Linux 安全工具之extundelete误删除恢复

Posted 毕竟我是杨小飞呀i

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Linux 安全工具之extundelete误删除恢复相关的知识,希望对你有一定的参考价值。

一:前言

在Linux中,我们通常会因为误删除文件而感到烦恼,rm -rf +文件  rf参数简直就是每个运维的噩梦,但是大家想过没,为什么删除文件那么快呢,为什么我们copy文件的时候那么慢。

其实不管大家是rm 还是rm -rf都是删除的文件名字而已,数据还是保存在磁盘扇区里面的,当然这只是我的理解,那么删除后我们要怎么恢复呢,下面实验将进行对extundelete工具的简单操作介绍,

 

二:实验环境

系统:CentOS6.4_x64-mini.iso

工具选择: extundelete-0.2.4.tar.bz2 

extundelete官网:http://extundelete.sourceforge.net/ 

备注:这里我全文全部为Linux命令,没有任何图片,加一个图片到blogs里面很累的。

再者环境我说明一下,我这里的实验目录是单独挂载到一个硬盘上的,不然搞得大家看不懂就很不好了,

说下我为什么挂载一个硬盘上呢,大家想下,企业中了为了安全的考虑,肯定会把数据盘和系统盘分开。

删除了数据盘的数据就必须马上umount下,不然数据二次写入,就是大牛来了也帮不了你了。这点和Windows一样,我想都会懂的。

 

 

三:实验前准备

创建目录,copy文件。

[[email protected] ~]#mkdir  /yang
[[email protected] ~]# mkfs.ext4 /dev/sdb 
[[email protected] ~]# mount /dev/sdb /yang/
[[email protected] ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       9.5G  3.6G  5.5G  39% /
tmpfs           242M     0  242M   0% /dev/shm
/dev/sda1       190M   27M  153M  15% /boot
/dev/sdb        4.8G   10M  4.6G   1% /yang
[[email protected] ~]# cp /etc/hosts /yang/
[[email protected] ~]# cp /etc/passwd /yang/
[[email protected] ~]# mkdir -p /yang/data1/
[[email protected] ~]# mkdir -p /yang/data2/
[[email protected] ~]# echo "data1.txt" > /yang/data1/data1.txt
[[email protected] ~]# echo "data2.txt" > /yang/data2/data2.txt
[[email protected] ~]# ls -r /yang/*
/yang/passwd  /yang/hosts

/yang/lost+found:

/yang/data2:
data2.txt

/yang/data1:
data1.txt


###以上为我实验环境的准备,命令都很简单,最后查看文件输出结果###

四、下载安装extundelete

[[email protected] ~]#wget  http://internode.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
[[email protected] ~]# tar jxvf extundelete-0.2.4.tar.bz2
[[email protected] ~]# cd extundelete-0.2.4
[[email protected] extundelete-0.2.4]# ls
acinclude.m4  autogen.sh   config.log  configure.ac  install-sh  Makefile.am  missing  src
aclocal.m4    config.h.in  configure   depcomp       LICENSE     Makefile.in  README
[[email protected] extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
configure: error: Cant find ext2fs library

###好的,到这里看到报错,怎么办呢,根据报错解决了###

这里报错说找不到ext2fs,找不到就装一个呗,怎么装呢,yum? 首先要确定下这个包,yum直接安装ext2fs肯定是没有的,接下来我们既然没那么多经验,不知道包名字,我们就rpm找就可以了,简单明了。

