Restore the operation of linux rm -rf



需要先安装extundelete-0.2.4.tar.bz2软件。

[root@rhel-10 ~]# ls
anaconda-ks.cfg  Desktop  extundelete-0.2.4.tar.bz2  install.log  install.log.syslog
[root@rhel-10 ~]# bunzip extundelete-0.2.4.tar.bz2
[root@rhel-10 ~]# ls -ltr
total 652
-rw-r--r-- 1 root root   4077 Sep 23 01:03 install.log.syslog
-rw-r--r-- 1 root root  57893 Sep 23 01:03 install.log
-rw------- 1 root root   1470 Sep 23 01:03 anaconda-ks.cfg
drwxr-xr-x 3 root root   4096 Sep 23 22:45 Desktop
-rw-r--r-- 1 root root 573440 Dec 13 11:16 extundelete-0.2.4.tar
[root@rhel-10 ~]#

[root@rhel-10 ~]# tar xvf extundelete-0.2.4.tar
extundelete-0.2.4/
extundelete-0.2.4/acinclude.m4
extundelete-0.2.4/missing
extundelete-0.2.4/autogen.sh
extundelete-0.2.4/aclocal.m4
extundelete-0.2.4/configure
extundelete-0.2.4/LICENSE
extundelete-0.2.4/README
extundelete-0.2.4/install-sh
extundelete-0.2.4/config.h.in
extundelete-0.2.4/src/
extundelete-0.2.4/src/extundelete.cc
extundelete-0.2.4/src/block.h
extundelete-0.2.4/src/kernel-jbd.h
extundelete-0.2.4/src/insertionops.cc
extundelete-0.2.4/src/block.c
extundelete-0.2.4/src/cli.cc
extundelete-0.2.4/src/extundelete-priv.h
extundelete-0.2.4/src/extundelete.h
extundelete-0.2.4/src/jfs_compat.h
extundelete-0.2.4/src/Makefile.in
extundelete-0.2.4/src/Makefile.am
extundelete-0.2.4/configure.ac
extundelete-0.2.4/depcomp
extundelete-0.2.4/Makefile.in
extundelete-0.2.4/Makefile.am
[root@rhel-10 ~]# ls -ltr
total 656
drwxr-xr-x 3 1000 1000   4096 Jan  4  2013 extundelete-0.2.4
-rw-r--r-- 1 root root   4077 Sep 23 01:03 install.log.syslog
-rw-r--r-- 1 root root  57893 Sep 23 01:03 install.log
-rw------- 1 root root   1470 Sep 23 01:03 anaconda-ks.cfg
drwxr-xr-x 3 root root   4096 Sep 23 22:45 Desktop
-rw-r--r-- 1 root root 573440 Dec 13 11:16 extundelete-0.2.4.tar
[root@rhel-10 ~]#

[root@rhel-10 ~]# cd extundelete-0.2.4
[root@rhel-10 extundelete-0.2.4]# ls
acinclude.m4  autogen.sh   configure     depcomp     LICENSE      Makefile.in  README
aclocal.m4    config.h.in  configure.ac  install-sh  Makefile.am  missing      src
[root@rhel-10 extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@rhel-10 extundelete-0.2.4]#

[root@rhel-10 extundelete-0.2.4]# make && make install
make -s all-recursive
Making all in src
extundelete.cc:105: warning: unused parameter ?.et_flags?
extundelete.cc:571: warning: unused parameter ?.lags?
block.c: In function ?.xtundelete_block_iterate3?.
block.c:840: warning: label ?.rrout?.defined but not used
block.c:620: warning: unused variable ?.?
Making install in src
  /usr/bin/install -c extundelete '/usr/local/bin'
[root@rhel-10 extundelete-0.2.4]#

extundelete  --help  查看有哪些选项 
--restore-file 指定恢复文件,
--restore-directory 指定恢复目录，
--restore-all 恢复全部等等,恢复完成后,恢复的文件就在当前目录下生成的RECOVERED_FILES的目录里.如下图所示:

