Linux下误删文件应急恢复
维护中难免遇到状态不好的时候或者新人操作不当，一个rm –f *删除了大量的文件，导致生产重大故障，这个时候我们需要考虑文件恢复，为了能够应对这种情况，在这里讨论一个网上常用的恢复工具：extundelete，该工具支持ext3或者ext4.
1 安装
首先安装好准备包：
[root@redhat1 home]# yum install e2fs* –安装extundelete软件的依赖包
[root@redhat1 home]# rpm -aq |grep e2fs –检查软件包是否安装
e2fsprogs-devel-1.41.12-14.el6.i686
e2fsprogs-libs-1.41.12-14.el6.i686
e2fsprogs-1.41.12-14.el6.i686
确认gcc编译工具齐全
gcc+
开始安装
tar xvf extundelete-0.2.4.tar.bz2
. /configure
make
make install
2 使用方法
root@localhost bin]# ./extundelete
No action specified; implying –superblock.
./extundelete: Missing device name.
Usage: ./extundelete [options] [–] device-file
Options:
–version, -[vV] Print version and exit successfully.
–help, Print this help and exit successfully.
–superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
–journal Show content of journal.
–after dtime Only process entries deleted on or after ‘dtime’.根据时间点恢复之后的文件。
–before dtime Only process entries deleted before ‘dtime’.根据时间点恢复之前的。
Actions:
–inode ino Show info on inode ‘ino’.
–block blk Show info on block ‘blk’.
–restore-inode ino[,ino,…]
Restore the file(s) with known inode number ‘ino’.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
–restore-file ‘path’ Will restore file ‘path’. ‘path’ is relative to root
of the partition and does not start with a ‘/’
The restored file is created in the current
directory as ‘RECOVERED_FILES/path’.
–restore-files ‘path’ Will restore files which are listed in the file ‘path’.
Each filename should be in the same format as an option
to –restore-file, and there should be one per line.
–restore-directory ‘path’
Will restore directory ‘path’. ‘path’ is relative to the
root directory of the file system. The restored
directory is created in the output directory as ‘path’.
–restore-all Attempts to restore everything.
-j journal Reads an external journal from the named file.
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize Uses blocksize as the block size when opening the file
system. The number should be the number of bytes.
–log 0 Make the program silent.
–log filename Logs all messages to filename.
–log D1=0,D2=filename Custom control of log messages with comma-separated
Examples below: list of options. Dn must be one of info, warn, or
–log info,error error. Omission of the ‘=name’ results in messages
–log warn=0 with the specified level to be logged to the console.
–log error=filename If the parameter is ‘=0’, logging for the specified
level will be turned off. If the parameter is
‘=filename’, messages with that level will be written
to filename.
-o directory Save the recovered files to the named directory.
The restored files are created in a directory
named ‘RECOVERED_FILES/’ by default.
./extundelete: Error parsing command-line options.
3 实验恢复
创建目录
/boot/test
创建测试文件
[root@localhost test]# ls -rlt
total 12
-rw-r–r–. 1 root root 21 Oct 9 17:11 1111111111111112.txt
-rw-r–r–. 1 root root 13 Oct 9 17:11 1111111111111111.txt
-rw-r–r–. 1 root root 24 Oct 9 17:11 1111111111111113.txt
删除文件
rm –rf *
4 恢复
cd /usr/local/bin/
查看可恢复的文件和目录。
./extundelete /dev/sda1 –ls –inode 2
直接恢复文件到当前目录。
./extundelete /dev/sda1 –restore-all
查看当前目录：RECOVERED_FILES 就可以看到删除的文件。
直接恢复指定的文件
./extundelete /dev/sda1 –restore-file vmlinuz-2.6.32-642.el6.x86_64
直接恢复制定的文件夹
./extundelete /dev/sda1 –restore-directory test
网上可参考学习
https://my.oschina.net/fufangchun/blog/176550
