恢複誤删除的檔案

1、安裝extundelete

[root@xuegod62 ~]# tar jxvf extundelete-0.2.4.tar.bz2

[root@xuegod62 ~]# cd extundelete-0.2.4

[root@xuegod62 extundelete-0.2.4]# ./configure

Configuring extundelete 0.2.4

configure: error: Can't find ext2fs library

解決辦法：

[root@xuegod62 extundelete-0.2.4]# uname -r

2.6.32-431.el6.x86_64

[root@xuegod62 extundelete-0.2.4]# rpm -ivh /mnt/Packages/e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm warning: /mnt/Packages/e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY

Preparing...                ########################################### [100%]

1:e2fsprogs-devel        ########################################### [100%]

Writing generated files to disk

You have new mail in /var/spool/mail/root

[root@xuegod62 extundelete-0.2.4]# make

make -s all-recursive

Making all in src

extundelete.cc:571: 警告：未使用的參數'flags'

[root@xuegod62 extundelete-0.2.4]# make install

Making install in src

/usr/bin/install -c extundelete '/usr/local/bin'

準備測試分區

[root@xuegod62 ~]# fdisk /dev/sda

WARNING: DOS-compatible mode is deprecated. It's strongly recommended to

switch off the mode (command 'c') and change display units to

sectors (command 'u').

Command (m for help): n

Command action

e   extended

p   primary partition (1-4)

p

Selected partition 4

First cylinder (1593-2610, default 1593):

Using default value 1593

Last cylinder, +cylinders or +size{K,M,G} (1593-2610, default 2610): +1G

Command (m for help): p

Disk /dev/sda: 21.5 GB, 21474836480 bytes

255 heads, 63 sectors/track, 2610 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x000299f9

Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *           1          26      204800   83  Linux

Partition 1 does not end on cylinder boundary.

/dev/sda2              26        1332    10485760   83  Linux

/dev/sda3            1332        1593     2097152   82  Linux swap / Solaris

/dev/sda4            1593        1724     1059294   83  Linux

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: 裝置或資源忙.

The kernel still uses the old table. The new table will be used at

the next reboot or after you run partprobe(8) or kpartx(8)

Syncing disks.

[root@xuegod62 ~]# reboot

[root@xuegod62 ~]# mkfs.ext4 /dev/sda4

[root@xuegod62 ~]# mkdir /sda4

[root@xuegod62 ~]# mount /dev/sda4 /sda4/

[root@xuegod62 ~]# df -h

Filesystem      Size  Used Avail Use% Mounted on

/dev/sda2       9.9G  3.6G  5.9G  38% /

tmpfs           936M   72K  936M   1% /dev/shm

/dev/sda1       194M   34M  151M  19% /boot

/dev/sr0        3.6G  3.6G     0 100% /mnt

/dev/sda4      1019M   34M  934M   4% /sda4

準備測試檔案

[root@xuegod62 ~]# cp /etc/passwd /sda4/

[root@xuegod62 ~]# cp /etc/hosts /sda4/

[root@xuegod62 ~]# mkdir -p /sda4/a/b/c

[root@xuegod62 ~]# cp /etc/passwd /sda4/a/

[root@xuegod62 ~]# touch /sda4/a/b/kong.txt

删除檔案

[root@xuegod62 ~]# cd /sda4/

[root@xuegod62 sda4]# ls

a  hosts  lost+found  passwd

[root@xuegod62 sda4]# rm -rf a hosts passwd

解除安裝要恢複的分區或者以隻讀的方式進行挂載

[root@xuegod62 ~]# umount /sda4/

恢複檔案

檢視要恢複分區的檔案删除狀态資訊

[root@xuegod62 ~]# extundelete /dev/sda4 --inode 2

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11

passwd                                            12             Deleted

hosts                                             13             Deleted

a                                                 7361           Deleted

方法一：通過inode進行恢複

[root@xuegod62 ~]# extundelete /dev/sda4 --restore-inode 12

[root@xuegod62 ~]# ls RECOVERED_FILES/

file.12

[root@xuegod62 ~]# diff /etc/passwd RECOVERED_FILES/file.12

方法二：通過檔案名進行恢複

[root@xuegod62 ~]# extundelete /dev/sda4 --restore-file passwd

方法三：通過目錄進行恢複

[root@xuegod62 ~]# extundelete /dev/sda4 --restore-directory a

方法四：恢複所有檔案