extundelete恢复备删除的文件

从http://sourceforge.net/projects/extundelete/获取次工具的安装包

安装

# rpm -qa|grep e2fsprogs
e2fsprogs-1.41.12-21.el6.x86_64
e2fsprogs-libs-1.41.12-21.el6.x86_64
e2fsprogs-devel-1.41.12-21.el6.x86_64

以上是需要ext2fs的lib库，安装如上包之后

# tar -jxvf extundelete-0.2.4.tar.bz2 && cd extundelete-0.2.4

# make && make isntall

使用

恢复原理简介

用inode定位标记为delete的文件，然后从inode中取出起始块的位置，并取出文件占用块的长度，从而之间从块中取出数据

那么我们首先需要去定位inode的位置

如何查看inode

使用ls -lia 目标目录

命令简介 l参数为了方便对应文件和inode关系，人性化的现实，i参数则为显示文件的inode，a参数为列出本目录下索引的文件，包括隐藏的

注意：如果是根目录要看自己的inode，那么就必须用a参数，因为在根目录下，它本身的名字叫".",如果不加a参数是列不出来的

为了让命令通用起来，所以在此中笔者建议用ls -lia,这样通用一些

例子：

# ls -lia /
总用量 114
       2 dr-xr-xr-x.  25 root   root      4096 6月   1 13:02 .
       2 dr-xr-xr-x.  25 root   root      4096 6月   1 13:02 ..
      13 -rw-r--r--    1 root   root         0 5月  28 13:49 .autofsck
      12 -rw-r--r--    1 root   root         0 1月  15 01:12 .autorelabel
34145281 dr-xr-xr-x.   2 root   root      4096 4月  30 14:58 bin
       2 dr-xr-xr-x.   5 root   root      1024 7月  15 2014 boot

此处略去N个字。。。。

如上可见 我的根目录（/）的inode为2

.autofsck 隐藏文件的inode为13

目录bin的inode为34145281

然后确定文件存放的硬盘

# df -h
文件系统          容量  已用  可用 已用%% 挂载点
/dev/sda4             1.3T  1.1T  166G  87% /
tmpfs                  16G     0   16G   0% /dev/shm
/dev/sda2             194M   25M  159M  14% /boot
/dev/sda1              10G  280K   10G   1% /boot/efi

用df 命令可以看到设备和挂载点，此处我的根分区的挂载数据块设备是/dev/sda4

注意，如果使用lvm卷的话应该如下所示

# df -h
文件系统          容量  已用  可用 已用%% 挂载点
/dev/mapper/VolGroup-lv_root
                       50G   30G   18G  64% /
tmpfs                 5.9G   72K  5.9G   1% /dev/shm
/dev/sda1             485M   37M  423M   8% /boot

那么它的挂载数据块设备就应该是/dev/mapper/VolGroup-lv_root，而不是sdXX。

确定了inode和块设备之后，正是开始使用extundelete

# /usr/local/extundelete/bin/extundelete --inode 2 /dev/sda4

NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)                                                                                        //此处的信息是因为我在根目录下做实验，无法进行卸载导致的，这儿的大概意思是说 如果你要进行这个操作的话，最好吧分区卸载掉再进行恢复，否则如果不卸载的话，如果有写操作会吧原来的inode覆盖掉，如果你已经卸载了分区，还报这个错的话用fuser -k /PATH，之后再umount /PATH，请用这样的话会导致无法恢复，或者恢复不成功，笔者鉴于是测试服务器，并且是实验操作所以选Y，生产环境建议不要这么做。
y
Loading filesystem metadata ... 10807 groups loaded.
Group: 0
Contents of inode 2:
0000 | 6d 41 00 00 00 10 00 00 cc e9 c4 53 4b e7 6b 55 | mA.........SK.kU
0010 | 4b e7 6b 55 00 00 00 00 00 00 19 00 08 00 00 00 | K.kU............
0020 | 00 00 00 00 2c 00 00 00 31 24 00 00 00 00 00 00 | ....,...1$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 ac 87 c7 b6 ac 87 c7 b6 80 10 cd cc | ................
0090 | 37 de c4 53 00 00 00 00 00 00 00 00 00 00 02 ea | 7..S............
00a0 | 07 06 44 00 00 00 00 00 1c 00 00 00 00 00 00 00 | ..D.............
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux.........
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 73 79 73 74 65 6d 5f 75 3a 6f 62 6a | ....system_u:obj
00f0 | 65 63 74 5f 72 3a 72 6f 6f 74 5f 74 3a 73 30 00 | ect_r:root_t:s0.

