您的位置：首页 > 运维架构 > Linux

恢复误删除的文件

2016-01-05 14:59 507 查看

1、安装extundelete
[root@xuegod62 ~]# tar jxvf extundelete-0.2.4.tar.bz2
[root@xuegod62 ~]# cd extundelete-0.2.4
[root@xuegod62 extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library

解决办法：
[root@xuegod62 extundelete-0.2.4]# uname -r
2.6.32-431.el6.x86_64
[root@xuegod62 extundelete-0.2.4]# rpm -ivh /mnt/Packages/e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm warning: /mnt/Packages/e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
1:e2fsprogs-devel ########################################### [100%]

[root@xuegod62 extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
You have new mail in /var/spool/mail/root
[root@xuegod62 extundelete-0.2.4]# make
make -s all-recursive
Making all in src
extundelete.cc:571: 警告：未使用的参数'flags'
[root@xuegod62 extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'

准备测试分区
[root@xuegod62 ~]# fdisk /dev/sda

WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
switch off the mode (command 'c') and change display units to
sectors (command 'u').

Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Selected partition 4
First cylinder (1593-2610, default 1593):
Using default value 1593
Last cylinder, +cylinders or +size{K,M,G} (1593-2610, default 2610): +1G

Command (m for help): p

Disk /dev/sda: 21.5 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000299f9

Device Boot Start End Blocks Id System
/dev/sda1 * 1 26 204800 83 Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2 26 1332 10485760 83 Linux
/dev/sda3 1332 1593 2097152 82 Linux swap / Solaris
/dev/sda4 1593 1724 1059294 83 Linux
Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: 设备或资源忙.
The kernel still uses the old table. The new table will be used at
the next reboot or after you run partprobe(8) or kpartx(8)
Syncing disks.
[root@xuegod62 ~]# reboot
[root@xuegod62 ~]# mkfs.ext4 /dev/sda4
[root@xuegod62 ~]# mkdir /sda4
[root@xuegod62 ~]# mount /dev/sda4 /sda4/
[root@xuegod62 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 9.9G 3.6G 5.9G 38% /
tmpfs 936M 72K 936M 1% /dev/shm
/dev/sda1 194M 34M 151M 19% /boot
/dev/sr0 3.6G 3.6G 0 100% /mnt
/dev/sda4 1019M 34M 934M 4% /sda4

准备测试文件
[root@xuegod62 ~]# cp /etc/passwd /sda4/
[root@xuegod62 ~]# cp /etc/hosts /sda4/
[root@xuegod62 ~]# mkdir -p /sda4/a/b/c
[root@xuegod62 ~]# cp /etc/passwd /sda4/a/
[root@xuegod62 ~]# touch /sda4/a/b/kong.txt

删除文件
[root@xuegod62 ~]# cd /sda4/
[root@xuegod62 sda4]# ls
a hosts lost+found passwd
[root@xuegod62 sda4]# rm -rf a hosts passwd

卸载要恢复的分区或者以只读的方式进行挂载
[root@xuegod62 ~]# umount /sda4/

恢复文件
查看要恢复分区的文件删除状态信息
[root@xuegod62 ~]# extundelete /dev/sda4 --inode 2
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11
passwd 12 Deleted
hosts 13 Deleted
a 7361 Deleted

方法一：通过inode进行恢复
[root@xuegod62 ~]# extundelete /dev/sda4 --restore-inode 12
[root@xuegod62 ~]# ls RECOVERED_FILES/
file.12
[root@xuegod62 ~]# diff /etc/passwd RECOVERED_FILES/file.12
方法二：通过文件名进行恢复
[root@xuegod62 ~]# extundelete /dev/sda4 --restore-file passwd
方法三：通过目录进行恢复
[root@xuegod62 ~]# extundelete /dev/sda4 --restore-directory a
方法四：恢复所有文件
[root@xuegod62 ~]# extundelete /dev/sda4 --restore-all

通过extundelete命令不能恢复空文件和空目录

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签： linux 删除文件 extundelete

相关文章推荐

新的分享

章节导航