1.安装软件(extundelete依赖于系统的e2fsprogs三个软件包)

        [root@redhat1 home]# mkdir /mnt/cdrom                                --创建光盘挂载目录

        [root@redhat1 home]# mount /dev/cdrom /mnt/cdrom         --挂载光盘
        mount: block device /dev/sr0 is write-protected, mounting read-only
        [root@redhat1 home]# vim /etc/yum.repos.d/base.repo                --配置系统的本地源

              [base]
              name=base
              baseurl=file:///mnt/cdrom
              enabled=1
              gpgcheck=1
              gpgkey=file:///mnt/cdrom/RPM-GPG-KEY-REDHAT-6

        [root@redhat1 home]# yum install e2fs*                    --安装extundelete软件的依赖包

        [root@redhat1 home]# rpm -aq |grep e2fs                --检查软件包是否安装
        e2fsprogs-devel-1.41.12-14.el6.i686
        e2fsprogs-libs-1.41.12-14.el6.i686
        e2fsprogs-1.41.12-14.el6.i686

         [root@redhat1 home]#wgethttp://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2--下载extundelete软件包

         [root@redhat1 home]# tar xvf extundelete-0.2.4.tar.bz2    --解压软件包

         [root@redhat1 home]# cd extundelete-0.2.4     --进入软件包

         [root@redhat1 ext3grep-0.10.2]# ./configure --prefix=/usr/local/extundelete  && make && make install        --安装软件

         [root@redhat1 ext3grep-0.10.2]# ll /usr/local/ |grep ext         --查看软件安装成功
         drwxr-xr-x. 3 root root 4096 Dec 2 17:24 extundelete

          [root@redhat1 ext3grep-0.10.2]#

      2.创建块设备并挂载系统

         [root@redhat1 home]# dd if=/dev/zero of=123 bs=1M count=100         --在home目录下新建一个块设备123
        100+0 records in
        100+0 records out
         104857600 bytes (105 MB) copied, 0.634943 s, 165 MB/s

          [root@redhat1 home]# mkfs.ext4  123 --格式化块设备

         mke2fs 1.41.12 (17-May-2010)
         123 is not a block special device.
          Proceed anyway? (y,n) y --输入y确定
          Filesystem label=
          OS type: Linux
           Block size=1024 (log=0)
           Fragment size=1024 (log=0)
           Stride=0 blocks, Stripe width=0 blocks
           25688 inodes, 102400 blocks
           5120 blocks (5.00%) reserved for the super user
           First data block=1
           Maximum filesystem blocks=67371008
           13 block groups
           8192 blocks per group, 8192 fragments per group
           1976 inodes per group
            Superblock backups stored on blocks:
            8193, 24577, 40961, 57345, 73729

            Writing inode tables: done
            Creating journal (4096 blocks): done
            Writing superblocks and filesystem accounting information: done

            This filesystem will be automatically checked every 27 mounts or
            180 days, whichever comes first. Use tune2fs -c or -i to override.

             [root@redhat1 home]#mkdir /mnt/123             --新建块设备挂载的目录

             [root@redhat1 home]# mount 123 /mnt/123 -o loop            --将块设备123挂载到/mnt/123中

             [root@redhat1 home]# df -TH                --查看目录是否挂载
             Filesystem Type Size Used Avail Use% Mounted on
             /dev/mapper/VolGroup-lv_root
             ext4 20G 3.8G 16G 20% /
            tmpfs tmpfs 262M 0 262M 0% /dev/shm
            /dev/sda1 ext4 508M 32M 451M 7% /boot
            df: `/mnt/cdrom': No such file or directory
            /dev/sr0 iso9660 3.2G 3.2G 0 100% /mnt
            /home/123 ext4 102M 5.8M 91M 7% /mnt/123       --设备已挂载

        3.添加和删除文件

           [root@redhat1 home]# cp -a /etc/passwd /etc/shadow /etc/group /mnt/123/      --将文件移动到设备中