[[email protected] extundelete-0.2.4]# mount /dev/cdrom /mnt/
mount: block device /dev/sr0 is write-protected, mounting read-only
[[email protected] extundelete-0.2.4]# cd /mnt/
[[email protected] mnt]# ls
CentOS_BuildTag  GPL       Packages                  RPM-GPG-KEY-CentOS-6           RPM-GPG-KEY-CentOS-Testing-6
EFI              images    RELEASE-NOTES-en-US.html  RPM-GPG-KEY-CentOS-Debug-6     TRANS.TBL
EULA             isolinux  repodata                  RPM-GPG-KEY-CentOS-Security-6
[[email protected] mnt]# cd Packages/
[[email protected] Packages]# ls *2fs*
e2fsprogs-1.41.12-21.el6.x86_64.rpm      e2fsprogs-devel-1.41.12-21.el6.x86_64.rpm  e2fsprogs-libs-1.41.12-21.el6.x86_64.rpm
e2fsprogs-devel-1.41.12-21.el6.i686.rpm  e2fsprogs-libs-1.41.12-21.el6.i686.rpm

[[email protected] Packages]# rpm -ivh e2fsprogs-1.41.12-21.el6.x86_64.rpm
Preparing...                ########################################### [100%]
    package e2fsprogs-1.41.12-21.el6.x86_64 is already installed
[[email protected] Packages]# rpm -ivh e2fsprogs-devel-1.41.12-21.el6.x86_64.rpm
Preparing...                ########################################### [100%]
   1:e2fsprogs-devel        ########################################### [100%]

Ok,这里我安装成功了,我的是x64位系统,当然我要装x86_x64啦。接下来我们继续编译安装。

[[email protected] Packages]#  cd /root/extundelete-0.2.4
[[email protected] extundelete-0.2.4]# ./configure 
Configuring extundelete 0.2.4
Writing generated files to disk
[[email protected] extundelete-0.2.4]# echo $?
0
[[email protected] extundelete-0.2.4]# make && make install
make -s all-recursive
Making all in src
extundelete.cc:571: warning: unused parameter ‘flags’
Making install in src
  /usr/bin/install -c extundelete /usr/local/bin
[[email protected] extundelete-0.2.4]# ls /usr/local/bin/
Extundelete


########安装成功  我们开始删除文件来进行恢复测试#####

进行删除,恢复测试。记得删除后umount哦,不然二次写入谁也帮不了你呢。

[[email protected] ~]# rm -rf /yang/*
[[email protected] ~]# ls /yang/*
ls: cannot access /yang/*: No such file or directory
[[email protected] ~]# ls /yang/
[[email protected] ~]#echo “这里可以看到我刚才删除了rm –rf /yang/*就没有任何东西了”
[[email protected] ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       9.5G  3.6G  5.5G  40% /
tmpfs           242M     0  242M   0% /dev/shm
/dev/sda1       190M   27M  153M  15% /boot
/dev/sdb        4.8G   10M  4.6G   1% /yang
/dev/sr0        4.4G  4.4G     0 100% /mnt
[[email protected] ~]# umount /yang/
[[email protected] ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       9.5G  3.6G  5.5G  40% /
tmpfs           242M     0  242M   0% /dev/shm
/dev/sda1       190M   27M  153M  15% /boot
/dev/sr0        4.4G  4.4G     0 100% /mnt

 

五、恢复测试。恢复方式有很多,接下来简单说几个。

1、  通过inode节点恢复

什么是inode?这里建议大家去百度,其实笔者也不是很懂啦,哈哈,我只是会一些简单的。

[[email protected] ~]# mkdir /recover
[[email protected] ~]# cd /recover/
[[email protected] recover]# ls
[[email protected] recover]# extundelete /dev/sdb --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 b3 3f 79 57 af 3f 79 57 | .A.......?yW.?yW
0010 | af 3f 79 57 00 00 00 00 00 00 02 00 08 00 00 00 | .?yW............
0020 | 00 00 00 00 09 00 00 00 61 21 00 00 00 00 00 00 | ........a!......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 a8 c0 78 45 a8 c0 78 45 6c 66 f1 64 | ......xE..xElf.d
0090 | 27 3d 79 57 00 00 00 00 00 00 00 00 00 00 00 00 | =yW............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1467563955
Creation time: 1467563951
Modification time: 1467563951
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 8545, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
hosts                                             12             Deleted
passwd                                            13             Deleted
data1                                             131073         Deleted
data2                                             131074         Deleted
[[email protected] recover]#

