使用extundelete恢复删除的文件

声明：本博文用于学习总结及工作心得

环境 LINUX Ubuntu14.04

下午因误操作删除了部署在tomcat 上的项目 ，所以需要使用extundelete来恢复

当前误删除了 /var/lib/tomcat7/webapps/ 所有项目

1.安装extundelete

apt-get install extundelete

2.查看误删除的文件或者目录的上级目录的inode

ls -id /var/lib/tomcat7/webapps 

得到inode 918944

3.查看当前删除的文件的磁盘分区

当前是 /dev/xvda1

4.查询可可恢复的数据信息

extundelete  /dev/xvda1  --inode 918944

WARNING: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 160 groups loaded.
Contents of inode 918944:
0000 | ff 41 69 00 00 10 00 00 ae 38 9c 58 aa 38 9c 58 | .Ai......8.X.8.X
0010 | aa 38 9c 58 00 00 00 00 6f 00 02 00 08 00 00 00 | .8.X....o.......
0020 | 00 00 08 00 df 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 f5 20 38 00 | ............. 8.
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 9e 50 2e b5 00 00 00 00 00 00 00 00 | .....P..........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 90 00 00 00 00 00 00 00 11 04 00 00 00 00 00 00 | ................
0090 | 00 00 14 00 00 fe 4f 00 e6 ff 03 00 28 38 45 00 | ......O.....(8E.
00a0 | ee f7 12 00 00 00 00 00 02 00 00 00 02 00 00 00 | ................
00b0 | 00 80 00 00 00 80 00 00 00 20 00 00 2e 27 20 58 | ......... ...' X
00c0 | 0c fe f3 54 14 00 ff ff 53 ef 01 00 01 00 00 00 | ...T....S.......
00d0 | 0f 9d e8 53 00 00 00 00 00 00 00 00 01 00 00 00 | ...S............
00e0 | 00 00 00 00 0b 00 00 00 00 01 00 00 3c 00 00 00 | ............<...
00f0 | 46 02 00 00 7b 00 00 00 8f 91 cd 21 b0 ca 45 d7 | F...{......!..E.

Inode is Allocated
Group: 112
File mode: 16895
Low 16 bits of Owner Uid: 105
Size in bytes: 4096
Access time: 1486633134
Creation time: 1486633130
Modification time: 1486633130
Deletion Time: 0
Low 16 bits of Group Id: 111
Links count: 2
Blocks count: 8
File flags: 524288
File version (for NFS): 3039711390
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 3678453, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
Directory block 3678453:
.                                                 918944
..                                                918912
ROOT                                              917620         Deleted
ROOT2                                             917523         Deleted
ROOT.war                                          920771         Deleted
.README.swp                                       923876         Deleted
README                                            917514         Deleted
ROOT.war                                          918702         Deleted

5.开始恢复 可选择恢复单个文件还是整个目录,或者是恢复所有

当前是恢复所有

extundelete /dev/xvda1 --restore-all

恢复单个文件

extundelete /dev/xvda1 --restore-file  文件名

恢复目录

extundelete /dev/xvda1 --restore-directory 目录名

输出内容太多 这里就不显示了 但是你可以注意有没有： Restored inode 917679 to file RECOVERED_FILES/恢复的文件名称

然后进入当前目录的RECOVERED_FILES中 就能看见恢复的数据了 ,如果没有数据则恢复失败