Linux ext4 rm删除文件恢复

最新推荐文章于 2023-07-31 16:14:06 发布

snoopyljc

最新推荐文章于 2023-07-31 16:14:06 发布

阅读量687

点赞数

分类专栏： Linux 文章标签： Linux ext4

本文链接：https://blog.csdn.net/snoopyljc/article/details/89199130

版权

Linux 专栏收录该内容

15 篇文章 0 订阅

订阅专栏

根据inode节点恢复

查找文件所在inode节点

extundelete --inode 2 /dev/sdxx

File name                                       | Inode number | Deleted status
Workspace                                         28442625
TEE                                               31064065
HEE                                               11927553

继续使用extundelete根据inode信息查找，指导找到被删除的文件

extundelete --inode 11927553 /dev/sdxx

File name                                       | Inode number | Deleted status
zircon_start                                      11946149       Deleted

使用下面的命令恢复被删除的文件

extundelete --restore-inode 11946149 /dev/sdxx
 ==> 恢复的文件在当前目录的RECOVERED_FILES目录下

根据路径恢复

extundelete --restore-file /HEE/zircon_start /dev/sdxx
恢复文件在当前目录的同路径目录下

其他

extundelete　--restore-directory /HEE /dev/sdxx

查找文件对应的块(未删除文件)

sudo debugfs -R "stat /HEE/zircon_start" /dev/sdxx
确定文件所在块
Inode: 11946137   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 1131370828    Version: 0x00000000:00000001
User:     0   Group:     0   Project:     0   Size: 7259
File ACL: 0
Links: 1   Blockcount: 16
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5cae0cff:e418a474 -- Wed Apr 10 23:34:23 2019
 atime: 0x5cae0cff:e418a474 -- Wed Apr 10 23:34:23 2019
 mtime: 0x5cae0cff:e418a474 -- Wed Apr 10 23:34:23 2019
crtime: 0x5cae0cff:e418a474 -- Wed Apr 10 23:34:23 2019
Size of extra inode fields: 32
EXTENTS:
(0-1):47780800-47780801

sudo dumpe2fs -h /dev/sdxx
确定块大小
Block size:               4096

sudo dd if=/dev/sdxx bs=4096 skip=47780800 count=2 status=none | hexdump -C
查看文件内容
00000000  2a 20 67 75 65 73 74 5f  69 6e 69 74 0a 20 20 2a  |* guest_init.  *|
00000010  20 7a 78 5f 73 74 61 74  75 73 5f 74 20 73 74 61  | zx_status_t sta|
00000020  74 75 73 20 3d 20 56 6d  4f 62 6a 65 63 74 50 61  |tus = VmObjectPa|
00000030  67 65 64 3a 3a 43 72 65  61 74 65 28 30 2c 20 47  |ged::Create(0, G|
00000040  55 45 53 54 5f 50 48 59  53 5f 4d 45 4d 5f 53 49  |UEST_PHYS_MEM_SI|
00000050  5a 45 2c 20 26 67 75 65  73 74 5f 70 68 79 73 5f  |ZE, &guest_phys_|