CentOS7恢复rm -rf 误删的xfs系统

误删除文件

删除前查看都有哪些文件或者压缩文件

]# df -h
文件系统                 容量  已用  可用 已用% 挂载点
/dev/mapper/centos-root   50G  1.5G   49G    3% /
devtmpfs                 3.9G     0  3.9G    0% /dev
tmpfs                    3.9G     0  3.9G    0% /dev/shm
tmpfs                    3.9G  8.6M  3.9G    1% /run
tmpfs                    3.9G     0  3.9G    0% /sys/fs/cgroup
/dev/sda1               1014M  145M  870M   15% /boot
tmpfs                    783M     0  783M    0% /run/user/0
/dev/mapper/centos-data   32G  5.5G   26G   18% /data
/dev/mapper/centos-home   10G   33M   10G    1% /home

]# cd /data/
]# ls -l
总用量 1545496
drwxr-xr-x. 16 3001 3001 4096 4月 23 2020 ahi-python
-rw-r–r--. 1 root root 1582580764 3月 1 10:13 ahi-python-v1.0.12-20200423.tar.gz

]# ls -l ahi-python
总用量 152
drwxr-xr-x. 2 3001 3001 8192 4月 23 2020 bin
-rwxr-xr-x. 1 3001 3001 25395 4月 23 2020 CHANGES
drwxr-xr-x. 2 3001 3001 30 4月 23 2020 compiler_compat
drwxr-xr-x. 2 3001 3001 8192 4月 23 2020 conda-meta
drwxr-xr-x. 2 3001 3001 6 12月 19 2018 envs
drwxr-xr-x. 6 3001 3001 63 4月 23 2020 etc
drwxr-xr-x. 21 3001 3001 4096 4月 23 2020 include
drwxr-xr-x. 19 3001 3001 12288 4月 23 2020 lib
-rwxr-xr-x. 1 3001 3001 35146 4月 23 2020 LICENSE
-rw-r–r--. 1 3001 3001 4134 3月 2 2018 LICENSE.txt
drwxr-xr-x. 3 3001 3001 18 4月 23 2020 man
-rwxr-xr-x. 1 3001 3001 5641 4月 23 2020 PKG-INFO.rst
drwxr-xr-x. 105 3001 3001 12288 4月 23 2020 pkgs
-rwxr-xr-x. 1 3001 3001 11296 4月 23 2020 README.rst
drwxr-xr-x. 20 3001 3001 268 4月 23 2020 share
drwxr-xr-x. 3 3001 3001 146 4月 23 2020 ssl
drwxr-xr-x. 3 3001 3001 19 4月 23 2020 var
drwxr-xr-x. 3 3001 3001 21 12月 19 2018 x86_64-conda_cos6-linux-gnu
drwxr-xr-x. 2 3001 3001 27 4月 23 2020 xgboost

]# find ./ -name *.gz|xargs ls -l
-rw-r–r--. 1 root root 1582580764 3月 1 10:13 ./ahi-python-v1.0.12-20200423.tar.gz
[root@localhost data]# tar -tf ./ahi-python-v1.0.12-20200423.tar.gz|head -n 10
ahi-python/
ahi-python/PKG-INFO.rst
ahi-python/LICENSE.txt
ahi-python/.condarc
ahi-python/bin/
ahi-python/bin/reset
ahi-python/bin/freetype-config
ahi-python/bin/python2.7
ahi-python/bin/genrb
ahi-python/bin/derb

]# find ./ -name *.txt|xargs grep “termcolor”
./ahi-python/lib/python2.7/site-packages/termcolor-1.1.0.dist-info/top_level.txt:termcolor
]# cat ./ahi-python/lib/python2.7/site-packages/termcolor-1.1.0.dist-info/top_level.txt
termcolor

