Linux文件误删恢复

Posted 2021-12-04 zhangan

Linux文件误删恢复

 

一、需求研究

针对日常维护操作，难免会出现文件误删除的操作。大家熟知linux文件系统不同win有回收站，删除后的文件可以到垃圾箱寻回，要知道linux文件修复比较费劲，网络上面的文档也是五花八门。所以本次研究一种比较靠谱的文件和目录恢复方法，也给维护人员留一条后路。

分析对比debugfs、testdisk 6.14、extundelete，对比各自官网介绍和操作说明本次决定研究extundelete对文件和目录的恢复操作。

 二、项目内容

1、工具安装部署

官方网站是http://extundelete.sourceforge.net/ ，其目前的稳定版本是extundelete-0.2.4.

工具下载

 wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

解压按装

依赖包

yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64

tar -jxvf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4

./configure

 

这时一般会报错；

Configuring extundelete 0.2.4
configure: error: in `/root/Desktop/extundelete-0.2.4‘:
configure: error: C++ compiler cannot create executables
See `config.log‘ for more details

经过查找知道需要安装gcc-c++包

yum -y install gcc gcc-c++

重新./configure显示
[[email protected] extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
configure: error: Can‘t find ext2fs library

经过查找知道缺少e2fsprogs-devel，下面开始安装

yum -y install e2fsprogs-devel


再./configure出现，表示成功了；

[[email protected] extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
Writing generated files to disk

make && make install

验证安装结果

extundelete -v

 

前提：如果确定文件被误删，在没有备份的情况下请马上对分区实施写入保护，df -h命令可以看出你的目录挂载在那个分区下（预防新的写入覆盖误删的块数据）

mount -o remount,ro /dev/sdxnum

2、文件恢复操作过程

恢复指定文件：

extundelete /dev/sdb1 --inode 2

可能会报下面错误

/usr/local/extundelete/bin/extundelete: Bad magic number in super-block when trying to open filesystem /dev/sda3

网上搜了下，lvm是有区别的，主要是lvm的设备名不是/dev/sda的形式了vgscan查看具体的卷名。最后发现我的卷名是/dev/vg_centosdesktop/lv_root,好了，现在就可以恢复了

原理：从根节点(inode=2)开始找到被删除文件的i节点，然后recover i节点。

以下操作模拟在/dev/sdb1 删除文件apache-tomcat-8.0.24.tar.gz 和目录tomcat-app1，

extundelete /dev/sdb1 --inode 2 NOTICE: Extended attributes are not restored. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. The partition should be unmounted to undelete any files without further data loss. If the partition is not currently mounted, this message indicates it was improperly unmounted, and you should run fsck before continuing. If you decide to continue, extundelete may overwrite some of the deleted files and make recovering those files impossible.  You should unmount the file system and check it with fsck before using extundelete. Would you like to continue? (y/n) y Loading filesystem metadata ... 4000 groups loaded. Group: 0 Contents of inode 2: 00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................   Inode is Allocated File mode: 16877 Low 16 bits of Owner Uid: 0 Size in bytes: 4096 Access time: 1482394360 Creation time: 1482394361 Modification time: 1482394361 Deletion Time: 0 Low 16 bits of Group Id: 0 Links count: 3 Blocks count: 8 File flags: 0 File version (for NFS): 0 File ACL: 0 Directory ACL: 0 Fragment address: 0 Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 Indirect block: 0 Double indirect block: 0 Triple indirect block: 0   File name                                       | Inode number | Deleted status .                                                 2 ..                                                2 lost+found                                        11 apache-tomcat-8.0.24.tar.gz                       13             Deleted apache-tomcat-8.0.24                              30670849       Deleted tomcat-app1                                       30670849       Deleted

 

关注红色信息

恢复命令（恢复过程不要在误删分区进行，谨防inode、block块相互覆盖）

extundelete /dev/sdb1 --restore-inode 13   根据inode信息进行文件恢复   extundelete /dev/sdb1 --restore-file apache-tomcat-8.0.24.tar.gz  根据文件名进行文件修复   修复后的文件存储在当前目录RECOVERED_FILES里面 ll RECOVERED_FILES/ -rw-r----- 1 root root 9106353 Dec 22 17:23 apache-tomcat-8.0.24.tar.gz -rw-r----- 1 root root 9106353 Dec 22 17:23 file.13

 

3、目录恢复操作过程

extundelete /dev/sdb1 --restore-directory /tomcat-app1 根据目录名称恢复目录   NOTICE: Extended attributes are not restored. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. The partition should be unmounted to undelete any files without further data loss. If the partition is not currently mounted, this message indicates it was improperly unmounted, and you should run fsck before continuing. If you decide to continue, extundelete may overwrite some of the deleted files and make recovering those files impossible.  You should unmount the file system and check it with fsck before using extundelete. Would you like to continue? (y/n) y Loading filesystem metadata ... 4000 groups loaded. Loading journal descriptors ... 1204 descriptors loaded. Searching for recoverable inodes in directory /tomcat-app1 ... 2405 recoverable inodes found. Looking through the directory structure for deleted files ...   ll RECOVERED_FILES/ -rw-r----- 1 root root 9106353 Dec 22 17:23 apache-tomcat-8.0.24.tar.gz -rw-r----- 1 root root 9106353 Dec 22 17:23 file.13 drwxr-x--- 6 root root    4096 Dec 22 17:27 tomcat-app1   恢复成功

 

4.重新挂载磁盘目录或者reboot重启都是ok的。

三、项目结果

根据上面操作证明extundelete 工具可以实现对误删数据的恢复，而且操作简单。

总结：

1、使用rm一定要谨慎

2、磁盘按照功能进行分区是必要的

3、最少掌握一种数据恢复方式