Linux下面误删除文件使用extundelete工具恢复介绍

操作系统版本：CentOS release 6.4 (Final) 软件版本：extundelete-0.2.4.tar.bz2

PS:该软件恢复文件系统仅支持ext2/ext3/ext4

1.使用rz命令上传extundelete-0.2.4.tar.bz2到/tmp文件夹下并解压软件。

[root@localhost tmp]# tar -jxvf extundelete-0.2.4.tar.bz2

2.进入到extundelete解压的目录下面，执行编译安装。

[root@localhost test]# cd /tmp

[root@localhost tmp]# ls

extundelete-0.2.4          lrzsz-0.12.20         pulse-0Wu68Rqve4hx

extundelete-0.2.4.tar.bz2  lrzsz-0.12.20.tar.gz  virtual-root.b6Z0Gt

[root@localhost tmp]# cd extundelete-0.2.4

[root@localhost extundelete-0.2.4]# ./configure

Configuring extundelete 0.2.4

configure: error: Can't find ext2fs library   #根据提示找到ext2fs库文件进行安装,执行yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel

[root@localhost extundelete-0.2.4]# ./configure

Configuring extundelete 0.2.4

Writing generated files to disk

[root@localhost extundelete-0.2.4]# make

make -s all-recursive

Making all in src

[root@localhost extundelete-0.2.4]# make install

Making install in src

  /usr/bin/install -c extundelete '/usr/local/bin'

3.新添加一块硬盘/dev/sdb1并划分区格式化挂载到/test，新建文件和目录如下。

[root@localhost /]# tree test
test
├── 1.txt
├── a
│   ├── a.txt
│   └── b
│   ├── a.txt
│   └── c
│   ├── a.txt
│   └── d
├── a.txt
├── hosts
├── kong.txt
├── lost+found
└── passwd

5 directories, 8 files

4.进入到挂载目录/test，然后删除挂载点里面的文件并卸载磁盘。

[root@localhost /]# rm -rf a a.txt 1.txt hosts kong.txt passwd
[root@localhost /]# ls /test
lost+found
[root@localhost /]# umount /test

5.使用extundelete查看/dev/sdb1目录和文件的inode号。

[root@localhost ~]# extundelete /dev/sdb1 --inode 2

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 41 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 f4 6e 9d 5a f2 6e 9d 5a | .A.......n.Z.n.Z

0010 | f2 6e 9d 5a 00 00 00 00 00 00 03 00 08 00 00 00 | .n.Z............

0020 | 00 00 00 00 00 00 00 00 39 03 00 00 00 00 00 00 | ........9.......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0090 | bd 68 9d 5a 00 00 00 00 00 00 00 00 00 00 00 00 | .h.Z............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1520266996

Creation time: 1520266994

Modification time: 1520266994

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 3

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 825, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11

1.txt                                             12             Deleted

a                                                 8017           Deleted

hosts                                             13             Deleted

passwd                                            14             Deleted

a.txt                                             15             Deleted

kong.txt                                          16             Deleted

6.使用extundelete命令进行文件和目录的恢复。

(1)通过inode号恢复（文件名会有变更）；

[root@localhost test]# extundelete /dev/sdb1 --restore-inode 12

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 41 groups loaded.

Loading journal descriptors ... 101 descriptors loaded.

[root@localhost test]# ls

RECOVERED_FILES

[root@localhost test]# cd RECOVERED_FILES/

[root@localhost RECOVERED_FILES]# ls

file.12

[root@localhost RECOVERED_FILES]# cat file.12

1111

(2)通过文件名恢复；

[root@localhost RECOVERED_FILES]# extundelete /dev/sdb1 --restore-file passwd

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 41 groups loaded.

Loading journal descriptors ... 101 descriptors loaded.

Successfully restored file passwd

[root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/

[root@localhost RECOVERED_FILES]# cat passwd

root:x:0:0:root:/root:/bin/bash

bin:x:1:1:bin:/bin:/sbin/nologin

daemon:x:2:2:daemon:/sbin:/sbin/nologin

adm:x:3:4:adm:/var/adm:/sbin/nologin

lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin

sync:x:5:0:sync:/sbin:/bin/sync

shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

(3)通过目录名称恢复(空目录是不会被恢复的);

[root@localhost test]# extundelete /dev/sdb1 --restore-directory a

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 41 groups loaded.

Loading journal descriptors ... 101 descriptors loaded.

Searching for recoverable inodes in directory a ...

13 recoverable inodes found.

Looking through the directory structure for deleted files ...

7 recoverable inodes still lost.

[root@localhost test]# ls

RECOVERED_FILES

[root@localhost test]# cd RECOVERED_FILES/

[root@localhost RECOVERED_FILES]# ls

a

[root@localhost RECOVERED_FILES]# tree a

a

├── a.txt

└── b

    ├── a.txt

    └── c

        └── a.txt

2 directories, 3 files

(4)恢复所有文件和目录，不包括空文件和空目录；

[root@localhost test]# extundelete /dev/sdb1 --restore-all

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 41 groups loaded.

Loading journal descriptors ... 101 descriptors loaded.

Searching for recoverable inodes in directory / ...

13 recoverable inodes found.

Looking through the directory structure for deleted files ...

1 recoverable inodes still lost.

[root@localhost test]# ls

RECOVERED_FILES

[root@localhost test]# cd RECOVERED_FILES/

[root@localhost RECOVERED_FILES]# ls

1.txt  a  a.txt  hosts  kong.txt  passwd

[root@localhost RECOVERED_FILES]# tree

.

