http://blog.csdn.net/pang601355182/article/details/7947011
extundelete需要依赖两个包
----e2fsprogs
下载地址:http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-1.41.14.tar.gz/download
----e2fsprogs-libs
下载地址:
http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-libs-1.41.14.tar.gz/download
----官网:http://www.sourceforge.net/ --> extundelete
下载地址:http://sourceforge.net/projects/extundelete/files/extundelete/0.2.0/extundelete-0.2.0.tar.bz2/download
tar -xjf extundelete-0.2.0.tar.bz2
按e2fsprogs -- e2fsprogs-libs -- extundelete的顺序逐一编译安装:
./configure
make
make install
必须先umount要恢复文件的分区或者把分区改为只读模式,命令:mount –o remout,ro 分区(例如:dev/hda1)
或者
mount -n -r -o remount /db 最好尽快将所在分区修改为只读方式,防止数据被覆盖使用。
# df -h
文件系统 容量 已用 可用 已用%% 挂载点
/dev/sda3 9.9G 6.7G 2.8G 71% /
tmpfs 736M 8.0K 736M 1% /dev/shm
/dev/sda1 97M 25M 68M 27% /boot
/dev/sdb1 20G 6.0G 13G 32% /var/www
假如有个分区/dev/sdb1,我把它挂载在/var/www。
cd /var/www
--------------恢复分区所有被删除的文件:
/usr/local/bin/extundelete /dev/sdb1 --restore-all
所以恢复的文件都会储存在当前目录下的一个名为RECOVERED_FILES目录下。
--------------根据时间:
假如删除的时间大概是2011-7-26 14:30
date -d "Jul 26 14:30" +%s
得出秒数 1234567890
恢复此时间后删除的所有文件
/usr/local/bin/extundelete /dev/sdb1 --after 1234567890 --restore-all
--------------根据文件名:
/usr/local/bin/extundelete /dev/sdb1 --restore-file '1'
--------------根据inode恢复文件。
查看文件inode:ls -i
/usr/local/bin/extundelete /dev/hda3 --restore-inode 222
--------------恢复多个文件:
创建一个文档,在文档输入文件的路径和名字,一个一行。如
restore的内容为:
/test/a
/test2/b
c
/usr/local/bin/extundelete /dev/hda3 --restore-files 'restore'
--------------恢复一个被误删除的文件
extundelete /dev/sda3 --restore-file /an/important/file
--------------恢复一个被误删除的文件夹
extundelete /dev/sda3 --restore-directory /an/important
==================================usr/local/bin/extundelete --help
Usage: /usr/local/bin/extundelete [options] [--] device-file
Options:
--version, -[vV] Print version and exit successfully.
--help, Print this help and exit successfully.
--superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
--journal Show content of journal.
--after dtime Only process entries deleted on or after 'dtime'.
--before dtime Only process entries deleted before 'dtime'.
Actions:
--inode ino Show info on inode 'ino'.
--block blk Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RESTORED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/' (it
must be one of the paths returned by --dump-names).
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-all Attempts to restore everything.
-j journal Reads an external journal from the named file.
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize Uses blocksize as the block size when opening the file
system. The number should be the number of bytes.
You have new mail in /var/spool/mail/root