Ubuntu ext4文件系统下恢复误删除文件

linux ext3 ext4文件系统下 恢复 rm －rf 误删除文件  

今天一时手快 rm -rf .* ，删除了一个重要邮件目录，幸好通过extundelete恢复了。

记下操作流程：

1.准备工作

主要通过 extundelete
0.2.0完成恢复

需要依赖两个包

sudo aptitude install e2fsprogs e2fslibs-dev

下载页面http://extundelete.sourceforge.net/

快速下载： download
extundelete

tar -xjf extundelete-0.2.0.tar.bz2

cd extundelete-0.2.0

编译三部曲

./configure
make
sudo make install

2.如果分区已经挂载，先umount，并且在将要恢复的地方查看空间大小

df -h ./

文件系统               1K-块        已用     可用 已用% 挂载点
/dev/sda3             18129292   2651744  14541764  16% /
/dev/sda1               194442     12197    172206   7% /boot

...

要 umount  /home!!!

如果你要恢复的是根目录或者系统目录就只有拿硬盘挂到另外一台电脑上操作了。

3.恢复制定分区下所有删除文件，默认恢复到执行命令的目录下，文件夹名字为RECOVERED_FILES，使用详情请参考：extundelete --help 运行的结果

恢复/dev/sda3里一个被误删除的文件

 

extundelete /dev/sda3 --restore-file /an/important/file

 

恢复/dev/sda3里一个被误删除的文件夹

extundelete /dev/sda3 --restore-directory /an/important

eg: grant/workspaces/...

 

恢复/dev/sda3里所有被删除的东西

extundelete /dev/sda3 --restore-all

sudo extundelete /dev/sda8 –restore-all

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

$ extundelete --help

Usage: extundelete [options] [--] device-file

Options:

  --version, -[vV]       Print version and exit successfully.

  --help,                Print this help and exit successfully.

  --superblock           Print contents of superblock in addition to the rest.

                         If no action is specified then this option is implied.

  --journal              Show content of journal.

  --after dtime          Only process entries deleted on or after 'dtime'.

  --before dtime         Only process entries deleted before 'dtime'.

Actions:

  --inode ino            Show info on inode 'ino'.

  --block blk            Show info on block 'blk'.

  --restore-inode ino[,ino,...]

                         Restore the file(s) with known inode number 'ino'.

                         The restored files are created in ./RESTORED_FILES

                         with their inode number as extension (ie, file.12345).

  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root

                         of the partition and does not start with a '/' (it

                         must be one of the paths returned by --dump-names).

                         The restored file is created in the current

                         directory as 'RECOVERED_FILES/path'.

  --restore-files 'path' Will restore files which are listed in the file 'path'.

                         Each filename should be in the same format as an option

                         to --restore-file, and there should be one per line.

  --restore-all          Attempts to restore everything.

  -j journal             Reads an external journal from the named file.

  -b blocknumber         Uses the backup superblock at blocknumber when opening

                         the file system.

  -B blocksize           Uses blocksize as the block size when opening the file

                         system.  The number should be the number of bytes.

[root@yznvm1 yzn]# extundelete /dev/sda3 --restore-file /home/yzn/helloworld/Makefile.am        
WARNING: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 

it was improperly unmounted, and you should run fsck before continuing.

If you decide to continue, extundelete may overwrite some of the deleted

files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 143 groups loaded.
Loading journal descriptors ... 29535 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Restored inode 4223596 to file RECOVERED_FILES/home/yzn/helloworld/Makefile.am

 

ok,这样就恢复成功了。

当然文件不能保证一定恢复成功，我的另外一个文件恢复出来是乱码，还有一个文件报错找不到inode.