文件误删除恢复

最新推荐文章于 2024-09-16 20:17:55 发布

醉里看星辰

最新推荐文章于 2024-09-16 20:17:55 发布

阅读量128

点赞数

文章标签： linux 运维服务器

本文链接：https://blog.csdn.net/qq_50875067/article/details/127428203

版权

该博客介绍了如何在Linux系统中通过添加新硬盘、格式化分区、挂载分区来创建测试目录结构，然后演示了如何模拟文件误删除并使用extundelete工具进行恢复，包括恢复单个文件和所有文件的步骤，展示了Linux系统的数据恢复能力。

摘要由CSDN通过智能技术生成

文件误删除恢复

1.新加硬盘，格式化分区

1.1添加硬盘步骤简单省略

在这里插入图片描述

1.2创建分区

[root@zzp 桌面]# ll /dev/sdb*
brw-rw----. 1 root disk 8, 16 9月   8 16:38 /dev/sdb
[root@zzp 桌面]# fdisk /dev/sdb
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel with disk identifier 0x21b8e569.
Changes will remain in memory only, until you decide to write them.
After that, of course, the previous content won't be recoverable.

Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
         switch off the mode (command 'c') and change display units to
         sectors (command 'u').

Command (m for help): m
Command action
   a   toggle a bootable flag
   b   edit bsd disklabel
   c   toggle the dos compatibility flag
   d   delete a partition
   l   list known partition types
   m   print this menu
   n   add a new partition
   o   create a new empty DOS partition table
   p   print the partition table
   q   quit without saving changes
   s   create a new empty Sun disklabel
   t   change a partition's system id
   u   change display/entry units
   v   verify the partition table
   w   write table to disk and exit
   x   extra functionality (experts only)

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-2610, default 1): 1
Last cylinder, +cylinders or +size{K,M,G} (1-2610, default 2610): +5G

Command (m for help): p

Disk /dev/sdb: 21.5 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x21b8e569

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1         654     5253223+  83  Linux

Command (m for help): w   
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.
[root@zzp 桌面]#

在这里插入图片描述

1.3格式化分区，挂载分区

#######格式化分区
[root@zzp 桌面]# mkfs.ext4 /dev/sdb1
mke2fs 1.41.12 (17-May-2010)
文件系统标签=
操作系统:Linux
块大小=4096 (log=2)
分块大小=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
328656 inodes, 1313305 blocks
65665 blocks (5.00%) reserved for the super user
第一个数据块=0
Maximum filesystem blocks=1346371584
41 block groups
32768 blocks per group, 32768 fragments per group
8016 inodes per group
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736

正在写入inode表: 完成                            
Creating journal (32768 blocks): 完成
Writing superblocks and filesystem accounting information: 完成

This filesystem will be automatically checked every 23 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

#######挂载分区
[root@zzp /]# mkdir /sdb1
[root@zzp /]# mount dev/sdb1 /sdb1
[root@zzp /]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        20G  3.8G   15G  21% /
tmpfs           1.9G  224K  1.9G   1% /dev/shm
/dev/sda1       124M   44M   74M  38% /boot
/dev/sr0        3.7G  3.7G     0 100% /media/CentOS_6.9_Final
/dev/sdb1       4.9G   11M  4.6G   1% /sdb1

2.在分区里创建测试目录结构

[root@zzp sdb1]# cp /etc/passwd ./
[root@zzp sdb1]# cp /etc/hosts ./
[root@zzp sdb1]# ls
hosts  lost+found  passwd
root@zzp sdb1]# mkdir -p a/b/c
[root@zzp sdb1]# echo aaaaaaa >a.txt
[root@zzp sdb1]# ls
a  a.txt  hosts  lost+found  passwd
[root@zzp sdb1]# cp a.txt a
[root@zzp sdb1]# cp a.txt a/b
[root@zzp sdb1]# touch a/b/kong.txt
[root@zzp sdb1]# tree
.
├── a
│   ├── a.txt
│   └── b
│       ├── a.txt
│       ├── c
│       └── kong.txt
├── a.txt
├── hosts
├── lost+found
└── passwd

