yum install e2fsprogs-devel e2fsprogs e2fsprogs-libs
百度网盘链接:https://pan.baidu.com/s/1UNS3TJxmnSuDWeI1sgarLQ
提取码:d9sb
这里我是去到/usr/local目录下面创建了一个software的目录,将安装包通过WinSCP上传上去了
在/usr/local/software目录下解压安装包
tar -jxvf extundelete-0.2.4.tar.bz2
yum -y install gcc
yum -y install gcc-c++
cd extundelete-0.2.4
./configure
make
make install
which extundelete
cd /
mkdir /data
cd /data
touch deletefile
备份命令
xfsdump -f /tmp/dump_data /data
-> dump_data
-> media0
出现这个xfsdump: Dump Status: SUCCESS说明备份成功了
查看删除目录
/usr/local/bin/extundelete --inode 2 /dev/sda2
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata … 285 groups loaded.
Group: 0
Contents of inode 2:
0000 | 6d 41 00 00 00 10 00 00 e2 b2 6a 61 66 b2 6a 61 | mA…jaf.ja
0010 | 66 b2 6a 61 00 00 00 00 00 00 13 00 08 00 00 00 | f.ja…
0020 | 00 00 08 00 22 00 00 00 0a f3 01 00 04 00 00 00 | …"…
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 26 24 00 00 | …&$…
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0080 | 1c 00 00 00 d0 7f eb 7d d0 7f eb 7d 00 53 f7 34 | …}…}.S.4
0090 | a2 be 68 61 00 00 00 00 00 00 00 00 00 00 02 ea | …ha…
00a0 | 07 06 44 00 00 00 00 00 1c 00 00 00 00 00 00 00 | …D…
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux…
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
00e0 | 00 00 00 00 73 79 73 74 65 6d 5f 75 3a 6f 62 6a | …system_u:obj
00f0 | 65 63 74 5f 72 3a 72 6f 6f 74 5f 74 3a 73 30 00 | ect_r:root_t:s0.
Inode is Allocated
File mode: 16749
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1634382562
Creation time: 1634382438
Modification time: 1634382438
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 19
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9254, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
… 2
lost+found 11
boot 2097153
dev 1179649
proc 1835009
run 1966081
sys 131073
etc 1310721
root 1441793
tmp 262145
var 393217
data 1048577
usr 1572865
bin 17
sbin 16
lib 13
lib64 15
home 524289
media 1703937
mnt 655361
opt 786433
srv 917505
可以找到data 1048577
/usr/local/bin/extundelete --inode 1048577 /dev/sda2
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata … 285 groups loaded.
Group: 128
Contents of inode 1048577:
0000 | ed 41 00 00 00 10 00 00 98 b3 6a 61 88 b3 6a 61 | .A…ja…ja
0010 | 88 b3 6a 61 00 00 00 00 00 00 03 00 08 00 00 00 | …ja…
0020 | 00 00 08 00 06 00 00 00 0a f3 01 00 04 00 00 00 | …
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 20 20 40 00 | … @.
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0060 | 00 00 00 00 00 1c 85 44 00 00 00 00 00 00 00 00 | …D…
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
0080 | 1c 00 00 00 00 08 6b d0 00 08 6b d0 14 06 2c a7 | …k…k…,.
0090 | 66 b2 6a 61 d0 76 ae 7d 00 00 00 00 00 00 02 ea | f.ja.v.}…
00a0 | 07 06 3c 00 00 00 00 00 23 00 00 00 00 00 00 00 | …<…#…
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux…
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 75 6e 63 6f | …unco
00e0 | 6e 66 69 6e 65 64 5f 75 3a 6f 62 6a 65 63 74 5f | nfined_u:object_
00f0 | 72 3a 64 65 66 61 75 6c 74 5f 74 3a 73 30 00 00 | r:default_t:s0…
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1634382744
Creation time: 1634382728
Modification time: 1634382728
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 1149574144
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 4202528, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 1048577
… 2
deletefile 1048578 Deleted
delete 1048579 Deleted
RECOVERED_FILES 1048580
可以看到deletefile和delete这二个被我误删除文件的inode值列出来了
模拟删除/data目录内的所有内容
rm -rf /data/*
恢复文件命令
xfsrestore -f /tmp/dump_data /data
恢复data目录的命令:
/usr/local/bin/extundelete /dev/sda2 --restore-directory /data
如果出现以下情况:
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
//此处的信息是因为我在根目录下做实验,无法进行卸载导致的,这儿的大概意思是说 如果你要进行这个操作的话,最好吧分区卸载掉再进行恢复,否则如果不卸载的话,如果有写操作会吧原来的inode覆盖掉,如果你已经卸载了分区,还报这个错的话用fuser -k /PATH,之后再umount /PATH,请用这样的话会导致无法恢复,或者恢复不成功,笔者鉴于是测试服务器,并且是实验操作所以选Y,生产环境建议不要这么做。
y
Loading filesystem metadata … 285 groups loaded.
