系统是centos 6.5 x64位系统

rm文件删除之后，恢复比较麻烦。

可以使用extundelete进行恢复

目前最新版本是0.2.4

extundelete 主页：http://extundelete.sourceforge.net/

下载软件

wget http://fossies.org/linux/misc/extundelete-0.2.4.tar.gz

安装组件

yum install -y e2fsprogs e2fsprogs-devel e2fsprogs-libs

安装extundelete

tar zxvf extundelete-0.2.4.tar.gz -C /usr/src/

cd /usr/src/extundelete-0.2.4/

./configure

make

make install

恢复的时候，需要卸载分区。如果你需要的恢复的文件在根分区，那么需要在另外一台服务器进行恢复。

所以我挂载了一个测试分区

[root@localhost ~]# df -hT

Filesystem                   Type   Size  Used Avail Use% Mounted on

/dev/mapper/VolGroup-lv_root ext4    29G  1.2G   26G   5% /

tmpfs                        tmpfs  246M     0  246M   0% /dev/shm

/dev/sda1                    ext4   485M   33M  427M   8% /boot

/dev/sdb1                    ext4  1008M   18M  940M   2% /test

写入文件，内容是111

[root@localhost ~]# vi /test/1.txt

删除文件

[root@localhost ~]# rm -rf /test/*

结束使用某分区的进程树

[root@localhost ~]# fuser -k /test

卸载分区

[root@localhost ~]# umount /test/

使用extundelete查看分区上存在的文件

--inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可

[root@localhost ~]# extundelete --inode 2 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 a9 bf 75 55 a8 bf 75 55 | .A........uU..uU

0010 | a8 bf 75 55 00 00 00 00 00 00 02 00 08 00 00 00 | ..uU............

0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........I.......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 28 6d b5 65 28 6d b5 65 78 80 59 bf | ....(m.e(m.ex.Y.

0090 | 6c bf 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | l.uU............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1433780137

Creation time: 1433780136

Modification time: 1433780136

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11             Deleted

.1.txt.swp                                        12             Deleted

1.txt                                             13             Deleted

从以上信息，可以看出，需要恢复的文件1.txt的I节点为13

恢复文件

--restore-inode 恢复指定的I节点文件，默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下，文件名为 file.I节点号

[root@localhost ~]# extundelete --restore-inode 13 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Loading journal descriptors ... 23 descriptors loaded.

查看目录是否有文件

[root@localhost ~]# ll RECOVERED_FILES/

total 4

-rw-r--r-- 1 root root 4 Jun  9 00:33 file.13

查看文件内容

[root@localhost ~]# cat RECOVERED_FILES/file.13

111

重新挂载分区，恢复文件，查看文件内容

[root@localhost ~]# mount /dev/sdb1 /test/

[root@localhost ~]# mv RECOVERED_FILES/file.13 /test/1.txt

[root@localhost ~]# cat /test/1.txt

111