linux rm 恢复 ext4,EXT4中恢复使用rm命令误删除的文件

EXT4中恢复使用rm命令误删除的文件

1. 需要准备的压缩包

[root@SYS-20140609-7-50 soft]# ll extundelete-0.2.0.tar.bz2

-rw-r--r-- 1 root root 97851 Jun 11 20:33 extundelete-0.2.0.tar.bz2

2. 环境准备

2.1 查看操作系统版本

[root@SYS-20140609-7-50 soft]# lsb_release -a

LSB Version: :core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch

Distributor ID: RedHatEnterpriseServer

Description: Red Hat Enterprise Linux Server release 6.2 (Santiago)

Release: 6.2  ###操作系统版本为6.2

Codename: Santiago

2.2 查看文件属性

[root@SYS-20140609-7-50 soft]# df -TP

Filesystem    Type 1024-blocks      Used Available Capacity Mounted on

/dev/mapper/VolGroup-lv_root ext4   2652784   1674164    843864      67% /

tmpfs        tmpfs     1958768         0   1958768       0% /dev/shm

/dev/sda1     ext4      495844     36837    433407       8% /boot

/dev/sdb1     ext4    20635700   3692092  15895372      19% /data

此操作系统都是ext4的文件格式

3. 安装软件包

[root@SYS-20140609-7-50 soft]# ll extundelete-0.2.0.tar.bz2

-rw-r--r-- 1 root root 97851 Jun 11 20:33 extundelete-0.2.0.tar.bz2

3.1 解压

[root@SYS-20140609-7-50 soft]# tar jxvf extundelete-0.2.0.tar.bz2

3.2 进入目录

[root@SYS-20140609-7-50 soft]# cd extundelete-0.2.0

3.3 进入编译

3.3.1

[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure

Configuring extundelete 0.2.0

configure: error: C++ compiler cannot create executables ###如果出现这样的情况    ----yum -y install gcc*

See `config.log' for more details.

3.3.2

[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure

Configuring extundelete 0.2.0

configure: error: Can't find ext2fs library   ####如果出现这样的情况

[root@SYS-20140609-7-50 extundelete-0.2.0]# rpm -qa | grep e2fsprogs

e2fsprogs-libs-1.41.12-11.el6.x86_64

e2fsprogs-1.41.12-11.el6.x86_64

这样需要再安装一下软件包

[root@SYS-20140609-7-50 extundelete-0.2.0]# yum -y install e2fsprogs*

再次查看e2fsprogs*

[root@SYS-20140609-7-50 extundelete-0.2.0]# rpm -qa | grep e2fsprogs

e2fsprogs-libs-1.41.12-11.el6.x86_64

e2fsprogs-1.41.12-11.el6.x86_64

e2fsprogs-devel-1.41.12-11.el6.x86_64

再次进行安装软件

[root@SYS-20140609-7-50 extundelete-0.2.0]# ./configure

Configuring extundelete 0.2.0

Writing generated files to disk  #####现在说明是成功状态

[root@SYS-20140609-7-50 extundelete-0.2.0]# make

make -s all-recursive

Making all in src

[root@SYS-20140609-7-50 extundelete-0.2.0]# make install

Making install in src

/usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'

出现此步说明安装成功

4. 执行删除操作

4.1 查看磁盘分区

[root@SYS-20140609-7-50 extundelete-0.2.0]# df -lP

Filesystem         1024-blocks      Used Available Capacity Mounted on

/dev/mapper/VolGroup-lv_root   2652784   1906628    611400      76% /

tmpfs                  1958768         0   1958768       0% /dev/shm

/dev/sda1               495844     36837    433407       8% /boot

/dev/sdb1             20635700   3696120  15891344      19% /data  ####打算用/data作为试验对像

4.2 删除12345.txt文件

[root@SYS-20140609-7-50 data]# vi 12345.txt

[root@SYS-20140609-7-50 data]# ls

4.3 查看文件内容

[root@SYS-20140609-7-50 data]# cat 12345.txt

dklfjadslkfjalskfjadlskfjdaksdfjlksdafjlaskdfjlksda

4.4 删除文件

12345.txt  lost+found  rhel6_2  Shell  soft

[root@SYS-20140609-7-50 data]# rm -rf 12345.txt

5. 数据恢复

5.1 卸载需要恢复文件的分区

[root@SYS-20140609-7-50 extundelete-0.2.0]# df -lP  

Filesystem         1024-blocks      Used Available Capacity Mounted on

/dev/mapper/VolGroup-lv_root   2652784   1906628    611400      76% /

tmpfs                  1958768         0   1958768       0% /dev/shm

/dev/sda1               495844     36837    433407       8% /boot

/dev/sdb1             20635700   3696120  15891344      19% /data

[root@SYS-20140609-7-50 ~]# fuser -k /data   

[root@SYS-20140609-7-50 ~]# umount /data   

5.2 使用extundelete查看分区上存在的文件

[root@SYS-20140609-7-50 ~]#  extundelete --inode 2 /dev/sdb1 # --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 160 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 48 1e 99 53 b8 fd 98 53 | .A......H..S...S

0010 | b8 fd 98 53 00 00 00 00 00 00 06 00 08 00 00 00 | ...S............

0020 | 00 00 00 00 15 00 00 00 21 24 00 00 00 00 00 00 | ........!$......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 00 00 00 00 00 00 00 00 11 10 00 00 00 00 00 00 | ................

0090 | 00 00 00 00 00 00 00 00 48 10 95 53 48 10 95 53 | ........H..SH..S

00a0 | 48 10 95 53 00 00 00 00 00 00 00 00 00 00 00 00 | H..S............

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1402543688

Creation time: 1402535352

Modification time: 1402535352

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 6

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

Directory block 9249:

.                                                 2

..                                                2

lost+found                                        11

rhel6_2                                           655361

soft                                              131073

Shell                                             1048577

.12345.txt.swp                                    12             Deleted  ----为删除文件

12345.txt                                         13             Deleted  ----为删除文件

5.3 现在进行恢复Deleted  12345.txt

[root@SYS-20140609-7-50 ~]# extundelete --restore-inode 13 /dev/sdb1 # --restore-inode 恢复指定的I节点文件，默认全将恢复

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 160 groups loaded.

Loading journal descriptors ... 2430 descriptors loaded.

Writing output to directory RECOVERED_FILES/

Restored inode 13 to file RECOVERED_FILES/file.13

5.4 进入此RECOVERED_FILES目录查看

[root@SYS-20140609-7-50 RECOVERED_FILES]# ls

file.13  

5.5 挂载目录，恢复文件

[root@SYS-20140609-7-50 RECOVERED_FILES]# mount /dev/sdb1 /data

[root@SYS-20140609-7-50 RECOVERED_FILES]# cd /data

[root@SYS-20140609-7-50 data]# ls

lost+found  rhel6_2  Shell  soft

[root@SYS-20140609-7-50 data]# cp /root/RECOVERED_FILES/file.13 ./12345.txt

[root@SYS-20140609-7-50 data]# ls

12345.txt  lost+found  rhel6_2  Shell  soft

[root@SYS-20140609-7-50 data]# cat 12345.txt

dklfjadslkfjalskfjadlskfjdaksdfjlksdafjlaskdfjlksda  

[root@SYS-20140609-7-50 data]#

注：命令操作方法

number 1: 恢复一个文件

# extundelete /dev/sdd1 --restore-file del1.txt

number 2:恢复一个目录

# extundelete /dev/sdd1 --restore-directory /backupdate/deldate

number 3: 恢复一个磁盘上所有文件

# extundelete /dev/sdd1 --restore-all