今天给大家介绍一个文件误删恢复的软件，extundelete，注意此软件只支持ext3或ext4文件系统，对ext4恢复率很高。
先说一下Linux文件系统的组成：由 文件名，inode，block 组成
data.txt –>inode –>block
文件名 存放文件的元数据信息 真正存放的数据
查看inode ：每一个文件都有一个inode
#ls -i data.txt
1320208 data.txt
# stat data.txt
File: “data.txt”
Size: 0 Blocks: 0 IO Block: 4096 普通空文件
Device: fb00h/64256d Inode: 1320208 Links: 1
Access: (0644/-rw-r–r–) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2020-04-26 22:26:15.971286718 +0800
Modify: 2020-04-26 22:26:15.971286718 +0800
Change: 2020-04-26 22:26:15.971286718 +0800
——————————————————————————————
误删除文件后，第一件事需要做什么是卸载需要恢复文件的分区或者以只读的方式挂载：
mount -o remount,ro /data
开始实验
软件准备，可以去百度下载extundelete，找不到 盘里有
链接：https://pan.baidu.com/s/1H88pcoA1N92t9SUbzYr2Cg 提取码：lokx
源码安装extundelete
tar jxvf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4
yum install -y e2fsprogs-devel gcc*
./configure
make
make install
准备新加一块盘，分区后，格式化为ext4系统，创建文件夹并挂载
1.在/data目录下添加一些测试文件
[root@oracle ~]# cp /var/log/boot.log /var/log/yum.log /data/
[root@oracle ~]# mkdir -p /data/AA/BB/CC
[root@oracle ~]# touch /data/AA/A
[root@oracle ~]# touch /data/AA/BB/B
[root@oracle ~]# touch /data/AA/BB/CC/C
[root@oracle ~]# echo “This is disk test” >/data/data.txt
2.模拟删除误操作
[root@oracle data]# rm -rf /data/*
3.通过inode节点查看被删除的文件
- [root@oracle ~]# extundelete /dev/sdb1 --inode 2
- NOTICE: Extended attributes are not restored.
- WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
- The partition should be unmounted to undelete any files without further data loss.
- If the partition is not currently mounted, this message indicates
- it was improperly unmounted, and you should run fsck before continuing.
- If you decide to continue, extundelete may overwrite some of the deleted
- files and make recovering those files impossible. You should unmount the
- file system and check it with fsck before using extundelete.
- Would you like to continue(y/n)
- y
- Loading filesystem metadata ... 16 groups loaded.
-
Group: 0
- Contents of inode 2:
-
0000 | ed 41 00 00 00 10 00 00 a2 ac a5 5e a2 ac a5 5e | .A.........^...^
-
0010 | a2 ac a5 5e 00 00 00 00 00 00 02 00 08 00 00 00 | ...^............
-
0020 | 00 00 08 00 09 00 00 00 0a f3 01 00 04 00 00 00 | ................
-
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 a1 20 00 00 | ............. ..
-
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
0080 | 1c 00 00 00 a4 a7 9b db a4 a7 9b db a4 95 21 db | ..............!.
-
0090 | c6 aa a5 5e 00 00 00 00 00 00 00 00 00 00 00 00 | ...^............
-
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
-
- Inode is Allocated
- File mode: 16877
- Low 16 bits of Owner Uid: 0
- Size in bytes: 4096
- Access time: 1587915938
- Creation time: 1587915938
- Modification time: 1587915938
- Deletion Time: 0
- Low 16 bits of Group Id: 0
- Links count: 2
- Blocks count: 8
- File flags: 524288
- File version (for NFS): 0
- File ACL: 0
- Directory ACL: 0
- Fragment address: 0
- Direct blocks: 127754, 4, 0, 0, 1, 8353, 0, 0, 0, 0, 0, 0
- Indirect block: 0
-
声明：本站部分文章及图片源自用户投稿，如本站任何资料有侵权请您尽早请联系jinwei@zod.com.cn进行处理,非常感谢！