Linux下面误删除文件使用extundelete工具恢复介绍
操作系统版本:CentOS release 6.4 (Final) 软件版本:extundelete-0.2.4.tar.bz2
PS:该软件恢复文件系统仅支持ext2/ext3/ext4
1.使用rz命令上传extundelete-0.2.4.tar.bz2到/tmp文件夹下并解压软件。
[root@localhost tmp]# tar -jxvf extundelete-0.2.4.tar.bz2
2.进入到extundelete解压的目录下面,执行编译安装。
[root@localhost test]# cd /tmp
[root@localhost tmp]# ls
extundelete-0.2.4 lrzsz-0.12.20 pulse-0Wu68Rqve4hx
extundelete-0.2.4.tar.bz2 lrzsz-0.12.20.tar.gz virtual-root.b6Z0Gt
[root@localhost tmp]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library #根据提示找到ext2fs库文件进行安装,执行yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost extundelete-0.2.4]# make
make -s all-recursive
Making all in src
[root@localhost extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
3.新添加一块硬盘/dev/sdb1并划分区格式化挂载到/test,新建文件和目录如下。
[root@localhost /]# tree test
test
├── 1.txt
├── a
│ ├── a.txt
│ └── b
│ ├── a.txt
│ └── c
│ ├── a.txt
│ └── d
├── a.txt
├── hosts
├── kong.txt
├── lost+found
└── passwd
5 directories, 8 files
4.进入到挂载目录/test,然后删除挂载点里面的文件并卸载磁盘。
[root@localhost /]# rm -rf a a.txt 1.txt hosts kong.txt passwd
[root@localhost /]# ls /test
lost+found
[root@localhost /]# umount /test
5.使用extundelete查看/dev/sdb1目录和文件的inode号。
[root@localhost ~]# extundelete /dev/sdb1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 f4 6e 9d 5a f2 6e 9d 5a | .A.......n.Z.n.Z
0010 | f2 6e 9d 5a 00 00 00 00 00 00 03 00 08 00 00 00 | .n.Z............
0020 | 00 00 00 00 00 00 00 00 39 03 00 00 00 00 00 00 | ........9.......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0090 | bd 68 9d 5a 00 00 00 00 00 00 00 00 00 00 00 00 | .h.Z............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1520266996
Creation time: 1520266994
Modification time: 1520266994
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 825, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0 File name | Inode number | Deleted status
. 2
.. 2
lost+found 11
1.txt 12 Deleted
a 8017 Deleted
hosts 13 Deleted
passwd 14 Deleted
a.txt 15 Deleted
kong.txt 16 Deleted
6.使用extundelete命令进行文件和目录的恢复。
(1)通过inode号恢复(文件名会有变更);
[root@localhost test]# extundelete /dev/sdb1 --restore-inode 12
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
file.12
[root@localhost RECOVERED_FILES]# cat file.12
1111
(2)通过文件名恢复;
[root@localhost RECOVERED_FILES]# extundelete /dev/sdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Successfully restored file passwd
[root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# cat passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
(3)通过目录名称恢复(空目录是不会被恢复的);
[root@localhost test]# extundelete /dev/sdb1 --restore-directory a
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Searching for recoverable inodes in directory a ...
13 recoverable inodes found.
Looking through the directory structure for deleted files ...
7 recoverable inodes still lost.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
a
[root@localhost RECOVERED_FILES]# tree a
a
├── a.txt
└── b
├── a.txt
└── c
└── a.txt 2 directories, 3 files
(4)恢复所有文件和目录,不包括空文件和空目录;
[root@localhost test]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 41 groups loaded.
Loading journal descriptors ... 101 descriptors loaded.
Searching for recoverable inodes in directory / ...
13 recoverable inodes found.
Looking through the directory structure for deleted files ...
1 recoverable inodes still lost.
[root@localhost test]# ls
RECOVERED_FILES
[root@localhost test]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ls
1.txt a a.txt hosts kong.txt passwd
[root@localhost RECOVERED_FILES]# tree
.
├── 1.txt
├── a
│ ├── a.txt
│ └── b
│ ├── a.txt
│ └── c
│ └── a.txt
├── a.txt
├── hosts
├── kong.txt
└── passwd
Linux下面误删除文件使用extundelete工具恢复介绍的更多相关文章
- 高性能Linux服务器 第6章 ext3文件系统反删除利器ext3grep extundelete工具恢复rm -rf 误删除的文件
高性能Linux服务器 第6章 ext3文件系统反删除利器ext3grep extundelete工具恢复rm -rf 误删除的文件 只能用于ext3文件系统!!!!!!!高俊峰(高性能Linux ...
