linux_文件删除的恢复（rm -rf *）

文件删除，需要进行恢复。

1. lsof

    文件刚刚被删除，想要恢复，先尝试lsof.

   #lsof |grep data.file1

   # cp /proc/xxx/xxx/xx   /dir/data.file1

2. 

   如果lsof不能看到文件，那么就需要使用恢复软件进行恢复。

   要做的第一件事是立刻卸载被误删除文件所在的分区，或者重新以只读方式挂载此分区。

   umount  /dev/part    或    mount -o remount,ro /dev/part

   删除一个文件，就是将文件inode(inode 是操作系统寻找文件的目录，起到索引作用)

   节点中的扇区指针清除，同时，释放这些数据对应的数据块，

   而真实的文件还存留在磁盘分区中。但是这些被删除的文件不一定会一直存留在磁盘中，当这些

   释放的数据块被操作系统重新分配时，这些被删除的数据就会被覆盖。因此要立刻卸载分区。

3. ext3grep 

   该工具只能用于ext3文件系统，操作步骤不详细介绍.

   1> unmount /dev/part

   2> ext3grep /dev/part --ls --inode 2            ##列出可恢复文件信息

   3>ext3grep /dev/part --restore-inode N

   4>恢复到 RESTORED_FILES/

   更多命令查看 ext3grep --help

4. extundelete

     该工具可以恢复ext3,ext4.     http://extundelete.sourceforge.net/

      

     1>fuser -k /dev/part   && unmunt /dev/part

     2>extundelete --inode 2   /dev/part

     3>extundelete --restore-inode 13 /dev/part

     4>恢复到 RECOVERD_FILES/

root@grid1 ~]# extundelete --help

Usage: extundelete [options] [--] device-file

Options:

  --version, -[vV]       Print version and exit successfully.

  --help,                Print this help and exit successfully.

  --superblock           Print contents of superblock in addition to the rest.

                         If no action is specified then this option is implied.

  --journal              Show content of journal.

  --after dtime          Only process entries deleted on or after 'dtime'.

  --before dtime         Only process entries deleted before 'dtime'.

Actions:

  --inode ino            Show info on inode 'ino'.

  --block blk            Show info on block 'blk'.

  --restore-inode ino[,ino,...]

                         Restore the file(s) with known inode number 'ino'.

                         The restored files are created in ./RECOVERED_FILES

                         with their inode number as extension (ie, file.12345).

  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root

                         of the partition and does not start with a '/'

                         The restored file is created in the current

                         directory as 'RECOVERED_FILES/path'.

  --restore-files 'path' Will restore files which are listed in the file 'path'.

                         Each filename should be in the same format as an option

                         to --restore-file, and there should be one per line.

  --restore-directory 'path'

                         Will restore directory 'path'. 'path' is relative to the

                         root directory of the file system.  The restored

                         directory is created in the output directory as 'path'.

  --restore-all          Attempts to restore everything.

  -j journal             Reads an external journal from the named file.

  -b blocknumber         Uses the backup superblock at blocknumber when opening

                         the file system.

  -B blocksize           Uses blocksize as the block size when opening the file

                         system.  The number should be the number of bytes.

  --log 0                Make the program silent.

  --log filename         Logs all messages to filename.

--log D1=0,D2=filename   Custom control of log messages with comma-separated

   Examples below:       list of options.  Dn must be one of info, warn, or

   --log info,error      error.  Omission of the '=name' results in messages

   --log warn=0          with the specified level to be logged to the console.

   --log error=filename  If the parameter is '=0', logging for the specified

                         level will be turned off.  If the parameter is

                         '=filename', messages with that level will be written

                         to filename.

   -o directory          Save the recovered files to the named directory.

                         The restored files are created in a directory

                         named 'RECOVERED_FILES/' by default.

     看上面的命令就很容易理解，各个参数的作用。

  5.note

  1> 对于空文件，不会进行恢复

  2> 可以恢复mysql表， 由于myisam是单独3个文件，恢复出来就能使用。 

  3> 建议innodb，设置innodb_file_per_table 为 ON，这样也就能恢复单表数据。

  4> 从上面可以看出，恢复工具这能恢复分区，所以，建议为应用软件单独划区进行安装，

      存放数据。