[[email protected] recover]# extundelete /dev/sdb --restore-inode 13
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 52 descriptors loaded.
[[email protected] recover]# ls
RECOVERED_FILES
[[email protected] recover]# ls RECOVERED_FILES/
file.13
[[email protected] recover]# du -sh ./RECOVERED_FILES/file.13 
4.0K    ./RECOVERED_FILES/file.13
[[email protected] recover]# echo "这里我根据是inode的节点恢复的,当然这里有些人会不了解为什么是file.13,上面我inode节点对应的不是passwd文件?下面我们查看一下是否一样文件,再使用diff对比一下。"

原文件:

[[email protected] recover]# more /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:499:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
www:x:600:600::/data1/app/services/nginx:/sbin/nologin
[[email protected] recover]#

恢复出来的文件:

[[email protected] recover]# more RECOVERED_FILES/file.13 
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:499:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
www:x:600:600::/data1/app/services/nginx:/sbin/nologin
[[email protected] recover]#

##############输出的结果一模一样############

再者我们使用diff对比一下文件,diff命令不懂?  没问题啊,一样啊去百度啊,因为笔者也不了解,嘿嘿。逗逼一下,不然写着很累的。

[[email protected] recover]# diff /etc/passwd ./RECOVERED_FILES/file.13 
[[email protected] recover]# echo $?
0
[[email protected] recover]#echo “这里返回结果就是0,没有报错,就是成功了,对比一样,记住,在Linux中没有信息就是最好的信息。”

2、  根据文件名来恢复

[[email protected] recover]# extundelete /dev/sdb --restore-file hosts
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 52 descriptors loaded.
Successfully restored file hosts
[[email protected] recover]# ls
RECOVERED_FILES
[[email protected] recover]# ls RECOVERED_FILES/
file.13  hosts
[[email protected] recover]# diff /etc/hosts ./RECOVERED_FILES/hosts 
[[email protected] recover]# echo $?
0
[[email protected] recover]#echo“对比一样还是恢复成功了。”

3、根据目录来恢复

[[email protected] recover]# extundelete /dev/sdb --restore-directory data1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 52 descriptors loaded.
Searching for recoverable inodes in directory data1 ... 
7 recoverable inodes found.
Looking through the directory structure for deleted files ... 
6 recoverable inodes still lost.
[[email protected] recover]# ls ./RECOVERED_FILES/
data1  file.13  hosts
[[email protected] recover]# ls ./RECOVERED_FILES/data1/
data1.txt
[[email protected] recover]# echo “到这里目录测试也是可以恢复成功,里面文件也是我之前的文件,那么如果有人说我的文件太多了我想恢复所有的,这样操作是不是太麻烦了,没问题,下面我来教大家怎么恢复所有的,就是更改下参数。”

4、恢复全部文件。

我先给之前恢复的文件都删除了,下面看是不是可以正常恢复成功所有的文件

[[email protected] recover]# rm -rf RECOVERED_FILES/
[[email protected] recover]# ls
[[email protected] recover]# extundelete /dev/sdb --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 52 descriptors loaded.
Searching for recoverable inodes in directory / ... 
7 recoverable inodes found.
Looking through the directory structure for deleted files ... 
0 recoverable inodes still lost.
[[email protected] recover]# ls
RECOVERED_FILES
[[email protected] recover]# ls -r ./RECOVERED_FILES/
passwd  hosts  data2  data1
[[email protected] recover]#echo “可以看到我删除后所有的都恢复过来了”

啊~~~到这里总算是告一段落了,实在不懂的直接问我就可以了,我也是今天才学的。感谢大家~

以上是关于Linux 安全工具之extundelete误删除恢复的主要内容,如果未能解决你的问题,请参考以下文章

Linux中利用extundelete恢复误删除的数据

Linux中用extundelete恢复误删除的数据

linux恢复误删除文件-extundelete

利用extundelete工具恢复Centos6.5中误删除的文件

Linux中用extundelete恢复误删文件

linux系统文件误删除恢复