zoukankan      html  css  js  c++  java
  • extundelete工具恢复误删文件

     linux删除文件时其实删的是文件名,数据还是存储在硬盘中的。在误删除文件后不做其他操作(比如创建新的文件),然后用umount卸载掉存储该数据的硬盘,再进行恢复操作,可以通过一些工具来恢复被误删的文件,以extundelete文件恢复工具为例: 

    extundelete是文件恢复工具,支持ext3/ext4双格式分区恢复。

    extundelete工具的下载地址:https://sourceforge.net/projects/extundelete/

    安装extundelete工具前先安装依赖包:yum install e2fsprogs* -y

    rz -y(从windows中下载extundelete软件包)

    tar jxf extundelete-0.2.4.tar.bz2

    cd extundelete-0.2.4.tar.bz2

    ./confgiure

    make 

    make install

    此时extundelete工具已经安装好了。下面我们模拟恢复误删文件。

    首先添加一块测试的硬盘

    然后开机查看一下硬盘是否成功加载到系统中

     

    创建ext4文件系统并挂载到/data中:

    mkfs -t ext4 /dev/sdb

    mkdir /data

    mount /dev/sdb /data/

    向/data目录写入数据

    删除/data中的数据rm -rf /data/*

    卸载硬盘umount /data/并用extundelete /dev/sdb --inode 2查看可恢复文件

    [root@liuhui ~]# umount /data/
    [root@liuhui ~]# extundelete /dev/sdb --inode 2
    NOTICE: Extended attributes are not restored.
    Loading filesystem metadata ... 160 groups loaded.
    Group: 0
    Contents of inode 2:
    0000 | ed 41 00 00 00 10 00 00 28 6a 9c 5b 24 6a 9c 5b | .A......(j.[$j.[
    0010 | 24 6a 9c 5b 00 00 00 00 00 00 02 00 08 00 00 00 | $j.[............
    0020 | 00 00 00 00 05 00 00 00 21 24 00 00 00 00 00 00 | ........!$......
    0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0080 | 1c 00 00 00 68 dc ee 16 68 dc ee 16 44 83 ba de | ....h...h...D...
    0090 | 9a 68 9c 5b 00 00 00 00 00 00 00 00 00 00 00 00 | .h.[............
    00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

    Inode is Allocated
    File mode: 16877
    Low 16 bits of Owner Uid: 0
    Size in bytes: 4096
    Access time: 1536977448
    Creation time: 1536977444
    Modification time: 1536977444
    Deletion Time: 0
    Low 16 bits of Group Id: 0
    Links count: 2
    Blocks count: 8
    File flags: 0
    File version (for NFS): 0
    File ACL: 0
    Directory ACL: 0
    Fragment address: 0
    Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    Indirect block: 0
    Double indirect block: 0
    Triple indirect block: 0

    File name | Inode number | Deleted status
    . 2
    .. 2
    lost+found 11 Deleted     
    passwd 12 Deleted
    test 262145 Deleted

    检测到被删除的文件又三个


    开始恢复数据。

    注意:恢复过程不要在误删分区进行,谨防inode.block块相互覆盖

    以恢复/data/passwd为例:extundelete /dev/sdb --restore-file passwd

    恢复成功后会在当前目录下生成一个RECOVERED_FILES目录,在这个目录里就可以看到被误删后得到恢复的文件

     

    也可以用inode恢复passwd文件,从上extundelete /dev/sdb --inode 2执行结果可 知passwd的inode为12

    注:用inode恢复后的文件名会跟之前的文件名不一样

     用md5sum校验RECOVERED_FILES/file.12是否跟源配置文件/etc/passwd相同

     结果是一样的。证明已经恢复成功了

    恢复/data中的全部文件用:extundelete /dev/sdb --restore-all这个命令

  • 相关阅读:
    ZOJ 3765 Lights (zju March I)伸展树Splay
    UVA 11922 伸展树Splay 第一题
    UVALive 4794 Sharing Chocolate DP
    ZOJ 3757 Alice and Bod 模拟
    UVALive 3983 捡垃圾的机器人 DP
    UVA 10891 SUM游戏 DP
    poj 1328 Radar Installatio【贪心】
    poj 3264 Balanced Lineup【RMQ-ST查询区间最大最小值之差 +模板应用】
    【转】RMQ-ST算法详解
    poj 3083 Children of the Candy Corn 【条件约束dfs搜索 + bfs搜索】【复习搜索题目一定要看这道题目】
  • 原文地址:https://www.cnblogs.com/liuhui-xzz/p/9666868.html
Copyright © 2011-2022 走看看