Linux文件误删恢复

一、需求研究

分析对比debugfs、testdisk 6.14、extundelete，对比各自官网介绍和操作说明本次决定研究extundelete对文件和目录的恢复操作。

二、项目内容

1、工具安装部署

官方网站是http://extundelete.sourceforge.net/ ，其目前的稳定版本是extundelete-0.2.4.

工具下载

wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

解压按装

依赖包

yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64

tar -jxvf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4

./configure

这时一般会报错；

Configuring extundelete 0.2.4
configure: error: in `/root/Desktop/extundelete-0.2.4':
configure: error: C++ compiler cannot create executables
See `config.log' for more details

经过查找知道需要安装gcc-c++包

yum -y install gcc gcc-c++

重新./configure显示
[root@localhost extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library

经过查找知道缺少e2fsprogs-devel，下面开始安装

yum -y install e2fsprogs-devel

再./configure出现，表示成功了；

[root@localhost extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
Writing generated files to disk

make && make install

验证安装结果

extundelete -v

前提：如果确定文件被误删，在没有备份的情况下请马上对分区实施写入保护，（预防新的写入覆盖误删的块数据）mount -o remount,ro /dev/sdb1或者直接umount /dev/sdb1/解挂载目录，df -h命令可以看出你的数据目录挂载在那个分区下（fdisk磁盘管理）

2、文件恢复操作过程

恢复指定文件：

extundelete /dev/sdb1 --inode 2

可能会报下面错误

/usr/local/extundelete/bin/extundelete: Bad magic number in super-block when trying to open filesystem /dev/sdb1

网上搜了下，lvm是有区别的，主要是lvm的设备名不是/dev/sda的形式了vgscan查看具体的卷名。最后发现我的卷名是/dev/vg_centosdesktop/lv_root。

原理：从根节点(inode=2)开始找到被删除文件的i节点，然后recover i节点。

以下操作模拟在/dev/sdb1 删除文件apache-tomcat-8.0.24.tar.gz 和目录tomcat-app1，

extundelete /dev/sdb1 --inode 2

NOTICE: Extended attributes are not restored.

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.

The partition should be unmounted to undelete any files without further data loss.

If the partition is not currently mounted, this message indicates

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible.  You should unmount the

file system and check it with fsck before using extundelete.

Would you like to continue? (y/n)

y

Loading filesystem metadata ... 4000 groups loaded.

Group: 0

Contents of inode 2:

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1482394360

Creation time: 1482394361

Modification time: 1482394361

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 3

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11

apache-tomcat-8.0.24.tar.gz                       13             Deleted

apache-tomcat-8.0.24                              30670849       Deleted

tomcat-app1                                       30670849       Deleted

关注红色信息

恢复命令（恢复过程不要在误删分区进行，谨防inode、block块相互覆盖）

extundelete /dev/sdb1 --restore-inode 13   根据inode信息进行文件恢复

extundelete /dev/sdb1 --restore-file apache-tomcat-8.0.24.tar.gz  根据文件名进行文件修复

修复后的文件存储在当前目录RECOVERED_FILES里面

ll RECOVERED_FILES/

-rw-r----- 1 root root 9106353 Dec 22 17:23 apache-tomcat-8.0.24.tar.gz

-rw-r----- 1 root root 9106353 Dec 22 17:23 file.13

3、目录恢复操作过程

extundelete /dev/sdb1 --restore-directory /tomcat-app1 根据目录名称恢复目录

NOTICE: Extended attributes are not restored.

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.

The partition should be unmounted to undelete any files without further data loss.

If the partition is not currently mounted, this message indicates

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible.  You should unmount the

file system and check it with fsck before using extundelete.

Would you like to continue? (y/n)

y

Loading filesystem metadata ... 4000 groups loaded.

Loading journal descriptors ... 1204 descriptors loaded.

Searching for recoverable inodes in directory /tomcat-app1 ...

2405 recoverable inodes found.

Looking through the directory structure for deleted files ...

ll RECOVERED_FILES/

-rw-r----- 1 root root 9106353 Dec 22 17:23 apache-tomcat-8.0.24.tar.gz

-rw-r----- 1 root root 9106353 Dec 22 17:23 file.13

drwxr-x--- 6 root root    4096 Dec 22 17:27 tomcat-app1   恢复成功

4.重新挂载磁盘目录或者reboot重启都是ok的。

三、项目结果

根据上面操作证明extundelete 工具可以实现对误删数据的恢复，而且操作简单。

总结：

1、使用rm一定要谨慎

2、磁盘按照功能进行分区是必要的

3、最少掌握一种数据恢复方式