]# rm -rf /data/*
]# ls -l /data/
总用量 0

#发现误删除文件后，立马把误删除文件所在的分区设置成只读状态，或者卸载掉该分区,让分区没有写操作
]# umount /data/

使用xfs_undelete工具修复

误删文件所在的文件系统格式是xfs，所以选择了xfs_undelete工具进行修复

https://github.com/ianka/xfs_undelete

源码安装tcllib

# tar -xf pgs.tar.gz
# cd pgs/
# tar -xf tcl8.6.11-src.tar.gz
# cd tcl8.6.11/unix/
# ./configure && make && make install
....
....
....
Installing /opt/pgs/tcl8.6.11/pkgs/thread2.8.6/generic/tclThread.h
Installing documentation in /usr/local/share/man
Installing /opt/pgs/tcl8.6.11/pkgs/thread2.8.6/doc/man/thread.n
Installing /opt/pgs/tcl8.6.11/pkgs/thread2.8.6/doc/man/tpool.n
Installing /opt/pgs/tcl8.6.11/pkgs/thread2.8.6/doc/man/tsv.n
Installing /opt/pgs/tcl8.6.11/pkgs/thread2.8.6/doc/man/ttrace.n
make[1]: 离开目录“/opt/pgs/tcl8.6.11/unix/pkgs/thread2.8.6”

]# cd /opt/pgs/
]# ls -l
总用量 14988
-rw-r–r--. 1 root root 1980564 2月 23 21:21 tcl-8.5.13-8.el7.x86_64.rpm
drwxr-xr-x. 14 503 games 4096 12月 31 09:45 tcl8.6.11
-rw-------. 1 root root 10259009 2月 23 21:17 tcl8.6.11-src.tar.gz
-rw-r–r--. 1 root root 3068188 7月 14 2015 tcllib-1.14-1.el7.noarch.rpm
-rw-------. 1 root root 26664 2月 23 21:17 xfs_undelete-master.zip
# yum install -y tcllib*.rpm

执行xfs_undelete工具找回误删的文件

]# unzip xfs_undelete-master.zip
]# cd xfs_undelete-master
]# ls -l
总用量 88
-rw-r--r--. 1 root root 35149 11月 11 20:23 LICENSE
-rw-r--r--. 1 root root 12538 11月 11 20:23 README.md
-rw-r--r--. 1 root root   150 11月 11 20:23 shell.nix
-rwxr-xr-x. 1 root root 18080 11月 11 20:23 xfs_undelete
-rw-r--r--. 1 root root  8725 11月 11 20:23 xfs_undelete.man

]# ./xfs_undelete 2021-03-01 /dev/mapper/centos-data

#存放在目录下./xfs_undeleted，文件和之前的有差异，根据文件比对找到对应的数据，主要恢复sh、py和zip文件

修复文件比对

]# find ./ -name *.gz|xargs ls -l
-rw-r--r--. 1 root root 1582580764 3月   1 10:13 ./2021-02-24-21-00_423425453.tar.gz
[root@localhost data]# tar -tf ./2021-02-24-21-00_423425453.tar.gz|head -n 10
ahi-python/
ahi-python/PKG-INFO.rst
ahi-python/LICENSE.txt
ahi-python/.condarc
ahi-python/bin/
ahi-python/bin/reset
ahi-python/bin/freetype-config
ahi-python/bin/python2.7
ahi-python/bin/genrb
ahi-python/bin/derb

]# find ./ -name *.txt|xargs grep “termcolor”
./xfs_undeleted/2021-02-25-21-00_4194699.txt:termcolor
]# cat ./xfs_undeleted/2021-02-25-21-00_4194699.txt
termcolor

使用testdisk工具找回文件

这个工具使用比较简单，无需源码编译，解压即可使用

https://www.cgsecurity.org/wiki/TestDisk

photorec找回文件

]# tar -xf testdisk-7.2-WIP.linux26-x86_64.tar.bz2 
]# cd testdisk-7.2-WIP
]# ]# mkdir data_recovery
]# ./photorec_static 
  PhotoRec is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 107 GB / 100 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/mapper/centos-data - 33 GB / 31 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/mapper/centos-home - 10 GB / 10 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/mapper/centos-root - 53 GB / 50 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/mapper/centos-swap - 8455 MB / 8064 MiB (RO) - QEMU QEMU HARDDISK
Disk /dev/sr0 - 962 MB / 918 MiB (RO) - QEMU DVD-ROM
Disk /dev/dm-0 - 53 GB / 50 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/dm-1 - 8455 MB / 8064 MiB (RO) - QEMU QEMU HARDDISK
Disk /dev/dm-2 - 10 GB / 10 GiB (RO) - QEMU QEMU HARDDISK
Disk /dev/dm-3 - 33 GB / 31 GiB (RO) - QEMU QEMU HARDDISK