├── 1.txt

├── a

│   ├── a.txt

│   └── b

│       ├── a.txt

│       └── c

│           └── a.txt

├── a.txt

├── hosts

├── kong.txt

└── passwd

Linux下面误删除文件使用extundelete工具恢复介绍的更多相关文章

高性能Linux服务器第6章 ext3文件系统反删除利器ext3grep extundelete工具恢复rm -rf 误删除的文件
高性能Linux服务器第6章 ext3文件系统反删除利器ext3grep extundelete工具恢复rm -rf 误删除的文件只能用于ext3文件系统!!!!!!!高俊峰(高性能Linux ...
Linux修改profile文件改错了，恢复的方法
Linux修改profile文件改错了,恢复的方法在改profile的时候,改出问题了,除了cd以外的命令基本都不能用了,连vi都不能用了,上网查了下,用export PATH=/usr/bin:/u ...
centOS6.4 extundelete工具恢复rm -rf 删除的目录
PS:补充下,我在fedora 19上运行的时候遇到的一个问题: [root@localhost extundelete-]# ./configure Configuring extundelete ...
centOS6.4 extundelete工具恢复rm -rf 删除的目录[转]
原文:http://www.cnblogs.com/patf/p/3368765.html PS:补充下,我在fedora 19上运行的时候遇到的一个问题: 1 [root@localhost ext ...
java安全删除一个文件，防止工具恢复数据
解决移动端文件删除的安全问题:file.delect() Java 确保安全删除某个文件 http://outofmemory.cn/code-snippet/14222/Java-securit ...
linux命令行todo列表管理工具Taskwarrior介绍
Taskwarrior 是一款在命令行下使用的TODO列表管理工具,或者说任务管理工具,灵活,快速,高效. 安装在ubuntu 14.04 中,可从官方仓库安装task软件包 sudo apt-ge ...
linux下查看文件编码及修改编码介绍
1.在Vim中可以直接查看文件编码:set fileencoding即可显示文件编码格式.如果你只是想查看其它编码格式的文件或者想解决用Vim查看文件乱码的问题,那么你可以在~/.vimrc 文件中添 ...
Linux 文件内容查看工具介绍-cat,less,more,tail,head
Linux 文件内容查看工具介绍作者:北南南北来自:LinuxSir.Org摘要: 本文讲述几种常用文件内容的查看工具,比如cat.more.less.head.tail等,把这些工具最常用的参数. ...
linux tail 命令详解！Linux 文件内容查看工具介绍
转:http://blog.csdn.net/carzyer/article/details/4759593 1.cat 显示文件连接文件内容的工具: cat 是一个文本文件查看和连接工具.查看一个文 ...

随机推荐

spark 任务导致tmp目录过大
现象:hdp的集群没有配置spak的临时本地目录,默认在跑程序的时候会将中间过程的文件存放在本地的/tmp目录下如果跑的spark数据量过大,就会导致/tmp下文件过大,最终导致根分区被占满,系统崩 ...
深度学习笔记（十）Augmentation for small object detection（翻译）
一. abstract 这些年来,目标检测取得了令人瞩目的成就.尽管改进很大,但对于小目标和大目标的检测性能差异还是蛮大的.我们在 MS COCO 数据集上分析了如今一个比较先进的算法,Mask-RC ...
git远程相关
git remote add origin git仓库地址 // 添加了远程仓库 git remote remove origin // 移除远程仓库 git push -u origin maste ...
JavaWeb_(SSH论坛)_二、框架整合
基于SSH框架的小型论坛项目一.项目入门传送门二.框架整合传送门三.用户模块传送门四.页面显示传送门五.帖子模块传送门六.点赞模块传送门七.辅助模块传送门导入Jar包导 ...
R_Studio读取xls文件
百度经验传送门需要包xlsx 依赖包rjava 需要安装java编译环境在R Console中执行命令install.packages("rjava"),install.pa ...
python学习之路（15）
map/reduce Python内建了map()和reduce()函数. 如果你读过Google的那篇大名鼎鼎的论文“MapReduce: Simplified Data Processing on ...
CentOS 6.5上的Tomcat启动报错问题
最近在搭建虚拟机环境,装的是CentOSQL 6.5版本,然后装的OpenJDK1.7,在Apache下载了一个纯净的Tomcat放到虚拟机上启动报错了: 这里有两个错误: 1.第一个错误,APR的问 ...
消息队列rabbitmq/kafka
12.1 rabbitMQ 1. 你了解的消息队列 rabbitmq是一个消息代理,它接收和转发消息,可以理解为是生活的邮局.你可以将邮件放在邮箱里,你可以确定有邮递员会发送邮件给收件人.概括:rab ...
C++入门经典-例5.7-调用自定义函数交换两变量值，传入指针
1:代码如下: // 5.7.cpp : 定义控制台应用程序的入口点. // #include "stdafx.h" #include <iostream> using ...
Qt编写大数据大屏UI电子看板系统
前言目前大屏大数据可视化UI这块非常火,趁热也用Qt来实现一个,Qt这个一站式超大型GUI超市,没有什么他做不了的,大屏电子看板当然也不在话下,有了QSS和QPainter这两个无敌的工具组合,借用 ...

Linux下面误删除文件使用extundelete工具恢复介绍

Linux下面误删除文件使用extundelete工具恢复介绍的更多相关文章

随机推荐

热门专题