linux实现数据恢复 extundelete

extundelete，可以实现对ext3 ext4等基于Linux分区的数据修复

试验环境

centos-5.5

实验软件

e2fsprogs e2fsprogs-devel

extundelete-0.2.0.tar.bz2

软件安装

yum -y install e2fsprogs e2fsprogs-devel

tar jxf extundelete-0.2.0.tar.bz2

cd extundelete-0.2.0

./configure

make

make install

使用方法

extundelete /dev/sdb7 --restore-all               恢复分区

extundelete /dev/sdb7 --restore-file /file1.txt   恢复某一个文件

测试

fdisk -l

Disk /dev/sdb: 21.4 GB, 21474836480 bytes

255 heads, 63 sectors/track, 2610 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot      Start         End      Blocks   Id  System

/dev/sdb1               1        1460    11727418+  83  Linux

/dev/sdb2            1461        2610     9237375    5  Extended

mkdir file

mount /dev/sdb1 file

cd file

touch  aa.txt bb.txt cc.txt

rm -rf file/*

umount /dev/sdb1

extundelete /dev/sdb1 --restore-all   测试恢复分区

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.

The partition should be unmounted to undelete any files without further data loss.

If the partition is not currently mounted, this message indicates

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible.  You should unmount the

file system and check it with fsck before using extundelete.

Would you like to continue? (y/n)

y

Loading filesystem metadata ... 90 groups loaded.

Loading journal descriptors ... 19 descriptors loaded.

Writing output to directory RECOVERED_FILES/

Searching for recoverable inodes in directory / ...

1 recoverable inodes found.

Looking through the directory structure for deleted files ...

Failed to restore inode 11 to file RECOVERED_FILES/lost+found:Inode does not correspond to a regular file.

0 recoverable inodes still lost.

Disk /dev/sdb: 21.4 GB, 21474836480 bytes

255 heads, 63 sectors/track, 2610 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

  Device Boot      Start         End      Blocks   Id  System

/dev/sdb1               1        1460    11727418+  83  Linux

/dev/sdb2            1461        2610     9237375    5  Extended

extundelete /dev/sdb1 --restore-file /aa.txt    测试恢复文件

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.

The partition should be unmounted to undelete any files without further data loss.

If the partition is not currently mounted, this message indicates

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible.  You should unmount the

file system and check it with fsck before using extundelete.

Would you like to continue? (y/n)

Loading filesystem metadata ... 90 groups loaded.

Loading journal descriptors ... 19 descriptors loaded.

Unable to restore inode 48961 (aa.txt): No undeleted copies found in the journa

经测试，次软件的恢复能力对分区有效，对文件效果不大

本文转自 mailfile 51CTO博客，原文链接：http://blog.51cto.com/mailfile/1329839，如需转载请自行联系原作者