linux下恢复数据工具,Linux 数据恢复工具extundelete(示例代码)

通过extundelete恢复单个文件

1.模拟数据误删除环境

以ext4文件系统为例

[[email protected] ~]# mkfs.ext4 /dev/sdc1

[[email protected] ~]# mount /dev/sdc1 /data/

[[email protected] ~]# cp /etc/passwd /data

[[email protected] ~]# mkdir /data/test

[[email protected] ~]# echo "extundelete test" > /data/test/mytest.txt

[[email protected] data]# md5sum passwd

f1a0dd6601afdab09a66ab7741c74f66  passwd

[[email protected] data]# md5sum test/mytest.txt

eb42e4b3f953ce00e78e11bf50652a80  test/mytest.txt

[[email protected] data]# rm -rf /data/*

2.卸载磁盘分区

[[email protected] data]# cd /mnt/

[[email protected] mnt]# umount /data

3.查询可恢复的数据信息

通过extundelete命令可以查询/dev/sdc1分区可恢复的数据信息

[[email protected] /]# extundelete /dev/sdc1 --inode 2

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 38 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 94 aa 75 58 54 aa 75 58 | .A........uXT.uX

0010 | 54 aa 75 58 00 00 00 00 00 00 02 00 08 00 00 00 | T.uX............

0020 | 00 00 08 00 05 00 00 00 0a f3 01 00 04 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 01 00 00 00 d5 21 00 00 | .............!..

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 c8 15 0b 0d c8 15 0b 0d dc 36 bf 4b | .............6.K

0090 | b2 a8 75 58 00 00 00 00 00 00 00 00 00 00 00 00 | ..uX............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1484106388

Creation time: 1484106324

Modification time: 1484106324

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 8

File flags: 524288

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 127754, 4, 0, 0, 1, 8661, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11             Deleted

passwd                                            12             Deleted

test                                              128513         Deleted

根据上面输出，标记为Deleted状态的是已经删除的文件或目录，同时，还可以看到每个已删除文件inode值，接下来就可以恢复文件了

4.恢复单个文件

执行如下命令开始恢复文件

extundelete /dev/sdc1 --restore-file passwd