2021-05-12 14:32:11
Linux下使用extundelete恢復誤刪除檔案
2020-06-16 16:54:15
當發現某個分割區的資料被誤刪除後，要做的第一件事是立刻解除安裝被誤刪除檔案所在的分割區，或者重新以唯讀方式掛載此分割區。
這麼做的原因其實很簡單：刪除一個檔案，就是將檔案inode節點中的磁區指標清除，同時，釋放這些資料對應的資料塊，而真實的檔案還存留在磁碟分割區中。但是這些被刪除的檔案不一定會一直存留在磁碟中，當這些釋放的資料塊被作業系統重新分配時，那些被刪除的資料就會被覆蓋。因此，在資料誤刪除後，馬上解除安裝檔案所在分割區可以降低資料塊中資料被覆蓋的風險，進而提高成功恢復資料的機率。
作業系統版本：CentOS release 6.4 (Final) 軟體版本：extundelete-0.2.4.tar.bz2
1.使用rz命令上傳extundelete-0.2.4.tar.bz2到/tmp資料夾下並解壓軟體。
[root@localhost tmp]# tar -jxvf extundelete-0.2.4.tar.bz2
2.進入到extundelete解壓的目錄下面，執行編譯安裝。
[root@localhost test]# cd /tmp
[root@localhost tmp]# ls
extundelete-0.2.4 lrzsz-0.12.20 pulse-0Wu68Rqve4hx
extundelete-0.2.4.tar.bz2 lrzsz-0.12.20.tar.gz virtual-root.b6Z0Gt
[root@localhost tmp]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library #根據提示找到ext2fs庫檔案進行安裝
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost tmp]# ls
extundelete-0.2.4 lrzsz-0.12.20 pulse-0Wu68Rqve4hx
extundelete-0.2.4.tar.bz2 lrzsz-0.12.20.tar.gz virtual-root.b6Z0Gt
[root@localhost tmp]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library #根據提示找到ext2fs庫檔案進行安裝
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost extundelete-0.2.4]# make
make -s all-recursive
Making all in src
[root@localhost extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
make -s all-recursive
Making all in src
[root@localhost extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
3.新新增一塊硬碟/dev/sdb1並劃分割區格式化掛載到/test，新建檔案和目錄如下。
[root@localhost /]# tree test
test
├── 1.txt
├── a
│ ├── a.txt
│ └── b
│ ├── a.txt
│ └── c
│ ├── a.txt
│ └── d
├── a.txt
├── hosts
├── kong.txt
├── lost+found
└── passwd
5 directories, 8 files
4.進入到掛載目錄/test，然後刪除掛載點裡面的檔案並解除安裝磁碟。
[root@localhost /]# rm -rf a a.txt 1.txt hosts kong.txt passwd
[root@localhost /]# ls /test
lost+found
[root@localhost /]# umount /test
5.使用extundelete檢視/dev/sdb1目錄和檔案的inode號。
6.使用extundelete命令進行檔案和目錄的恢復。
(1)通過inode號恢復（檔名會有變更）；
[root@localhost test]# extundelete /dev/sdb1 --restore-inode 12
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
file.12
[root@localhost RECOVERED_FILES]# cat file.12
1111
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
file.12
[root@localhost RECOVERED_FILES]# cat file.12
1111
(2)通過檔名恢復；
[root@localhost RECOVERED_FILES]# extundelete /dev/sdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Successfully restored file passwd
[root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# cat passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Successfully restored file passwd
[root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# cat passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
(3)通過目錄名稱恢復(空目錄是不會被恢復的);
[root@localhost test]# extundelete /dev/sdb1 --restore-directory a
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Searching for recoverable inodes in directory a ...
13 recoverable inodes found.
Looking through the directory structure for deleted files ...
7 recoverable inodes still lost.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
a
[root@localhost RECOVERED_FILES]# tree a
a
├── a.txt
└── b
├── a.txt
└── c
└── a.txt
2 directories, 3 files
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Searching for recoverable inodes in directory a ...
13 recoverable inodes found.
Looking through the directory structure for deleted files ...
7 recoverable inodes still lost.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
a
[root@localhost RECOVERED_FILES]# tree a
a
├── a.txt
└── b
├── a.txt
└── c
└── a.txt
2 directories, 3 files
(4)恢復所有檔案和目錄，不包括空檔案和空目錄；
[root@localhost test]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Searching for recoverable inodes in directory / ...
13 recoverable inodes found.
Looking through the directory structure for deleted files ...
1 recoverable inodes still lost.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
1.txt a a.txt hosts kong.txt passwd
[root@localhost RECOVERED_FILES]# tree
.
├── 1.txt
├── a
│ ├── a.txt
│ └── b
│ ├── a.txt
│ └── c
│ └── a.txt
├── a.txt
├── hosts
├── kong.txt
└── passwd
本文永久更新連結地址：https://www.linuxidc.com/Linux/2018-03/151199.htm
相關文章