Linux系统：第十三章：centos误删文件如何恢复文件数据

00f0 | 65 63 74 5f 72 3a 72 6f 6f 74 5f 74 3a 73 30 00 | ect_r:root_t:s0.

Inode is Allocated

File mode: 16749

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1634382562

Creation time: 1634382438

Modification time: 1634382438

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 19

Blocks count: 8

File flags: 524288

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 127754, 4, 0, 0, 1, 9254, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name | Inode number | Deleted status

. 2

… 2

lost+found 11

boot 2097153

dev 1179649

proc 1835009

run 1966081

sys 131073

etc 1310721

root 1441793

tmp 262145

var 393217

data 1048577

usr 1572865

bin 17

sbin 16

lib 13

lib64 15

home 524289

media 1703937

mnt 655361

opt 786433

srv 917505

可以找到data 1048577

/usr/local/bin/extundelete --inode 1048577 /dev/sda2

NOTICE: Extended attributes are not restored.

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.

The partition should be unmounted to undelete any files without further data loss.

If the partition is not currently mounted, this message indicates

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible. You should unmount the

file system and check it with fsck before using extundelete.

Would you like to continue? (y/n)

y

Loading filesystem metadata … 285 groups loaded.

Group: 128

Contents of inode 1048577:

0000 | ed 41 00 00 00 10 00 00 98 b3 6a 61 88 b3 6a 61 | .A…ja…ja

0010 | 88 b3 6a 61 00 00 00 00 00 00 03 00