4 directories, 6 files
[root@zzp sdb1]#

在这里插入图片描述

3.删除恢复

###删除目录结构
[root@zzp sdb1]# rm -rf ./*
[root@zzp sdb1]# ls
[root@zzp sdb1]# 

###########################################恢复
###卸载sdb1分区
[root@zzp sdb1]# cd 
[root@zzp ~]# umount /dev/sdb1
[root@zzp ~]# 

####上传，解压，安装extundelete恢复工具
anaconda-ks.cfg   CentOS-Debuginfo.repo  CentOS-Media.repo  extundelete-0.2.4          install.log         公共的  视频  文档  音乐
CentOS-Base.repo  CentOS-fasttrack.repo  CentOS-Vault.repo  extundelete-0.2.4.tar.bz2  install.log.syslog  模板    图片  下载  桌面
[root@zzp ~]# cd extundelete-0.2.4
[root@zzp extundelete-0.2.4]# ls
acinclude.m4  autogen.sh  config.h.in  config.status  configure.ac  install-sh  Makefile     Makefile.in  README  stamp-h1
aclocal.m4    config.h    config.log   configure      depcomp       LICENSE     Makefile.am  missing      src     test
[root@zzp extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
Writing generated files to disk
[root@zzp extundelete-0.2.4]# make
make -s all-recursive
Making all in src
[root@zzp extundelete-0.2.4]# make install
Making install in src
  /usr/bin/install -c extundelete '/usr/local/bin'
[root@zzp extundelete-0.2.4]# echo $?
0
[root@zzp extundelete-0.2.4]# 

####查看可恢复文件inode号
[root@zzp ~]# extundelete /dev/sdb1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 72 b3 19 63 6e b3 19 63 | .A......r..cn..c
0010 | 6e b3 19 63 00 00 00 00 00 00 02 00 08 00 00 00 | n..c............
0020 | 00 00 00 00 11 00 00 00 b2 20 00 00 00 00 00 00 | ......... ......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 54 fe 98 eb 54 fe 98 eb b8 d0 9d 03 | ....T...T.......
0090 | 55 ac 19 63 00 00 00 00 00 00 00 00 00 00 00 00 | U..c............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1662628722
Creation time: 1662628718
Modification time: 1662628718
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 8370, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
passwd                                            12             Deleted
hosts                                             13             Deleted
a                                                 128257         Deleted
a.txt                                             14             Deleted
kong.txt                                          15             Deleted
[root@zzp ~]# 
###恢复文件
[root@zzp ~]# mkdir test
[root@zzp ~]# ls
anaconda-ks.cfg        CentOS-fasttrack.repo  extundelete-0.2.4          install.log.syslog  模板  文档  桌面
CentOS-Base.repo       CentOS-Media.repo      extundelete-0.2.4.tar.bz2  test                视频  下载
CentOS-Debuginfo.repo  CentOS-Vault.repo      install.log                公共的              图片  音乐
[root@zzp ~]# cd test/
[root@zzp test]# ls
[root@zzp test]# extundelete /dev/sdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 136 descriptors loaded.
Successfully restored file passwd
[root@zzp test]# ls
RECOVERED_FILES
[root@zzp test]# cd RECOVERED_FILES/
[root@zzp RECOVERED_FILES]# ls
passwd
[root@zzp RECOVERED_FILES]# md5sum passwd /etc/passwd
0d1442d94a0f6122a56d6bb29461af9b  passwd
0d1442d94a0f6122a56d6bb29461af9b  /etc/passwd
###恢复所有文件
[root@zzp RECOVERED_FILES]# cd ../
[root@zzp test]# ls
RECOVERED_FILES
[root@zzp test]# rm -rf ./*
[root@zzp test]# ls
[root@zzp test]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 136 descriptors loaded.
Searching for recoverable inodes in directory / ... 
9 recoverable inodes found.
Looking through the directory structure for deleted files ... 
0 recoverable inodes still lost.
[root@zzp test]# ls
RECOVERED_FILES
[root@zzp test]# cd RECOVERED_FILES/
[root@zzp RECOVERED_FILES]# ls
a  a.txt  hosts  passwd
[root@zzp RECOVERED_FILES]# tree
.
├── a
│   ├── a.txt
│   └── b
│       └── a.txt
├── a.txt
├── hosts
└── passwd

2 directories, 5 files
[root@zzp RECOVERED_FILES]#