Linux rm/rm -rf误删除文件恢复

Linux rm/rm -rf误删除文件恢复

一,安装extundelete

二,查看被删除文件

1).

#查看分区

@Lenovo-XiaoXin-I2000:EASYU$ df -h
文件系统        容量  已用  可用 已用% 挂载点
udev            3.9G     0  3.9G    0% /dev
tmpfs           789M   59M  730M    8% /run
/dev/sda9        29G   23G  4.5G   84% /
/dev/sda3       996M  525M  472M   53% /media/jun/LRS_ESP
/dev/sda5       101G   81G   20G   81% /media/jun/Windows8_OS
/dev/sda6       310G  235G   59G   81% /media/jun/691a1209-5e63-4648-b357-469d45fcfbce

#卸载该磁盘分区(/dev/sda6为例)

# umount sudo unmount /dev/sda6

 

2).查看文件

注:一般一个分区挂载到一个目录下时，这个”根”目录的inode值为2

我们为了查看根目录所有文件，所以查看分区inode为2的这个部分

j@Lenovo-XiaoXin-I2000:EASYU$ sudo extundelete /dev/sda6 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 2515 groups loaded.
Group: 0
Contents of inode 2:
0000 | c0 41 e8 03 00 10 00 00 05 9b 85 5e a3 9a 85 5e | .A.........^...^
0010 | a3 9a 85 5e 00 00 00 00 e8 03 14 00 08 00 00 00 | ...^............
0020 | 00 00 08 00 f8 03 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 21 24 00 00 | ............!$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 20 00 00 00 50 b3 2f 7e 50 b3 2f 7e 7c cf 1e 12 |  ...P./~P./~|...
0090 | 31 ee 41 59 00 00 00 00 00 00 00 00 00 00 00 00 | 1.AY............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16832
Low 16 bits of Owner Uid: 1000
Size in bytes: 4096
Access time: 1585814277
Creation time: 1585814179
Modification time: 1585814179
Deletion Time: 0
Low 16 bits of Group Id: 1000
Links count: 20
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9249, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
.Trash-1000                                       17170433
msm-code                                          18087937
Codeback                                          1709316
sign_qsee                                         442            Deleted
vitality                                          524290
.goutputstream-IWGHI0                             12             Deleted
android_kernel_asus_sdm660-S240                   15597570
Project                                           1703937
android-ndk-r13b                                  17826480
android-ndk-r21                                   15990787
boot.img                                          10394          Deleted
firmware-update                                   1048679        Deleted
system.transfer.list                              10395          Deleted
vendor.transfer.list                              10396          Deleted
build.config.goldfish.x86_64                      10402          Deleted
build.sh                                          10418          Deleted
certs                                             15728727       Deleted
crypto                                            15728734       Deleted
drivers                                           15728885       Deleted
firmware                                          16125271       Deleted
WW__ZB_414_20200227_debug.zip                     45597606566    Deleted
fs                                                16125457       Deleted
include                                           16127334       Deleted
init                                              17826480       Deleted
ipc                                               17826495       Deleted

--------------------------------

注:标记为”Deleted”的文件则是被删除的文件

 

3).恢复指定的文件

注: 默认被删文件会恢复到当前目录下的RECOVERED_FILES目录中去

@Lenovo-XiaoXin-I2000:EASYU$ sudo extundelete --restore-file WW__ZB_414_20200227_debug.zip  /dev/sda6  
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 2515 groups loaded.
Loading journal descriptors ... 31306 descriptors loaded.

Successfully restored file WW__ZB_414_20200227_debug.zip

 

# cd RECOVERED_FILES/

# ll

----------------

-rw-r--r-- 1 root root 52592 8月  13 07:18 WW__ZB_414_20200227_debug.zip

----------------

 

4).完全恢复设备上文件

# extundelete --restore-all /dev/sda6

# ll

-----------------------------------

总用量 34464

-----------------------------------

 

-rw-r--r-- 1 root root    52592 8月  13 07:18 WW__ZB_414_20200227_debug.zip

-rw-r--r-- 1 root root    52592 8月  13 07:24 WW__ZB_414_20200227_debug.zip.v1

-----------------------------------

注:这里完全恢复并不会把之前恢复的pic.jpg文件覆盖掉，而是重命名为WW__ZB_414_20200227_debug.zip.v1

 

5).恢复指定的时间点后被删文件

a).指定一个时间点

# date -d "Sep 4 03:09:13 2013" +%s

------------------

1378235353

------------------

b).恢复这个时间点后的文件

# extundelete --restore-all --after “1378235353” /dev/sda6

--------------------

..........

--------------------

注:如果要恢之前的就用before参数。extundelete命令与after结合使用，在进行恢复时非常有用，可以过滤掉那太旧的文件，减小恢复压力。

 

6).检验是否恢复成功

# md5sum RECOVERED_FILES/WW__ZB_414_20200227_debug.zip

------------------------------------

8ccqq655fb4ba8c676d5c63c6d5fcb74  RECOVERED_FILES/WW__ZB_414_20200227_debug.zip

------------------------------------

上传刚才误删的mysql安装包

# rz

...

# md5sum WW__ZB_414_20200227_debug.zip

---------------------------------

8ccqq655fb4ba8c676d5c63c6d5fcb74  WW__ZB_414_20200227_debug.zip

---------------------------------

MD5值相同，恢复成功