首页 > 系统相关 >Linux下面误删除文件使用extundelete工具恢复介绍

Linux下面误删除文件使用extundelete工具恢复介绍

时间:2023-05-08 13:14:12浏览次数:41  
标签:误删除 FILES 00 extundelete Linux txt root localhost

1.使用rz命令上传extundelete-0.2.4.tar.bz2到/tmp文件夹下并解压软件。

1 [root@localhost tmp]# tar -jxvf extundelete-0.2.4.tar.bz2

2.进入到extundelete解压的目录下面,执行编译安装。

1 2 3 4 5 6 7 8 9 10 11 [root@localhost test]# cd /tmp [root@localhost tmp]# ls extundelete-0.2.4          lrzsz-0.12.20         pulse-0Wu68Rqve4hx extundelete-0.2.4.tar.bz2  lrzsz-0.12.20.tar.gz  virtual-root.b6Z0Gt [root@localhost tmp]# cd extundelete-0.2.4 [root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4 configure: error: Can't find ext2fs library   #根据提示找到ext2fs库文件进行安装,执行yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel [root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4 Writing generated files to disk
1 2 3 4 5 6 [root@localhost extundelete-0.2.4]# make make -s all-recursive Making all in src [root@localhost extundelete-0.2.4]# make install Making install in src   /usr/bin/install -c extundelete '/usr/local/bin'

3.新添加一块硬盘/dev/sdb1并划分区格式化挂载到/test,新建文件和目录如下。

[root@localhost /]# tree test
test
├── 1.txt
├── a
│   ├── a.txt
│   └── b
│   ├── a.txt
│   └── c
│   ├── a.txt
│   └── d
├── a.txt
├── hosts
├── kong.txt
├── lost+found
└── passwd

5 directories, 8 files

4.进入到挂载目录/test,然后删除挂载点里面的文件并卸载磁盘。

[root@localhost /]# rm -rf a a.txt 1.txt hosts kong.txt passwd
[root@localhost /]# ls /test
lost+found
[root@localhost /]# umount /test

5.使用extundelete查看/dev/sdb1目录和文件的inode号。

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 [root@localhost ~]# extundelete /dev/sdb1 --inode 2 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 41 groups loaded. Group: 0 Contents of inode 2: 0000 | ed 41 00 00 00 10 00 00 f4 6e 9d 5a f2 6e 9d 5a | .A.......n.Z.n.Z 0010 | f2 6e 9d 5a 00 00 00 00 00 00 03 00 08 00 00 00 | .n.Z............ 0020 | 00 00 00 00 00 00 00 00 39 03 00 00 00 00 00 00 | ........9....... 0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0080 | 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0090 | bd 68 9d 5a 00 00 00 00 00 00 00 00 00 00 00 00 | .h.Z............ 00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................   Inode is Allocated File mode: 16877 Low 16 bits of Owner Uid: 0 Size in bytes: 4096 Access time: 1520266996 Creation time: 1520266994 Modification time: 1520266994 Deletion Time: 0 Low 16 bits of Group Id: 0 Links count: 3 Blocks count: 8 File flags: 0 File version (for NFS): 0 File ACL: 0 Directory ACL: 0 Fragment address: 0 Direct blocks: 825, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 Indirect block: 0 Double indirect block: 0 Triple indirect block: 0   File name                                       | Inode number | Deleted status .                                                 2 ..                                                2 lost+found                                        11 1.txt                                             12             Deleted a                                                 8017           Deleted hosts                                             13             Deleted passwd                                            14             Deleted a.txt                                             15             Deleted kong.txt                                          16             Deleted

6.使用extundelete命令进行文件和目录的恢复。

(1)通过inode号恢复(文件名会有变更);

1 2 3 4 5 6 7 8 9 10 11 [root@localhost test]# extundelete /dev/sdb1 --restore-inode 12 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 41 groups loaded. Loading journal descriptors ... 101 descriptors loaded. [root@localhost test]# ls RECOVERED_FILES [root@localhost test]# cd RECOVERED_FILES/ [root@localhost RECOVERED_FILES]# ls file.12 [root@localhost RECOVERED_FILES]# cat file.12 1111

(2)通过文件名恢复;

1 2 3 4 5 6 7 8 9 10 11 12 13 14 [root@localhost RECOVERED_FILES]# extundelete /dev/sdb1 --restore-file passwd NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 41 groups loaded. Loading journal descriptors ... 101 descriptors loaded. Successfully restored file passwd [root@localhost RECOVERED_FILES]# cd RECOVERED_FILES/ [root@localhost RECOVERED_FILES]# cat passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

(3)通过目录名称恢复(空目录是不会被恢复的);

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 [root@localhost test]# extundelete /dev/sdb1 --restore-directory a NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 41 groups loaded. Loading journal descriptors ... 101 descriptors loaded. Searching for recoverable inodes in directory a ... 13 recoverable inodes found. Looking through the directory structure for deleted files ... 7 recoverable inodes still lost. [root@localhost test]# ls RECOVERED_FILES [root@localhost test]# cd RECOVERED_FILES/ [root@localhost RECOVERED_FILES]# ls a [root@localhost RECOVERED_FILES]# tree a a ├── a.txt └── b     ├── a.txt     └── c         └── a.txt   2 directories, 3 files