>[Proceed ] [ Quit ]

#选择/dev/mapper/centos-data逻辑分区 ，Proceed继续
Disk /dev/mapper/centos-data - 33 GB / 31 GiB (RO) - QEMU QEMU HARDDISK

 Partition                  Start        End    Size <span class="token keyword">in</span> sectors
  Unknown                  0   0  1 65257471   0  1   65257472 <span class="token punctuation">[</span>Whole disk<span class="token punctuation">]</span>

> P XFS 5 0 0 1 65257471 0 1 65257472

>[ Search ] [Options ] [File Opt] [ Quit ]

#选择XFS分区，file opt可以选择修复的文件类型，如txt，压缩等等，最后选择search继续

To recover lost files, PhotoRec needs to know the filesystem type where the
file were stored:
[ ext2/ext3 ] ext2/ext3/ext4 filesystem
>[ Other ] FAT/NTFS/HFS+/ReiserFS/….

#选择other文件系统，enter继续
Q to quit
Directory /opt/testdisk-7.2-WIP
>drwxr-xr-x 1000 1000 4096 1-Mar-2021 11:32 .
drwxr-xr-x 0 0 106 1-Mar-2021 10:41 …
drwxr-xr-x 0 0 6 1-Mar-2021 11:32 data_recovery
drwxr-xr-x 1000 1000 113 21-Feb-2021 01:04 icons
drwxr-xr-x 1000 1000 24 21-Feb-2021 01:04 jni
drwxr-xr-x 1000 1000 19 21-Feb-2021 01:19 l
-rw-r–r-- 1000 1000 216 12-Nov-2007 00:21 AUTHORS
-rw-r–r-- 1000 1000 17987 16-Jun-2006 06:01 COPYING
-rw-r–r-- 1000 1000 232308 7-Jul-2019 22:10 ChangeLog
-rw-r–r-- 1000 1000 117 7-Jul-2019 22:15 INFO
-rw-r–r-- 1000 1000 19633 8-Jul-2019 01:16 NEWS
-rw-r–r-- 1000 1000 2187 2-Aug-2020 14:14 README.md
-rw-r–r-- 1000 1000 2256 25-Feb-2016 00:32 README_dev_photorec.txt
-rw-r–r-- 1000 1000 344 22-Apr-2008 01:32 THANKS
-rw-r–r-- 1000 1000 40 21-Feb-2021 01:19 VERSION
-rw-r–r-- 1000 1000 504 24-Dec-2017 22:21 documentation.html
-rw-r–r-- 1000 1000 907 21-Feb-2021 01:18 fidentify.8
-rwxr-xr-x 1000 1000 4089944 21-Feb-2021 01:18 fidentify_static
-rw-r–r-- 1000 1000 1174 21-Feb-2021 01:18 photorec.8
-rw-r–r-- 0 0 40960 1-Mar-2021 11:28 photorec.se2
-rwxr-xr-x 1000 1000 10769600 21-Feb-2021 01:18 photorec_static
-rw-r–r-- 1000 1000 301 8-Jul-2019 01:12 readme.txt
-rw-r–r-- 1000 1000 1759 21-Feb-2021 01:18 testdisk.8
-rwxr-xr-x 1000 1000 8601488 21-Feb-2021 01:18 testdisk_static

#选择要恢复文件所要存放的路径
Keys: Arrow keys to select another directory
C when the destination is correct
Q to quit
Directory /opt/testdisk-7.2-WIP/data_recovery
>drwxr-xr-x 0 0 6 1-Mar-2021 11:32 .
drwxr-xr-x 1000 1000 4096 1-Mar-2021 11:32 …

#c开始恢复文件

修复文件比对

#和上面的一样

验证过的系统版本

Centos7.4 7.6 7.7 7.8