centos7恢复误删的文件

一、背景:

磁盘/dev/vdc 挂载到/data目录,存放着中间件的数据;由于需要缩容,新增加了一块磁盘/dev/vdd挂载到/data1;两块磁盘都是ext4的格式

二、误删操作:

mv /data /data1/

由于xshell超时,终端断开,重新连接后执行 rm -rf /data1,并执行cp -a /data /data1

导致无论是/data还是/data1都没有数据了

三、恢复过程

3.1 发现数据没有后,马上卸载两个磁盘

[root@localhost opt]# umount /dev/vdc

[root@localhost opt]# umount /dev/vdd

3.2 搜索相关的资料,基本都是介绍extundelete工具,都能成功,但是我这里都失败了

下载链接: https://sourceforge.net/projects/extundelete/files/latest/download

#先安装依赖
[root@localhost opt]# yum install e2fslibs*
#编译安装
[root@localhost opt]# tar -jxf extundelete-0.2.4.tar.bz2
[root@localhost opt]# cd extundelete-0.2.4
[root@localhost opt]# yum install gcc gcc-c++ e2fsprogs e2fsprogs-devel e2fsprogs-libs
[root@localhost opt]# ./configure
[root@localhost opt]# make && make install
[root@localhost opt]# extundelete –version

查看被删除的数据,--inode 2是根分区的inode

[root@localhost extundelete-0.2.4]# extundelete --inode 2 /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 64 groups loaded.
...............

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
data                                              262145         Deleted
mysql                                             262147         Deleted
test.txt                                          262146         Deleted

尝试完整恢复

# 完成恢复所有,没有成功
[root@localhost bakcup]# extundelete --restore-all /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 64 groups loaded.
Loading journal descriptors ... Segmentation fault
[root@localhost bakcup]# ls
[root@localhost bakcup]# 

尝试指定文件名或者inode恢复,都是没有成功

#指定文件恢复
[root@localhost bakcup]# extundelete --restore-file test.txt /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 64 groups loaded.
Loading journal descriptors ... Segmentation fault
#指定inode恢复
[root@localhost bakcup]# extundelete --restore-inode 262146 /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 64 groups loaded.
Loading journal descriptors ... Segmentation fault

3.3 安装testdisk

[root@localhost bakcup]# yum install -y epel-release
[root@localhost bakcup]# yum install -y testdisk

# 运行testdisk

[root@localhost ~]# photorec

# 结果

# 恢复的文件都被重名了

3.4 安装ext4magic

# 下载链接: https://sourceforge.net/projects/ext4magic/files/

]# tar -xzvf ext4magic-0.3.2.tar.gz
]# cd ext4magic-0.3.2
]# yum install gcc gcc-c++ e2fsprogs-devel libuuid-devel libblkid-devel zlib-devel bzip2-devel file-libs file-devel
]# ./configure
]# make & make install
#创建软连接
]# ln -s /usr/local/ext4magic-0.3.2/src/ext4magic /usr/sbin/ext4magic
#查看版本
]# ext4magic -V -X
ext4magic  version : 0.3.2
libext2fs version : 1.42.9
CPU is little endian.
#查看可恢复数据
]# ext4magic /dev/sdb1 -f /
Filesystem in use: /dev/sdb1


Dump internal Inode 2
Status : Inode is Allocated

Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
Generation: 0    Version: 0x00000000:00000007
User:     0   Group:     0   Size: 4096
File ACL: 0    Directory ACL: 0
Links: 2   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 1736231655:0843172140 -- Tue Jan  7 01:34:15 2025
 atime: 1736231724:1209200756 -- Tue Jan  7 01:35:24 2025
 mtime: 1736231655:0843172140 -- Tue Jan  7 01:34:15 2025
crtime: 1736228260:0000000000 -- Tue Jan  7 00:37:40 2025
Size of extra inode fields: 28
        2  d  755 (2)      0      0           4096  7-Jan-2025 01:34 .
        2  d  755 (2)      0      0           4096  7-Jan-2025 01:34 ..
<      11> d  700 (2)      0      0              0  7-Jan-2025 01:34 lost+found
<  262145> d  755 (2)      0      0              0  7-Jan-2025 01:31 data
<  262147> d  755 (2)   1000   1000              0  7-Jan-2025 01:34 mysql
<  262146> _  644 (1)      0      0              0  7-Jan-2025 01:34 test.txt

ext4magic : EXIT_SUCCESS
#全盘恢复
~]# ext4magic /dev/sdb1 -R -d /root/data

# 最终使用ext4magic成功恢复了误删的数据