linux误删除多个文件恢复,linux恢复误删除文件-extundelete

1. 创建文件系统

[root@zw_test_26_74 /]#  mkfs -t ext4 /dev/sdb3

2.查看文件系统类型

[root@zw_test_26_74 /]# blkid /dev/sdb3  --查看文件系统类型

/dev/sdb3: UUID="b786e8d1-e8ac-4681-ad3a-ff7a39c07146" TYPE="ext4"

也能够用以下方法查看

[root@zw_test_26_74 ~]# file -s /dev/sdb3

/dev/sdb3: Linux rev 1.0 ext4 filesystem data (extents) (huge files)

3.创建一个delete文件夹。并挂载到刚创建的文件系统上，并创建文件，然后删除文件

[root@zw_test_26_74 /]# mkdir delete

[root@zw_test_26_74 /]# mount /dev/sdb3 /delete

[root@zw_test_26_74 /]# cd /delete

[root@zw_test_26_74 delete]# ls

lost+found

[root@zw_test_26_74 delete]# vi zw.txt      --加入一些内容

[root@zw_test_26_74 delete]# rm -rf zw.txt

4.下载

extundelete 主页：http://extundelete.sourceforge.net/

下载地址：http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2   --0.2.4版本号http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2--0.2.4版本号

[root@zw_test_26_74 /]# wget wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

[root@zw_test_26_74 /]# tar -xvf extundelete-0.2.4.tar.bz2

[root@zw_test_26_74 extundelete-0.2.4]# cd /extundelete-0.2.4

[root@zw_test_26_74 extundelete-0.2.4]# ./configure --prefix=/usr/local/extundelete  && make && make install

Configuring extundelete 0.2.4

configure: error: Can't find ext2fs library

这是由于extundelete依赖e2fsprogs。

[root@zw_test_26_74 extundelete-0.2.4]# yum -y install e2fsprogs  e2fsprogs-devel

安装e2fsprogs后再次configure 成功。

[root@zw_test_26_74 extundelete-0.2.4]# ./configure  --prefix=/usr/local/extundelete  && make && make install

Configuring extundelete 0.2.4

Writing generated files to disk

make -s all-recursive

Making all in src

Making install in src

/usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'

5.查看工具版本号

[root@zw_test_26_74 /]# cd /usr/local/extundelete/bin

[root@zw_test_26_74 bin]# ./extundelete -v

extundelete version 0.2.4

libext2fs version 1.41.12

Processor is little endian.

6.卸载分区。注意假设是/ 根文件夹的删了，把磁盘挂载到其它机器做恢复

[root@zw_test_26_74 ~] fuser -k /delete        

[root@www ~]# umount /delete                   

[root@zw_test_26_74 ~]#  umount /dev/sdb3

7.使用extundelete查看分区上存在的文件

extundelete --inode 2 /dev/sdb2

# --inode 为查找某i节点中的内容，使用2则说明为搜索，假设需要进入文件夹搜索，仅仅需要指定文件夹I节点就可以

[root@zw_test_26_74 bin]#  extundelete --inode 2 /dev/sdb3

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 26 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 04 00 00 01 7b c6 56 05 7b c6 56 | .A.......{.V.{.V

0010 | 05 7b c6 56 00 00 00 00 00 00 03 00 02 00 00 00 | .{.V............

0020 | 00 00 00 00 20 00 00 00 e3 10 00 00 00 00 00 00 | .... ...........

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 1024

Access time: 1455848193

Creation time: 1455848197

Modification time: 1455848197

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 3

Blocks count: 2

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 4323, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

Directory block 4323:

.                                                 2

..                                                2

lost+found                                        11

zw.txt14             Deleted.zw.txt.swp                                       13             Deleted

zw.txt~                                           12             Deleted

上面标记为deleted的,zw.txt 就是我误删的数据

8. 恢复：

root@zw_test_26_74 bin]# extundelete --restore-all  /dev/sdb3

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 26 groups loaded.

Loading journal descriptors ... 47 descriptors loaded.

Writing output to directory RECOVERED_FILES/

Searching for recoverable inodes in directory / ...

1 recoverable inodes found.

Looking through the directory structure for deleted files ...

Restored inode 14 to file RECOVERED_FILES/zw.txt

0 recoverable inodes still lost.

[root@zw_test_26_74 bin]# ll

total 1164

-rwxr-xr-x 1 root root 1187047 Feb 19 10:10 extundelete