(4)恢复所有文件和目录,不包括空文件和空目录;

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 [root@localhost test]# extundelete /dev/sdb1 --restore-all NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 41 groups loaded. Loading journal descriptors ... 101 descriptors loaded. Searching for recoverable inodes in directory / ... 13 recoverable inodes found. Looking through the directory structure for deleted files ... 1 recoverable inodes still lost. [root@localhost test]# ls RECOVERED_FILES [root@localhost test]# cd RECOVERED_FILES/ [root@localhost RECOVERED_FILES]# ls 1.txt  a  a.txt  hosts  kong.txt  passwd [root@localhost RECOVERED_FILES]# tree . ├── 1.txt ├── a │   ├── a.txt │   └── b │       ├── a.txt │       └── c │           └── a.txt ├── a.txt ├── hosts ├── kong.txt └── passwd

标签:误删除,FILES,00,extundelete,Linux,txt,root,localhost
From: https://www.cnblogs.com/mayunkuo/p/17381405.html

相关文章

  • linux环境部署--MySQL5.7二进制源码文件安装
    linux环境部署--MySQL5.7二进制源码文件安装mysql-5.7.11-Linux-glibc2.5-x86_64.tar提取码:1999MySQL5.7卸载1、将安装包解压到/usr/local/sudotarzxvfmysql-5.7.11-Linux-glibc2.5-x86_64.tar.gz-C/usr/local/2、解压后为了方便后面操作可把解压后文件名修改为mysql......
  • Shortcut of Chrome on Windows & Linux
    ShortcutofChromeonWindows&LinuxTab&windowshortcutsActionShortcutOpenanewwindowCtrl+nOpenanewwindowinIncognitomodeCtrl+Shift+nOpenanewtab,andjumptoitCtrl+tReopenpreviouslyclosedtabsinthe......
  • linux系统根目录下常见目录作用
    在Linux下一切皆文件,所有的文件都挂载在一个根文件上。一般有bin、boot、dev等目录。1.根文件内核启动后挂载的第一个文件系统2.bin存放系统的二进制命令(cd、ls、rm、mv)3.bootLinux内核和引导程序所需的目录4.lib/lib32/ilb64程序运行必要的链接库5.ect系统管理和维护方面的......
  • Linux - IO多路复用之select
    1.IO多路转接(复用) IO多路转接也称为IO多路复用,它是一种网络通信的手段(机制),通过这种方式可以同时监测多个文件描述符并且这个过程是阻塞的,一旦检测到有文件描述符就绪(可以读数据或者可以写数据)程序的阻塞就会被解除,之后就可以基于这些(一个或多个)就绪的文件描述符进行......
  • Linux - IO多路复用之epoll
    1.epoll概述epoll全称eventpoll,是linux内核实现IO多路转接/复用(IOmultiplexing)的一个实现。IO多路转接的意思是在一个操作里同时监听多个输入输出源,在其中一个或多个输入输出源可用的时候返回,然后对其的进行读写操作。epoll是select和poll的升级版,相较于这两个......
  • Linux - IO多路复用之poll
    1.poll函数poll的机制与select类似,与select在本质上没有多大差别,使用方法也类似,下面的是对于二者的对比:内核对应文件描述符的检测也是以线性的方式进行轮询,根据描述符的状态进行处理poll和select检测的文件描述符集合会在检测过程中频繁的进行用户区和内核区的拷贝,......
  • linux 中 xargs 中的 -i选项
     001、不使用-i选项[root@PC1test]#lsabvaabvbabvcabvddir1dir2dir3dir4dir5[root@PC1test]#ls|xargsmv{}{}.bak##不使用-i选项mv:cannotstat‘{}’:Nosuchfileordirectorymv:cannotstat‘{}.bak’:Nosuchfileordirecto......
  • 初次安装Linux 1Panel面板体验
    初次安装Linux1Panel面板体验1Panel是Linux下的一款服务器管理工具。和宝塔相比更加轻量化。相比之下各有优点,本文让我们一起来安装1Panel面板。面板优势快速建站 :深度集成WordPress和Halo,域名绑定、SSL证书配置等一键搞定高效管理 通过Web端轻松管理Linux......
  • linux 内核回收
    内核主要有4种LRU链表:enum lru_list{LRU_INACTIVE_ANON = LRU_BASE,LRU_ACTIVE_ANON = LRU_BASE + LRU_ACTIVE,LRU_INACTIVE_FILE = LRU_BASE + LRU_FILE,LRU_ACTIVE_FILE = LRU_BASE + LRU_FILE + LRU_ACTIVE,LRU_UNEVICTABLE,NR_LRU_LISTS};inactive......
  • Linux运行卡死【INFO: task multipathd:5832 blocked for more than 120 seconds】
    目录问题背景分析过程解决方法问题背景系统在正常运行过程中,突然收到监控平台告警,服务器无法ping通。分析过程机房人员重启服务器后,查看/var/log/messages日志发现如下报错:May619:43:45xxxkernel:INFO:taskmultipathd:5832blockedformorethan120seconds.M......