EXT4中恢复使用rm命令误删除的文件
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了EXT4中恢复使用rm命令误删除的文件相关的知识，希望对你有一定的参考价值。
工具：extundelete
关于ext4 文件系统的知识：http://www.ibm.com/developerworks/cn/linux/l-cn-filesrc5/
一、安装
# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2 # tar -xvf extundelete-0.2.0.tar.bz2 # cd extundelete-0.2.0 # mkdir /usr/local/extundelete # ./configure --prefix=/usr/local/extundelete [[email protected] extundelete-0.2.0]# ./configure --prefix=/usr/local/extundelete Configuring extundelete 0.2.0 configure: error: C++ compiler cannot create executables See `config.log‘ for more details. [[email protected] extundelete-0.2.0]yum install gcc-c++.x86_64 //安装编译工具包 [[email protected] extundelete-0.2.0]./configure --prefix=/usr/local/extundelete [[email protected] extundelete-0.2.0] yum -y install e2fsprogs* # 如果提示找不到ext2fs库，使用 yum -y install e2fsprogs* 安装 [[email protected] extundelete-0.2.0] ./configure --prefix=/usr/local/extundelete [[email protected] extundelete-0.2.0] make && make install [[email protected] extundelete-0.2.0] make clean # 安装完成。 下面挂载分区作为测试：
三、 恢复被删除去的文件
1. 马上umount 要恢复的文件分区
# umount /mnt1/loop100M
2. 使用extundelete查看分区上存在的文件:
# --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 2 /loop/disk_ 100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Contents of inode 2:
0000 | ed 41 00 00 00 04 00 00 55 db c4 56 49 db c4 56 | .A......U..VI..V
0010 | 49 db c4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I..V............
0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1455741781
Creation time: 1455741769
Modification time: 1455741769
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 4
Blocks count: 2
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
Directory block 272:
. 2
.. 2
lost+found 11
test 12
[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 12 /lo
loop/ lost+found/
2.1 再次搜索inod 12下面的文件
[[email protected] /]# /usr/local/extundelete/bin/extundelete --inode 12 /loop/disk _100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Contents of inode 12:
0000 | ed 41 00 00 00 04 00 00 5b db c4 56 b4 db c4 56 | .A......[..V...V
0010 | b4 db c4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ...V............
0020 | 00 00 08 00 07 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 b7 0d 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 95 32 29 7e b6 0d 00 00 00 00 00 00 | .....2)~........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1455741787
Creation time: 1455741876
Modification time: 1455741876
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 4
File flags: 524288
File version (for NFS): 2116629141
File ACL: 3510
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
Directory block 3511:
. 12
.. 2
xaa 13 Deleted
xab 14 Deleted
xac 15 Deleted
3 . 恢复inode 为12的文件
[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 12 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Unable to restore inode 12 (file.12): No undeleted copies found in the journal.
[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 13 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 13 to file RECOVERED_FILES/file.13
[[email protected] /]#
[[email protected] /]#
[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 14 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 14 to file RECOVERED_FILES/file.14
[[email protected] /]# /usr/local/extundelete/bin/extundelete --restore-inode 15 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 15 to file RECOVERED_FILES/file.15
[[email protected] /]#
[[email protected] /]#
[[email protected] /]#
[[email protected] /]# mount -o loop /loop/disk_100M /mnt1/loop100M/
[[email protected] /]# ls /mnt1/loop100M/
lost+found test
4. 查看恢复的文件：
[[email protected] /]# ls RECOVERED_FILES/
file.13 file.14 file.15
跟据恢复过程中的信息，将文件重命名回来，根据橙色的文字对照:
原文件名 -->> inod -->> 恢复后文件名
xaa 13 file.13
xab 14 file.14
xac 15 file.15
#mv file.13 /test/xaa
#mv file.14 /test/xab
#mv file.15 /test/xac
done
本文出自 “海无涯” 博客，请务必保留此出处http://plong.blog.51cto.com/3217127/1743705
以上是关于EXT4中恢复使用rm命令误删除的文件的主要内容，如果未能解决你的问题，请参考以下文章