标题：linux恢复误删文件出处：沧海一粟时间：Wed, 12 Dec 2018 08:45:11 +0000 作者：jed 地址：http://www.dzhope.com/post/1154/ 内容：一时冲动，把站点给删除了，后来发现没有备份，只能想办法进行恢复。开始找的都是关于“debugfs”的文章，尝试没有成功。貌似只能还原ext2格式的，又找的还原ext3、ext4格式的extundelete。关于extundelete这个工具的说明使用,官方网站extundelete.sourceforge.net是这样说的,extundelete是一种实用的工具,可以从ext3或ext4分区恢复被删除的文件,不能保证恢复所有的文件,所以最好能做好备份.它的最新版本是0.2.4 为什么要用extundelete? 官方这样描述,如果您已经在ext4的文件系统中删除了文件,选extundelete是一个不错的选择,它能够恢复已删除文件的文件名及内容.如果是在ext3的文件系统中删除了文件,extundelete和ext3grep比较仍然有一些优点,extundelete分析日志文件后,能够立即恢复一个文件,ext3grep分析整个硬盘才开始恢复硬盘中的文件,ext3grep方法是是有效的从一个小分区恢复多个文件,所以相比而言,如果需要从一个大的分区中恢复文件,extundelete要快些. 注意:在安装extundelete之前,要确定已经安装了e2fsprogs和e2fslibs(确定e2fsprogs的版本在1.41或者更高版本,可通过运行命令dumpe2fs来查看版本). 一、下载及安装软件 extundelete 主页：http://extundelete.sourceforge.net/ 下载地址：http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 (需跨墙） ubuntu用户可直接安装: apt-get install extundelete wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar -jxvf extundelete-0.2.4.tar.bz2 cd extundelete-0.2.4 ./configure --prefix=/usr/local/extundelete make && make install extundelete --help 查看有哪些选项 --restore-file 指定恢复文件, --restore-all 恢复全部等等,恢复完成后,恢复的文件就在当前目录下生成的RECOVERED_FILES的目录里. 实测：rm -rf /home/oracle [root@rac1 extundelete-0.2.4]# df -Th Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/VolGroup-lv_root ext4 50G 19G 29G 40% / tmpfs tmpfs 998M 80K 998M 1% /dev/shm /dev/sda1 ext4 477M 55M 397M 13% /boot /dev/mapper/VolGroup-lv_home ext4 28G 44M 26G 1% /home 二、数据恢复 1.卸载需要恢复文件的分区 [root@rac1 extundelete-0.2.4]# fuser -k ?home <-- 结束使用某分区的进程树 [root@rac1 extundelete-0.2.4]# umount /home <-- 卸载分区我卸载的时候，总是提示占用，就从/etc/fstab下取消挂载硬盘，重启的。 2.使用extundelete查看分区上存在的文件 [root@rac1 extundelete-0.2.4]# extundelete --inode 2 /dev/mapper/VolGroup-lv_home # --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 221 groups loaded. Group: 0 Contents of inode 2: 0000 | ed 41 00 00 00 10 00 00 74 85 fe 53 72 85 fe 53 | .A......t..Sr..S 0010 | 72 85 fe 53 00 00 00 00 00 00 03 00 08 00 00 00 | r..S............ 0020 | 00 00 08 00 02 00 00 00 0a f3 01 00 04 00 00 00 | ................ 0030 | 00 00 00 00 00 00 00 00 01 00 00 00 11 24 00 00 | .............$.. 0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0080 | 1c 00 00 00 cc 8f 32 d4 cc 8f 32 d4 1c 8c d6 9d | ......2...2..... 0090 | d1 21 ea 53 00 00 00 00 00 00 00 00 00 00 02 ea | .!.S............ 00a0 | 07 06 3c 00 00 00 00 00 21 00 00 00 00 00 00 00 | ..<.....!....... 00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux......... 00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 73 79 73 74 | ............syst 00e0 | 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f 72 3a 68 6f | em_u:object_r:ho 00f0 | 6d 65 5f 72 6f 6f 74 5f 74 3a 73 30 00 00 00 00 | me_root_t:s0.... Inode is Allocated File mode: 16877 Low 16 bits of Owner Uid: 0 Size in bytes: 4096 Access time: 1409189236 Creation time: 1409189234 Modification time: 1409189234 Deletion Time: 0 Low 16 bits of Group Id: 0 Links count: 3 Blocks count: 8 File flags: 524288 File version (for NFS): 0 File ACL: 0 Directory ACL: 0 Fragment address: 0 Direct blocks: 127754, 4, 0, 0, 1, 9233, 0, 0, 0, 0, 0, 0 Indirect block: 0 Double indirect block: 0 Triple indirect block: 0 File name | Inode number | Deleted status . 2 .. 2 lost+found 11 oracle 523265 Deleted 被删除的oracle文件夹已经被找到，状态为已经删除，接下来就将它们恢复出来。 [root@rac1 Desktop]# extundelete --restore-all /dev/mapper/VolGroup-lv_home # --restore-all是全部恢复，默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下，文件名为 file.I节点号 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 221 groups loaded. Loading journal descriptors ... 3108 descriptors loaded. Searching for recoverable inodes in directory / ... 3576 recoverable inodes found. Looking through the directory structure for deleted files ... 0 recoverable inodes still lost. [root@rac1 Desktop]# ls RECOVERED_FILES/ lost+found oracle [root@rac1 Desktop]# mount /home [root@rac1 Desktop]# df -Th Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/VolGroup-lv_root ext4 50G 21G 26G 45% / tmpfs tmpfs 998M 80K 998M 1% /dev/shm /dev/sda1 ext4 477M 55M 397M 13% /boot /dev/mapper/VolGroup-lv_home ext4 28G 44M 26G 1% /home [root@rac1 Desktop]# mv RECOVERED_FILES/oracle /home [root@rac1 Desktop]# df -Th Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/VolGroup-lv_root ext4 50G 19G 29G 40% / tmpfs tmpfs 998M 80K 998M 1% /dev/shm /dev/sda1 ext4 477M 55M 397M 13% /boot /dev/mapper/VolGroup-lv_home ext4 28G 2.6G 24G 10% /home 至此2.6G的数据恢复完毕。恢复之后，权限不一致的，别忘了授权。恢复的数据都在当前目录下的RECOVERED_FILES，以后还是需要谨慎操作，我恢复的数据，大部分是恢复了，还是有小部分没有找回来，这个也不是能够百分百恢复，还是需要谨慎操作。 Generated by Bo-blog 2.1.1 Release