名。

--restore-file 'path'，恢複指令參數，表示将恢複指定路徑的檔案，并把恢複的檔案放在目前目錄下的RECOVERED_FILES目錄中。

--restore-files 'path'，恢複指令參數，表示将恢複在路徑中已列出的所有檔案。

--restore-all，恢複指令參數，表示将嘗試恢複所有目錄和檔案。

-j journal，表示從已經命名的檔案中讀取擴充日志。

-b blocknumber，表示使用之前備份的超級塊來打開檔案系統，一般用于檢視現有超級塊是不是目前所要的檔案。

-B blocksize，通過指定資料塊大小來打開檔案系統，一般用于檢視已經知道大小的檔案。
  • 檔案恢複

原理：從根節點(inode=2)開始找到被删除檔案的i節點，然後recover i節點。 以下是模拟删除redis-4.0.11.tar.gz（檔案）和redis-4.0.11 （目錄）

[root@localhost extundelete-0.2.4]# extundelete /dev/sdb --inode 2
extundelete: Bad magic number in super-block when trying to open filesystem /dev/sdb
[root@localhost extundelete-0.2.4]# df -Th /dev/sdb1 
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/sdb1      xfs   100G  176K  100G   1% /mnt
[root@localhost extundelete-0.2.4]#

不支援xfs檔案格式的恢複，實驗中重新格式化成ext4格式測試。

[root@localhost /]# extundelete /dev/sdb1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 8a 33 0e 5c 3e 34 0e 5c | .A.......3.\>4.\
0010 | 3e 34 0e 5c 00 00 00 00 00 00 03 00 08 00 00 00 | >4.\............
0020 | 00 00 08 00 04 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 2e 24 00 00 | .............$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 24 de 02 30 24 de 02 30 24 0e 0b d4 | ....$..0$..0$...
0090 | a0 31 0e 5c 00 00 00 00 00 00 00 00 00 00 00 00 | .1.\............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1544434570
Creation time: 1544434750
Modification time: 1544434750
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9262, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
redis-4.0.11.tar.gz                               12             Deleted
redis-4.0.11                                      5505025        Deleted
[root@localhost /]#

恢複過程不要在誤删分區進行，謹防inode. block塊互相覆寫

恢複檔案（可根據檔案名進行恢複）：

[root@localhost /]# extundelete /dev/sdb1 --restore-file redis-4.0.11.tar.gz
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Successfully restored file redis-4.0.11.tar.gz
[root@localhost /]#            
[root@localhost /]# extundelete /dev/sdb1 --restore-directory redis-4.0.11
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Searching for recoverable inodes in directory redis-4.0.11 ... 
26 recoverable inodes found.
Looking through the directory structure for deleted files ... 
5 recoverable inodes still lost.
[root@localhost /]#            
[root@localhost /]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Searching for recoverable inodes in directory / ... 
26 recoverable inodes found.
Looking through the directory structure for deleted files ... 
1 recoverable inodes still lost.
[root@localhost /]#
extundelete Linux rm
上一篇: linux 誤删檔案恢複
下一篇: MongoDB誤删表恢複

繼續閱讀