- Linux修改profile文件改错了,恢复的方法
Linux修改profile文件改错了,恢复的方法在改profile的时候,改出问题了,除了cd以外的命令基本都不能用了,连vi都不能用了,上网查了下,用export PATH=/usr/bin:/u ...
- centOS6.4 extundelete工具恢复rm -rf 删除的目录
PS:补充下,我在fedora 19上运行的时候遇到的一个问题: [root@localhost extundelete-]# ./configure Configuring extundelete ...
- centOS6.4 extundelete工具恢复rm -rf 删除的目录[转]
原文:http://www.cnblogs.com/patf/p/3368765.html PS:补充下,我在fedora 19上运行的时候遇到的一个问题: 1 [root@localhost ext ...
- java安全删除一个文件,防止工具恢复数据
解决移动端文件删除的安全问题:file.delect() Java 确保安全删除某个文件 http://outofmemory.cn/code-snippet/14222/Java-securit ...
- linux命令行todo列表管理工具Taskwarrior介绍
Taskwarrior 是一款在命令行下使用的TODO列表管理工具,或者说任务管理工具,灵活,快速,高效. 安装 在ubuntu 14.04 中,可从官方仓库安装task软件包 sudo apt-ge ...
- linux下查看文件编码及修改编码介绍
1.在Vim中可以直接查看文件编码:set fileencoding即可显示文件编码格式.如果你只是想查看其它编码格式的文件或者想解决用Vim查看文件乱码的问题,那么你可以在~/.vimrc 文件中添 ...
- Linux 文件内容查看工具介绍-cat,less,more,tail,head
Linux 文件内容查看工具介绍 作者:北南南北来自:LinuxSir.Org摘要: 本文讲述几种常用文件内容的查看工具,比如cat.more.less.head.tail等,把这些工具最常用的参数. ...
- linux tail 命令详解!Linux 文件内容查看工具介绍
转:http://blog.csdn.net/carzyer/article/details/4759593 1.cat 显示文件连接文件内容的工具: cat 是一个文本文件查看和连接工具.查看一个文 ...
随机推荐
- 【leetcode】1187. Make Array Strictly Increasing
题目如下: Given two integer arrays arr1 and arr2, return the minimum number of operations (possibly zero ...
- Postman(二)、调试模式
postman提供了一个调试模式,很方便我们写脚本以及断言 在脚本中用console.log()打印,到控制台查看 比如写入如下脚本: 点击Send后,在控制台可以看到如下信息
- CodeForces 538F A Heap of Heaps
题意 给定一个长度为n的数组A,将它变为一颗k叉树(1 <= k <= n - 1)(堆的形式编号). 问对于每一个k,有多少个节点小于它的父节点. 解题 显然,最初的想法是暴力.因为树的 ...
- 工具类--BeanUtils----Bean转换工具
package com.zhouyy.netBank.util; import java.beans.PropertyDescriptor; import java.lang.reflect.Fiel ...
- Android_(控件)动态添加或删除Spinner下拉菜单
使用ArrayList动态数组的依赖性实现动态增减Spinner下拉菜单选项功能. 设置一个EditText输入框,当用户输入了文字并单击[添加]按钮的同时,就会将输入的值添加Spinner至下拉菜单 ...
- 使用jQuery创建可删除添加行的动态表格,超级简单实用的方法
使用jQuery动态的添加和删除表格里面的行,不多说了直接上代码. <!DOCTYPE html> <html> <head> <meta charset=& ...
- 数据重塑图解—Pivot, Pivot-Table, Stack and Unstack
Pivot pivot函数用于创建一个新的派生表,该函数有三个参数:index, columns和values.你需要在原始表中指定这三个参数所对定的列名,接下来pivot函数会创建一个新的表格,其中 ...
- C++入门经典-例2.6-简单用cout输出字符
1:代码如下: // 2.6.cpp : 定义控制台应用程序的入口点. // #include "stdafx.h" #include <iostream> using ...
- js对象深拷贝、浅拷贝
浅拷贝1 //浅拷贝1 let obj01 = { name: 'Lily', age: '20', time: ['13', '15'], person: { name: 'Henry', age: ...
- TCP之LAST_ACK状态
前提: A:主动关闭: B:被动关闭: A执行主动关闭,发送FIN,B收到FIN,发送ACK,进入CLOSE_WAIT,B发送FIN,进入LAST_ACK等待最后一个ACK到来: 关闭方式: (1) ...