[root@rhel-10 extundelete-0.2.4]# extundelete --help
Usage: extundelete [options] [--] device-file
Options:
  --version, -[vV]       Print version and exit successfully.
  --help,                Print this help and exit successfully.
  --superblock           Print contents of superblock in addition to the rest.
                         If no action is specified then this option is implied.
  --journal              Show content of journal.
  --after dtime          Only process entries deleted on or after 'dtime'.
  --before dtime         Only process entries deleted before 'dtime'.
Actions:
  --inode ino            Show info on inode 'ino'.
  --block blk            Show info on block 'blk'.
  --restore-inode ino[,ino,...]
                         Restore the file(s) with known inode number 'ino'.
                         The restored files are created in ./RECOVERED_FILES
                         with their inode number as extension (ie, file.12345).
  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root
                         of the partition and does not start with a '/'
                         The restored file is created in the current
                         directory as 'RECOVERED_FILES/path'.
  --restore-files 'path' Will restore files which are listed in the file 'path'.
                         Each filename should be in the same format as an option
                         to --restore-file, and there should be one per line.
  --restore-directory 'path'
                         Will restore directory 'path'. 'path' is relative to the
                         root directory of the file system.  The restored
                         directory is created in the output directory as 'path'.
  --restore-all          Attempts to restore everything.
  -j journal             Reads an external journal from the named file.
  -b blocknumber         Uses the backup superblock at blocknumber when opening
                         the file system.
  -B blocksize           Uses blocksize as the block size when opening the file
                         system.  The number should be the number of bytes.
  --log 0                Make the program silent.
  --log filename         Logs all messages to filename.
--log D1=0,D2=filename   Custom control of log messages with comma-separated
   Examples below:       list of options.  Dn must be one of info, warn, or
   --log info,error      error.  Omission of the '=name' results in messages
   --log warn=0          with the specified level to be logged to the console.
   --log error=filename  If the parameter is '=0', logging for the specified
                         level will be turned off.  If the parameter is
                         '=filename', messages with that level will be written
                         to filename.
   -o directory          Save the recovered files to the named directory.
                         The restored files are created in a directory
                         named 'RECOVERED_FILES/' by default.
[root@rhel-10 extundelete-0.2.4]#

--恢复命令
--umount或者read only 分区
 umount /dev/partition
 mount -o remount,ro /dev/partition
--恢复文件
xtundelete /dev/partition --restore-all
extundelete /dev/partition --restore-directory /backup/gnutool-delete
extundelete /dev/partition --restore-files /etc/passwd

--恢复测试
1.基于目录恢复
[root@rhel-10 ~]# ls
anaconda-ks.cfg  extundelete-0.2.4      install.log         testrm
Desktop          extundelete-0.2.4.tar  install.log.syslog
[root@rhel-10 oracle]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2             4.9G  3.7G 1005M  79% /
/dev/sda5             7.6G  146M  7.1G   2% /oracle
/dev/sda1             190M   12M  169M   7% /boot
tmpfs                1006M     0 1006M   0% /dev/shm
[root@rhel-10 oracle]# pwd
/oracle
[root@rhel-10 oracle]# ls -ltr
total 20
drwx------ 2 root root 16384 Sep 23 00:40 lost+found
drwxr-xr-x 2 root root  4096 Dec 13 11:41 testrm
[root@rhel-10 oracle]# rm -rf testrm/
[root@rhel-10 oracle]# extundelete /dev/sda5 --restore-directory /testrm
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 63 groups loaded.
Loading journal descriptors ... 68 descriptors loaded.
Searching for recoverable inodes in directory /testrm ...
3 recoverable inodes found.
Looking through the directory structure for deleted files ...
2 recoverable inodes still lost.
[root@rhel-10 oracle]# ls
lost+found  RECOVERED_FILES
[root@rhel-10 oracle]# cd RECOVERED_FILES/
[root@rhel-10 RECOVERED_FILES]# ls
testrm
[root@rhel-10 RECOVERED_FILES]# cd testrm/
[root@rhel-10 testrm]# ls
install.log
[root@rhel-10 testrm]#
恢复成功！

2.基于文件的恢复
[root@rhel-10 testrm]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2             4.9G  3.7G 1003M  79% /
/dev/sda5             7.6G  146M  7.1G   2% /oracle
/dev/sda1             190M   12M  169M   7% /boot
tmpfs                1006M     0 1006M   0% /dev/shm
[root@rhel-10 testrm]# pwd
/oracle/testrm
[root@rhel-10 testrm]# ls
install.log
[root@rhel-10 testrm]# rm -rf install.log
[root@rhel-10 testrm]# extundelete /dev/sda5 --restore-files /oracle/testrm/install.log
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 63 groups loaded.
Loading journal descriptors ... 152 descriptors loaded.
extundelete: Unable to open file /oracle/testrm/install.log
extundelete: Operation not permitted when trying to examine filesystem
[root@rhel-10 testrm]# ls
RECOVERED_FILES
[root@rhel-10 testrm]# cd RECOVERED_FILES/
[root@rhel-10 RECOVERED_FILES]# ll
total 0
[root@rhel-10 RECOVERED_FILES]#
恢复失败！

3.基于磁盘的恢复
[root@rhel-10 testrm]# extundelete /dev/sda5 --restore-all
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 63 groups loaded.
Loading journal descriptors ... 161 descriptors loaded.
Searching for recoverable inodes in directory / ...
9 recoverable inodes found.
Looking through the directory structure for deleted files ...
4 recoverable inodes still lost.
[root@rhel-10 testrm]# ls
RECOVERED_FILES
[root@rhel-10 testrm]# cd RECOVERED_FILES/
[root@rhel-10 RECOVERED_FILES]# ls
lost+found  testrm
[root@rhel-10 RECOVERED_FILES]# cd testrm/
[root@rhel-10 testrm]# ls
install.log
[root@rhel-10 testrm]#
恢复成功！

通过测试可知，利用extundelete恢复删除的文件或者目录，能否恢复有很大的不确定性。只能在某些紧急情况下尝试碰碰运气！