Loading journal descriptors … 25781 descriptors loaded.
Failed to restore file 1048579
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name | Inode number | Deleted status
/usr/local/bin/extundelete: Operation not permitted while restoring directory.
/usr/local/bin/extundelete: Operation not permitted when trying to examine filesystem
一般使用恢复所有删除的文件
sudo /usr/local/bin/extundelete /dev/sda2 --restore-all
为了做好运维面试路上的助攻手,特整理了上百道 【运维技术栈面试题集锦】 ,让你面试不慌心不跳,高薪offer怀里抱!
这次整理的面试题,小到shell、MySQL,大到K8s等云原生技术栈,不仅适合运维新人入行面试需要,还适用于想提升进阶跳槽加薪的运维朋友。
本份面试集锦涵盖了
- 174 道运维工程师面试题
- 128道k8s面试题
- 108道shell脚本面试题
- 200道Linux面试题
- 51道docker面试题
- 35道Jenkis面试题
- 78道MongoDB面试题
- 17道ansible面试题
- 60道dubbo面试题
- 53道kafka面试
- 18道mysql面试题
- 40道nginx面试题
- 77道redis面试题
- 28道zookeeper
总计 1000+ 道面试题, 内容 又全含金量又高
- 174道运维工程师面试题
1、什么是运维?
2、在工作中,运维人员经常需要跟运营人员打交道,请问运营人员是做什么工作的?
3、现在给你三百台服务器,你怎么对他们进行管理?
4、简述raid0 raid1raid5二种工作模式的工作原理及特点
5、LVS、Nginx、HAproxy有什么区别?工作中你怎么选择?
6、Squid、Varinsh和Nginx有什么区别,工作中你怎么选择?
7、Tomcat和Resin有什么区别,工作中你怎么选择?
8、什么是中间件?什么是jdk?
9、讲述一下Tomcat8005、8009、8080三个端口的含义?
10、什么叫CDN?
11、什么叫网站灰度发布?
12、简述DNS进行域名解析的过程?
13、RabbitMQ是什么东西?
14、讲一下Keepalived的工作原理?
15、讲述一下LVS三种模式的工作过程?
16、mysql的innodb如何定位锁问题,mysql如何减少主从复制延迟?
53道kafka面试
- 18道mysql面试题
- 40道nginx面试题
- 77道redis面试题
- 28道zookeeper
总计 1000+ 道面试题, 内容 又全含金量又高
- 174道运维工程师面试题
1、什么是运维?
2、在工作中,运维人员经常需要跟运营人员打交道,请问运营人员是做什么工作的?
3、现在给你三百台服务器,你怎么对他们进行管理?
4、简述raid0 raid1raid5二种工作模式的工作原理及特点
5、LVS、Nginx、HAproxy有什么区别?工作中你怎么选择?
6、Squid、Varinsh和Nginx有什么区别,工作中你怎么选择?
7、Tomcat和Resin有什么区别,工作中你怎么选择?
8、什么是中间件?什么是jdk?
9、讲述一下Tomcat8005、8009、8080三个端口的含义?
10、什么叫CDN?
11、什么叫网站灰度发布?
12、简述DNS进行域名解析的过程?
13、RabbitMQ是什么东西?
14、讲一下Keepalived的工作原理?
15、讲述一下LVS三种模式的工作过程?
16、mysql的innodb如何定位锁问题,mysql如何减少主从复制延迟?
17、如何重置mysql root密码?