阅读排行

EXT4中恢复使用rm命令误删除的文件

工具：extundelete

关于ext4 文件系统的知识：http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/

一、安装

#  wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2
 # tar -xvf extundelete-0.2.0.tar.bz2
 #  cd extundelete-0.2.0
 #  mkdir /usr/local/extundelete
 #  ./configure --prefix=/usr/local/extundelete
[root@paylm-164 extundelete-0.2.0]# ./configure --prefix=/usr/local/extundelete
Configuring extundelete 0.2.0
configure: error: C++ compiler cannot create executables
See `config.log‘ for more details.
 [root@paylm-164 extundelete-0.2.0]yum install gcc-c++.x86_64 //安装编译工具包
  [root@paylm-164 extundelete-0.2.0]./configure --prefix=/usr/local/extundelete
 [root@paylm-164 extundelete-0.2.0]  yum -y install e2fsprogs* # 如果提示找不到ext2fs库，使用 yum -y install e2fsprogs* 安装
 [root@paylm-164 extundelete-0.2.0] ./configure --prefix=/usr/local/extundelete
 [root@paylm-164 extundelete-0.2.0] make && make install
 [root@paylm-164 extundelete-0.2.0] make clean
 
 # 安装完成。
 
 
 下面挂载分区作为测试：

三、恢复被删除去的文件

1. 马上umount 要恢复的文件分区

# umount /mnt1/loop100M

2. 使用extundelete查看分区上存在的文件:

# --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 2 /loop/disk_ 100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 04 00 00 55 db c4 56 49 db c4 56 | .A......U..VI..V

0010 | 49 db c4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I..V............

0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 1024

Access time: 1455741781

Creation time: 1455741769

Modification time: 1455741769

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 4

Blocks count: 2

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name | Inode number | Deleted status

Directory block 272:

. 2

.. 2

lost+found 11

test 12

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 12 /lo

loop/ lost+found/

2.1 再次搜索inod 12下面的文件

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 12 /loop/disk _100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Contents of inode 12:

0000 | ed 41 00 00 00 04 00 00 5b db c4 56 b4 db c4 56 | .A......[..V...V

0010 | b4 db c4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ...V............

0020 | 00 00 08 00 07 00 00 00 0a f3 01 00 04 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 01 00 00 00 b7 0d 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 95 32 29 7e b6 0d 00 00 00 00 00 00 | .....2)~........

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 1024

Access time: 1455741787

Creation time: 1455741876

Modification time: 1455741876

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 4

File flags: 524288

File version (for NFS): 2116629141

File ACL: 3510

Directory ACL: 0

Fragment address: 0

Direct blocks: 127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name | Inode number | Deleted status

Directory block 3511:

. 12

.. 2

xaa 13 Deleted

xab 14 Deleted

xac 15 Deleted

3 . 恢复inode 为12的文件

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 12 /l oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Writing output to directory RECOVERED_FILES/

Unable to restore inode 12 (file.12): No undeleted copies found in the journal.

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 13 /l oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 13 to file RECOVERED_FILES/file.13

[root@paylm-164 /]#

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 14 /l oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 14 to file RECOVERED_FILES/file.14

[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 15 /l oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 15 to file RECOVERED_FILES/file.15

[root@paylm-164 /]#

[root@paylm-164 /]# mount -o loop /loop/disk_100M /mnt1/loop100M/

[root@paylm-164 /]# ls /mnt1/loop100M/

lost+found test

4. 查看恢复的文件：

[root@paylm-164 /]# ls RECOVERED_FILES/

file.13 file.14 file.15

跟据恢复过程中的信息，将文件重命名回来，根据橙色的文字对照:

原文件名 -->> inod -->> 恢复后文件名

xaa 13 file.13

xab 14 file.14

xac 15 file.15

#mv file.13 /test/xaa

#mv file.14 /test/xab

#mv file.15 /test/xac

done

本文出自 “海无涯” 博客，请务必保留此出处http://plong.blog.51cto.com/3217127/1743705

文章来自：http://plong.blog.51cto.com/3217127/1743705