虚拟机模拟EXT类型文件恢复

下载ext文件的开发库和库文件

下载e2fsprogs-devel e2fsprogs-libs

[root@localhost ~]# yum -y install e2fsprogs-devel e2fsprogs-libs

将分区类型设置成ext3，并挂载

设置/dev/sdb1的id为0

[root@localhost ~]# fdisk /dev/sdb
Command (m for help): t
Partition number (1,2, default 2): 1
Hex code (type L to list all codes): 0

Command (m for help): p

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1            2048    20973567    10485760    0  Empty
/dev/sdb2        20973568    41943039    10484736   83  Linux

Command (m for help): w

格式化

[root@localhost ~]# mkfs -t ext3 /dev/sdb1

挂载

[root@localhost ~]# cd /
[root@localhost /]# mkdir ext3
[root@localhost /]# mount /dev/sdb1 /ext3/
[root@localhost /]# df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
devtmpfs       devtmpfs  1.9G     0  1.9G   0% /dev
tmpfs          tmpfs     1.9G     0  1.9G   0% /dev/shm
tmpfs          tmpfs     1.9G   12M  1.9G   1% /run
tmpfs          tmpfs     1.9G     0  1.9G   0% /sys/fs/cgroup
/dev/sda3      xfs       291G  3.7G  288G   2% /
/dev/sda1      xfs      1014M  142M  873M  14% /boot
tmpfs          tmpfs     378M     0  378M   0% /run/user/0
/dev/sdb1      ext3      9.8G   23M  9.2G   1% /ext3

下载extundelete安装包

[root@localhost backup]# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

安装extundelete

解压

[root@localhost backup]# tar jxvf extundelete-0.2.4.tar.bz2
[root@localhost backup]# ls
extundelete-0.2.4  extundelete-0.2.4.tar.bz2

安装extundelete，路径/usr/local/extundelete

[root@localhost extundelete-0.2.4]# ./configure --prefix=/usr/local/extundelete && make && make install

制作软链接

[root@localhost extundelete-0.2.4]# ln -s /usr/local/extundelete/bin/* /usr/bin/

模拟数据丢失

在/ext3下创建5个文件，在5个文件中输入些数据，删除其中某些文件

[root@localhost /]# cd ext3/
[root@localhost ext3]# touch 1 2 3 4 5
[root@localhost ext3]# echo 1 > 1
[root@localhost ext3]# echo 2 > 2
[root@localhost ext3]# echo 3 > 3
[root@localhost ext3]# echo 4 > 4
[root@localhost ext3]# echo 5 > 5
[root@localhost ext3]# cat 3
3
[root@localhost ext3]# rm -rf 1 3
[root@localhost ext3]# ls
2  4  5

使用extundelete找回丢失的文件

解除挂载

[root@localhost /]# umount /ext3/
[root@localhost /]# df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
devtmpfs       devtmpfs  1.9G     0  1.9G   0% /dev
tmpfs          tmpfs     1.9G     0  1.9G   0% /dev/shm
tmpfs          tmpfs     1.9G   12M  1.9G   1% /run
tmpfs          tmpfs     1.9G     0  1.9G   0% /sys/fs/cgroup
/dev/sda3      xfs       291G  3.7G  288G   2% /
/dev/sda1      xfs      1014M  142M  873M  14% /boot
tmpfs          tmpfs     378M     0  378M   0% /run/user/0

查看丢失的文件

[root@localhost /]# extundelete /dev/sdb1 --inode 2

恢复丢失的文件

[root@localhost /]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 80 groups loaded.
Loading journal descriptors ... 36 descriptors loaded.
Searching for recoverable inodes in directory / ...
2 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.

恢复的文件在RECOVERED_FILES中

[root@localhost /]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
1  3
[root@localhost RECOVERED_FILES]# cat 1
1

完成