xfs文件系统恢复工具xfs_undelete

GitHub - ianka/xfs_undelete: An undelete tool for the XFS filesystem.

• tcl >= 8.6
• tcllib

安装tclsh

tcl最新源码下载 

Tcl Source Code: Check-in [0074847583]

下载解压，cd unix

./configure

make 

make install

 ln -s /usr/local/bin/tclsh8.7 /usr/bin/tclsh

tclsh

% info tclversion

8.7

% info patchlevel

安装tcllib

cd tcllib-1.20  
 ls
./configure 
make 
make install

下载xfs_undelete

 wget https://github.com/ianka/xfs_undelete/archive/refs/heads/master.zip

unzip master.zip 

执行恢复:最近48小时之内被删除的

[root@dockerimage ~]# cat 1.sh
/root/xfs_undelete-master/xfs_undelete -t -48hour -o /new /dev/mapper/git-git
[root@dockerimage ~]# nohup ./1.sh > ./1.log &
[1] 11195
[root@dockerimage ~]# nohup: ignoring input and redirecting stderr to stdout

[root@dockerimage ~]# 
[root@dockerimage ~]# 
[root@dockerimage ~]# 
[root@dockerimage ~]# tail -f 1.log
Starting recovery.
Checking  inode       67 (  5%)

参考：

【Linux】Linux 下编译安装 tcl 和 tk_RadiantJeral的博客-CSDN博客_编译安装tcl

# cd ~ ; xfs_undelete /dev/mapper/cr_data

This stores the recovered files from /dev/mapper/cr_data in the directory ~/xfs_undeleted.

# xfs_undelete -o /mnt/external_harddisk /dev/sda3

This stores the recovered files from /dev/sda3 in the directory /mnt/external_harddisk.

# xfs_undelete -t 2020-03-19 /dev/sda3

This ignores files deleted before March 19th, 2020.

# xfs_undelete -t -1hour /dev/sda3

This ignores files deleted more than one hour ago. The -t option accepts all dates understood by Tcl’s [clock scan] command.

# xfs_undelete -i "" -t -2hour /dev/sda3

This recovers all files deleted not more than two hours ago, including "bin" files.

# xfs_undelete -r 'image/*,gimp-*' /dev/sda3

This only recovers files matching any image/ mimetype plus those getting assigned an extension starting with gimp-.