           [root@redhat1 ~]# ll /mnt/123/  --查看是否有文件

total 19
           -rw-r--r--. 1 root root   712 Dec  2 14:39 group
           drwx------. 2 root root 12288 Dec  4 14:07 lost+found
           -rw-r--r--. 1 root root  1509 Dec  2 14:39 passwd
           ----------. 1 root root   976 Dec  2 14:39 shadow
            [root@redhat1 home]# sync            --文件同步一下

            [root@redhat1 home]# rm -rf /mnt/123/passwd /mnt/123/shadow           --删除文件

            [root@redhat1 home]# sync             --文件同步一下

            [root@redhat1 home]# umount /mnt/123       --卸载设备

      4.恢复刚才删除的文件

           cd /usr/local/extundelete/bin            --进入软件目录

           [root@redhat1 bin]# ./extundelete --ls --inode 2 /home/123     --查看块设备/home/123的文件详细信息
           ./extundelete: unrecognized option '--ls'
           NOTICE: Extended attributes are not restored.
           Loading filesystem metadata ... 13 groups loaded.
           Group: 0
           Contents of inode 2:
           0000 | ed 41 00 00 00 04 00 00 fe c6 9e 52 58 c7 9e 52 | .A.........RX..R
           0010 | 58 c7 9e 52 00 00 00 00 00 00 03 00 02 00 00 00 | X..R............
           0020 | 00 00 00 00 05 00 00 00 10 01 00 00 00 00 00 00 | ................
           0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
           0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
           0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
           0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
           0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

           Inode is Allocated
           File mode: 16877
           Low 16 bits of Owner Uid: 0
           Size in bytes: 1024
           Access time: 1386137342
           Creation time: 1386137432
           Modification time: 1386137432
           Deletion Time: 0
           Low 16 bits of Group Id: 0
           Links count: 3
           Blocks count: 2
           File flags: 0
           File version (for NFS): 0
           File ACL: 0
           Directory ACL: 0
           Fragment address: 0
           Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
           Indirect block: 0
           Double indirect block: 0
           Triple indirect block: 0

           File name                                       | Inode number | Deleted status
           .                                                 2
           ..                                                2
           lost+found                                        11
           passwd                                            12             Deleted              --Delete就是我们刚才删除的文件
           shadow                                            13             Deleted
           group                                             14
          [root@redhat1 bin]# ./extundelete  --restore-file passwd /home/123     --用文件名来恢复文件
          NOTICE: Extended attributes are not restored.
          Loading filesystem metadata ... 13 groups loaded.
          Loading journal descriptors ... 27 descriptors loaded.
          Successfully restored file passwd         --恢复成功

          [root@redhat1 bin]# ./extundelete  --restore-inode 13 /home/123      --用节点号来恢复文件
          NOTICE: Extended attributes are not restored.
          Loading filesystem metadata ... 13 groups loaded.
          Loading journal descriptors ... 27 descriptors loaded.

         [root@redhat1 bin]# ./extundelete  --restore-all /home/123       --恢复所有删除的文件
         NOTICE: Extended attributes are not restored.
         Loading filesystem metadata ... 13 groups loaded.
         Loading journal descriptors ... 27 descriptors loaded.
         Searching for recoverable inodes in directory / ...
         2 recoverable inodes found.
         Looking through the directory structure for deleted files ...
         0 recoverable inodes still lost.
         [root@redhat1 bin]# ll RECOVERED_FILES/       --查看所有恢复的文件
         total 20
         drwxr-xr-x. 2 root root 4096 Dec  3 16:21 123
         -rw-r--r--. 1 root root  976 Dec  4 14:18 file.13
         -rw-r--r--. 1 root root 1509 Dec  4 14:16 passwd
         -rw-r--r--. 1 root root 1509 Dec  4 14:20 passwd.v1
         -rw-r--r--. 1 root root  976 Dec  4 14:20 shadow
         [root@redhat1 bin]#