EXT4中恢复使用rm命令误删除的文件

Posted

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了EXT4中恢复使用rm命令误删除的文件相关的知识,希望对你有一定的参考价值。

工具:extundelete


关于ext4 文件系统的知识:http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/


 一、安装 

#  wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2
 # tar -xvf extundelete-0.2.0.tar.bz2
 #  cd extundelete-0.2.0
 #  mkdir /usr/local/extundelete
 #  ./configure --prefix=/usr/local/extundelete
[[email protected] extundelete-0.2.0]# ./configure --prefix=/usr/local/extundelete
Configuring extundelete 0.2.0
configure: error: C++ compiler cannot create executables
See `config.log‘ for more details.
 [[email protected] extundelete-0.2.0]yum install gcc-c++.x86_64 //安装编译工具包
  [[email protected] extundelete-0.2.0]./configure --prefix=/usr/local/extundelete
 [[email protected] extundelete-0.2.0]  yum -y install e2fsprogs* # 如果提示找不到ext2fs库,使用 yum -y install e2fsprogs* 安装
 [[email protected] extundelete-0.2.0] ./configure --prefix=/usr/local/extundelete
 [[email protected] extundelete-0.2.0] make && make install
 [[email protected] extundelete-0.2.0] make clean
 
 # 安装完成。
 
 
 下面挂载分区作为测试:

技术分享


三、 恢复被删除去的文件


  1. 马上umount 要恢复的文件分区

    # umount /mnt1/loop100M

  2. 使用extundelete查看分区上存在的文件:

   # --inode 为查找某i节点中的内容,使用2则说明为搜索,如果需要进入目录搜索,只须要指定目录I节点即可

[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 2 /loop/disk_               100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 04 00 00 55 db c4 56 49 db c4 56 | .A......U..VI..V

0010 | 49 db c4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I..V............

0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................


Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 1024

Access time: 1455741781

Creation time: 1455741769

Modification time: 1455741769

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 4

Blocks count: 2

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0


File name                                       | Inode number | Deleted status

Directory block 272:

.                                                 2

..                                                2

lost+found                                        11

test                                              12

[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 12 /lo

loop/       lost+found/

 2.1 再次搜索inod 12下面的文件

[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 12 /loop/disk               _100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Contents of inode 12:

0000 | ed 41 00 00 00 04 00 00 5b db c4 56 b4 db c4 56 | .A......[..V...V

0010 | b4 db c4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ...V............

0020 | 00 00 08 00 07 00 00 00 0a f3 01 00 04 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 01 00 00 00 b7 0d 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 95 32 29 7e b6 0d 00 00 00 00 00 00 | .....2)~........

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................


Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 1024

Access time: 1455741787

Creation time: 1455741876

Modification time: 1455741876

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 4

File flags: 524288

File version (for NFS): 2116629141

File ACL: 3510

Directory ACL: 0

Fragment address: 0

Direct blocks: 127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0


File name                                       | Inode number | Deleted status

Directory block 3511:

.                                                 12

..                                                2

xaa                                               13             Deleted

xab                                               14             Deleted

xac                                               15             Deleted

3 . 恢复inode 为12的文件

[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 12 /l               oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Writing output to directory RECOVERED_FILES/

Unable to restore inode 12 (file.12): No undeleted copies found in the journal.

[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 13 /l               oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 13 to file RECOVERED_FILES/file.13

[[email protected] /]#

[[email protected] /]#

[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 14 /l               oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 14 to file RECOVERED_FILES/file.14

[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 15 /l               oop/disk_100M

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 13 groups loaded.

Loading journal descriptors ... 31 descriptors loaded.

Restored inode 15 to file RECOVERED_FILES/file.15

[[email protected] /]#

[[email protected] /]#

[[email protected] /]#

[[email protected] /]# mount -o loop /loop/disk_100M /mnt1/loop100M/

[[email protected] /]# ls /mnt1/loop100M/

lost+found  test


4. 查看恢复的文件:

  

[[email protected] /]# ls RECOVERED_FILES/

file.13  file.14  file.15


跟据恢复过程中的信息,将文件重命名回来,根据橙色的文字对照:

 原文件名    -->>  inod   -->> 恢复后文件名

  xaa            13       file.13                 

  xab            14       file.14     

  xac            15       file.15


 #mv file.13 /test/xaa

 #mv file.14 /test/xab

 #mv file.15 /test/xac


done

本文出自 “海无涯” 博客,请务必保留此出处http://plong.blog.51cto.com/3217127/1743705

以上是关于EXT4中恢复使用rm命令误删除的文件的主要内容,如果未能解决你的问题,请参考以下文章

linux系统ext4文件系统rm删除的文件怎么恢复

centos下误删除文件

Linux rm危险命令误删除文件如何恢复

linux系统文件误删除恢复

Linux中如何恢复rm命令误删除的文件之extundelete编译安装及使用

Ubuntu中恢复rm命令误删文件(转)