Inode is Allocated
File mode: 16749
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1405413836
Creation time: 1433134923
Modification time: 1433134923
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 25
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9265, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
boot                                              58309633
dev                                               10506241
proc                                              27578881
sys                                               13658113
var                                               8667649
tmp                                               55420417
etc                                               5253121
root                                              70654465
selinux                                           19830529
lib64                                             70785793
usr                                               35195905
bin                                               34145281
home                                              27841537
lib                                               30993409
media                                             42550273
mnt                                               70129153
opt                                               68290561
sbin                                              48854017
srv                                               46490113
.autorelabel                                      12
oracle                                            87464449
.autofsck                                         13
cgroup                                            40055041
giis                                              79322113

如上结果和ls -lia /的输出的inode结果是一样的，然后想用extundelete查看某个目录里的文件或者目录用

/usr/local/extundelete/bin/extundelete --inode 55420417 /dev/sda4            //我的tmp目录的inode为55420417

此处略去及行字

File name                                       | Inode number | Deleted status
.                                                 55420417
..                                                2
yum.log                                           55420418
.ICE-unix                                         55428625
sqlnet.log                                        55420420
test.ora                                          55420421
hsperfdata_root                                   55428626
.oracle                                           55421283
yum_save_tx-2015-04-30-12-408b9aIq.yumtx          55420422
hadoop-2.7.0.tar.gz                               55420424
iptables                                          55420433
memcached.pid                                     55420419
java                                              55420428
ccHy2BJV.c                                        55420477       Deleted
jdk-7u75-linux-x64.rpm                            55420431
aaa.txt                                           55420427
cc0JnhVV.o                                        55420489       Deleted
memcached1.pid                                    55420423
yum_save_tx-2015-06-01-13-52PmXrAw.yumtx          55420476
ccXBGW6V.ld                                       55420504       Deleted
ccm8aCiW.le                                       55420505       Deleted
ccXGR2tk.ld                                       55420484       Deleted
cc2OuuMT.le                                       55420485       Deleted

输出入上，Deleted status为delete的则是一删除的文件

用这个方式查看目录的inode太麻烦，个人建议用ls -lia,直接着到要恢复文件的父目录。

然后恢复之

开始恢复单个目录

[root@vm java]# /usr/local/extundelete/bin/extundelete --inode 55420428 /dev/sda4
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 10807 groups loaded.
Group: 6752
Contents of inode 55420428:
0000 | ed 41 00 00 00 10 00 00 77 59 59 55 4f fd 6b 55 | .A......wYYUO.kU
0010 | 4f fd 6b 55 00 00 00 00 00 00 04 00 08 00 00 00 | O.kU............
0020 | 00 00 08 00 41 00 00 00 0a f3 01 00 04 00 00 00 | ....A...........
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 33 20 30 0d | ............3 0.
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 ac 48 ff f9 00 00 00 00 00 00 00 00 | .....H..........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 3c 27 87 21 3c 27 87 21 40 44 0b 14 | ....<'.!<'.!@D..
0090 | 77 59 59 55 40 44 0b 14 00 00 00 00 00 00 00 00 | wYYU@D..........
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1431918967
Creation time: 1433140559
Modification time: 1433140559
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 4
Blocks count: 8
File flags: 524288
File version (for NFS): 4194257068
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 221257779, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 55420428
..                                                55420417
ojdbc6.jar                                        55420426
JDBCCunLing.class                                 55420432
JDBCCunLing.java                                  55420430
RECOVERED_FILES                                   55428634
giis_4.6                                          55428627       Deleted
extundelete-0.2.4.tar.bz2                         55420442
extundelete-0.2.4                                 55428629
[root@vm java]# /usr/local/extundelete/bin/extundelete --restore-directory /tmp/java/giis_4.6 /dev/sda4
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 10807 groups loaded.
Loading journal descriptors ... 28793 descriptors loaded.
Searching for recoverable inodes in directory /tmp/java/giis_4.6 ...
88 recoverable inodes found.
Looking through the directory structure for deleted files ...
Unable to restore inode 55420442 (tmp/java/giis_4.6/.aaa.txt.swp): Space has been reallocated.
69 recoverable inodes still lost.
[root@vm java]# ll RECOVERED_FILES/
giis_4.6/         giis_4.6.tar.bz2  tmp/              
[root@vm java]# ll RECOVERED_FILES/
giis_4.6/         giis_4.6.tar.bz2  tmp/              
[root@vm java]# ll RECOVERED_FILES/giis_4.6/                 //文件的恢复路径是$PWD/RECOVERED_FILES
总用量 92
-rwxr-xr-x 1 root root    78 1月  28 2008 AUTHORS
drwxr-xr-x 2 root root  4096 6月  21 2009 bin
-rwxr-xr-x 1 root root 10630 6月  21 2009 ChangeLog
drwxr-xr-x 2 root root  4096 6月  21 2009 config
-rwxr-xr-x 1 root root 43579 6月  21 2009 COPYING
drwxr-xr-x 2 root root  4096 5月  31 2009 docs
-rwxr-xr-x 1 root root  3139 6月  21 2009 INSTALL
-rwxr-xr-x 1 root root   968 6月  21 2009 install_giis.sh
drwxr-xr-x 2 root root  4096 6月  21 2009 misc
-rwxr-xr-x 1 root root  1779 6月  21 2009 README
drwxr-xr-x 2 root root  4096 6月  21 2009 src

恢复单个文件

/usr/local/extundelete/bin/extundelete --restore-files  /etc/passwd /dev/sdb4

恢复单个文件指定inode

/usr/local/extundelete/bin/extundelete --restore-inode 88703856 /dev/sdb4

恢复分区上所有文件

extundelete /dev/partition --restore-all  /etc/passwd /dev/sdb4 

#####################################

迷途小运维原创

作者：john

转载请注明出处