|
系统是centos 6.5 x64位系统 rm文件删除之后，恢复比较麻烦。 可以使用extundelete进行恢复 目前最新版本是0.2.4 extundelete 主页：http://extundelete.sourceforge.net/ 下载软件 wget http://fossies.org/linux/misc/extundelete-0.2.4.tar.gz 安装组件 yum install -y e2fsprogs e2fsprogs-devel e2fsprogs-libs 安装extundelete
tar zxvf extundelete-0.2.4.tar.gz -C /usr/src/ cd /usr/src/extundelete-0.2.4/ ./configure make make install
恢复的时候，需要卸载分区。如果你需要的恢复的文件在根分区，那么需要在另外一台服务器进行恢复。 所以我挂载了一个测试分区 [root@localhost ~]# df -hT Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/VolGroup-lv_root ext4 29G 1.2G 26G 5% / tmpfs tmpfs 246M 0 246M 0% /dev/shm /dev/sda1 ext4 485M 33M 427M 8% /boot /dev/sdb1 ext4 1008M 18M 940M 2% /test
写入文件，内容是111
[root@localhost ~]# vi /test/1.txt 删除文件 [root@localhost ~]# rm -rf /test/*
结束使用某分区的进程树 [root@localhost ~]# fuser -k /test 卸载分区 [root@localhost ~]# umount /test/ 使用extundelete查看分区上存在的文件 --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
[root@localhost ~]# extundelete --inode 2 /dev/sdb1 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 8 groups loaded. Group: 0 Contents of inode 2: 0000 | ed 41 00 00 00 10 00 00 a9 bf 75 55 a8 bf 75 55 | .A........uU..uU 0010 | a8 bf 75 55 00 00 00 00 00 00 02 00 08 00 00 00 | ..uU............ 0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........I....... 0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0080 | 1c 00 00 00 28 6d b5 65 28 6d b5 65 78 80 59 bf | ....(m.e(m.ex.Y. 0090 | 6c bf 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | l.uU............ 00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated File mode: 16877 Low 16 bits of Owner Uid: 0 Size in bytes: 4096 Access time: 1433780137 Creation time: 1433780136 Modification time: 1433780136 Deletion Time: 0 Low 16 bits of Group Id: 0 Links count: 2 Blocks count: 8 File flags: 0 File version (for NFS): 0 File ACL: 0 Directory ACL: 0 Fragment address: 0 Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 Indirect block: 0 Double indirect block: 0 Triple indirect block: 0
File name | Inode number | Deleted status . 2 .. 2 lost+found 11 Deleted .1.txt.swp 12 Deleted 1.txt 13 Deleted
从以上信息，可以看出，需要恢复的文件1.txt的I节点为13
恢复文件 --restore-inode 恢复指定的I节点文件，默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下，文件名为 file.I节点号
[root@localhost ~]# extundelete --restore-inode 13 /dev/sdb1 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 8 groups loaded. Loading journal descriptors ... 23 descriptors loaded. 查看目录是否有文件 [root@localhost ~]# ll RECOVERED_FILES/ total 4 -rw-r--r-- 1 root root 4 Jun 9 00:33 file.13 查看文件内容
[root@localhost ~]# cat RECOVERED_FILES/file.13 111 重新挂载分区，恢复文件，查看文件内容
[root@localhost ~]# mount /dev/sdb1 /test/ [root@localhost ~]# mv RECOVERED_FILES/file.13 /test/1.txt [root@localhost ~]# cat /test/1.txt
111 |