extundelete

主要是针对ext4

 

Linux下执行 rm 并不会真正删除，而是将inode节点中的扇区删除，同时释放数据块。在数据块被系统重新分配前，这部分数据还是可以找回来的。

网上说在删除文件后要立即unmount这个分区，这样做其实是为了让外界不再写入，我们也可以设置为readonly模式代替。当然，如果为了不影响其它应用的运行，也可以不做unmount。在系统未将删除文件的 inode分配出去则可以完全恢复

好的，现在就该神器extundelete上场了。以CentOS6.5为例

依赖

yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel

安装

wget http://jaist.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar jxvf extundelete-0.2.4.tar.bz2 cd extundelte-0.2.4 ./configure make; make install

 

2)执行删除操作（要是/根分区之外的分区，并且只能是文件删除后的恢复，目录删除不能恢复）

[root@slave-node ~]# df -T

Filesystem Type 1K-blocks Used Available Use% Mounted on

/dev/sda3 ext4 151189708 2370020 141139688 2% /

tmpfs tmpfs 32960412 0 32960412 0% /dev/shm

/dev/sda1 ext4 198337 26798 161299 15% /boot

/dev/sda2 ext4 806346400 201304 765185096 1% /home

 

[root@slave-node ~]# cd /home/

[root@slave-node home]# echo "123456"> test1

[root@slave-node home]# echo "hahahahha" > wangshibo

[root@slave-node home]# ls

lost+found test1 wangshibo zabbix

 

删除文件

[root@slave-node home]# rm -rf test1 wangshibo

[root@slave-node home]# ls

lost+found zabbix

 

3）数据删除后的恢复操作

首先恢复前，卸载需要恢复文件的分区

[root@slave-node ~]# umount /home/ //如果卸载失败，就用命令"fuser -k /home"结束使用此分区的进程树

[root@slave-node ~]# df -T

Filesystem Type 1K-blocks Used Available Use% Mounted on

/dev/sda3 ext4 151189708 2370024 141139684 2% /

tmpfs tmpfs 32960412 0 32960412 0% /dev/shm

/dev/sda1 ext4 198337 26798 161299 15% /boot

 

使用extundelete查看分区上存在的文件,如下：

--inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可

[root@slave-node ~]# extundelete --inode 2 /dev/sda2

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 6250 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 84 10 49 58 82 10 49 58 | .A........IX..IX

0010 | 82 10 49 58 00 00 00 00 00 00 04 00 08 00 00 00 | ..IX............

0020 | 00 00 00 00 07 00 00 00 21 24 00 00 00 00 00 00 | ........!$......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 00 00 00 00 00 00 00 00 11 10 00 00 00 00 00 00 | ................

0090 | 00 00 00 00 00 00 00 00 62 0e 49 58 62 0e 49 58 | ........b.IXb.IX

00a0 | 62 0e 49 58 00 00 00 00 00 00 00 00 00 00 00 00 | b.IX............

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

 

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1481183364

Creation time: 1481183362

Modification time: 1481183362

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 4

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

 

File name | Inode number | Deleted status

Directory block 9249:

. 2

.. 2

lost+found 11

haha 12 Deleted

zabbix 17432577

test1 12 Deleted

wangshibo 13 Deleted

 

如上可以看出，被删除的两个文件test1和wangshibo已经被找到，状态为已经删除。

接下来就将它们恢复出来：

[root@slave-node ~]# extundelete --restore-inode 12 /dev/sda2

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 6250 groups loaded.

Loading journal descriptors ... 46 descriptors loaded.

Restored inode 12 to file RECOVERED_FILES/file.12

[root@slave-node ~]# extundelete --restore-inode 13 /dev/sda2

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 6250 groups loaded.

Loading journal descriptors ... 46 descriptors loaded.

Restored inode 13 to file RECOVERED_FILES/file.13

 

[root@slave-node ~]# ls RECOVERED_FILES/

file.12 file.13

[root@slave-node ~]# mount /dev/sda2 /home/ //重新挂载home分区

[root@slave-node ~]# mv RECOVERED_FILES/file.12 /home/test1

[root@slave-node ~]# mv RECOVERED_FILES/file.13 /home/wangshibo

 

再次查看home分区，发现删除的文件已经恢复回来了,很强大！！！

[root@slave-node ~]# cd /home/

[root@slave-node home]# ls

lost+found test1 wangshibo zabbix

[root@slave-node home]# cat test1

123456

[root@slave-node home]# cat wangshibo

hahahahha