Linux下数据恢复软件extundelete

extundelete软件专门解决意外删除事件的，有时候不小心 rm -rf * 就可能毁掉有用的数据.因此就出现了这个恢复工具，但这个工具也不是万能的，删除数据后一定要停止所以的写操作.以免Inodes空间被重新分配,那样的话就永远恢复不会来拉，只能节哀了...

1.安装extundelete

yum install gcc gcc-c++ -y
yum install e2fs*                    //安装extundelete软件的依赖包
wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
tar jxvf  extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4
./configure  && make && make install

配置临时环境变量，如果永久则写到profile
#export PATH=$PATH:/usr/local/extundelete/bin

我的服务器是centos6.8,文件系统是ext4,一但文件被删除，应马上停止所有写文件的进程或服务，最好将文件系统挂载文只读，以免数据文件被破坏无法恢复。开始恢复！

模拟数据删除及恢复操作.

1.查看挂载详细信息:

[root@localhost ~]# mount
/dev/vda1 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/vdb1 on /data type ext4 (rw,barrier=0)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

# /data目录对应的数据磁盘为/dev/vdb1,我会再/data目录进行数据删除及恢复.

2.构造数据(将local下的目录拷贝到/data目录下,将/etc/passwd文件拷贝/data目录)

[root@localhost ~]#cp /usr/local/ /data/ -rp
[root@localhost data]# ls -lh /data
total 68K
drwxr-xr-x 7 root root 4.0K Aug 23 10:43 aegis
drwxr-xr-x 2 root root 4.0K Aug 23 10:58 bin
drwxr-xr-x 2 root root 4.0K Sep 23  2011 etc
drwxr-xr-x 2 root root 4.0K Sep 23  2011 games
drwxr-xr-x 2 root root 4.0K Sep 23  2011 include
drwxr-xr-x 2 root root 4.0K Sep 23  2011 lib
drwxr-xr-x 2 root root 4.0K Sep 23  2011 lib64
drwxr-xr-x 2 root root 4.0K Sep 23  2011 libexec
drwxr-xr-x 2 root root 4.0K Aug 23 15:29 local
drwx------ 2 root root  16K Jun 28 14:38 lost+found
drwxr-xr-x 2 root root 4.0K Sep 23  2011 sbin
drwxr-xr-x 5 root root 4.0K Jun  5 05:32 share
drwxr-xr-x 2 root root 4.0K Jun 28 14:38 src
drwxr-xr-x 2 root root 4.0K Aug 23 15:21 testdb
-rw-r--r-- 1 root root 1188 Aug 23 09:46 passwd

3.模拟数据误删除：　　

[root@localhost ~]# cd /data/
[root@localhost data]# rm -rf *　　

下面为数据恢复的整个过程了.

4.迅速将/data目录从读写模式恢复为只读模式. (因为将文件删除后，仅仅是将文件的inode结点中的扇区指针清零，实际文件还存储在磁盘上，如果磁盘以读写模式挂载，这些已删除的文件的数据块就可能被操作系统重新分配出去，在这些数据块被新的数据覆盖后，这些数据就真的丢失了，恢复工具也回力无天。所以，以只读模式挂载磁盘可以尽量降低数据块中数据被覆盖的风险，以提高恢复数据成功的比率。)

[root@localhost ~]#mount -r -n -o remount /data
[root@localhost ~]#mount -a 
#挂为只读后，再写入的话会提示
[root@localhost ~]#mkdir /data/testdb
mkdir: cannot create directory `testdb': Read-only file system

#查看文件或文件夹的inodes

[root@localhost ~]# ls -id /data
2 /data
[root@localhost ~]# 

#查看块设备/dev/vdb1的文件详细信息

[root@localhost ~]# extundelete  /dev/vdb1  --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 fa 2e 9d 59 92 32 9d 59 | .A.........Y.2.Y
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
testdb                                            2097153        Deleted
local                                             2883585        Deleted
aegis                                             2883586        Deleted
bin                                               2888356        Deleted
etc                                               2888353        Deleted
games                                             2888355        Deleted
include                                           2888352        Deleted
lib                                               2888360        Deleted
lib64                                             2888359        Deleted
libexec                                           2888351        Deleted
sbin                                              2888354        Deleted
share                                             2888328        Deleted
src                                               2888358        Deleted
passwd                                            2888357        Deleted
[root@localhost ~]# 

恢复单个文件:　　

[root@localhost ~]# extundelete /dev/vdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Loading journal descriptors ... 1292 descriptors loaded.
Successfully restored file passwd
[root@localhost ~]# ll
total 4
drwxr-xr-x 2 root root 4096 Aug 23 16:12 RECOVERED_FILES
[root@localhost ~]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ll
total 4
-rw-r--r-- 1 root root 1188 Aug 23 16:12 passwd
[root@localhost RECOVERED_FILES]# 

#/dev/vdb1对象的挂载目录为/data

恢复单个目录：　　

[root@localhost ~]# extundelete /dev/vdb1 --restore-directory testdb
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Loading journal descriptors ... 1292 descriptors loaded.
Searching for recoverable inodes in directory testdb ... 
4745 recoverable inodes found.
Looking through the directory structure for deleted files ... 
4744 recoverable inodes still lost.
[root@localhost ~]# cd RECOVERED_FILES/
[root@localhost RECOVERED_FILES]# ll
total 4
drwxr-xr-x 2 root root 4096 Aug 23 15:58 testdb
[root@localhost RECOVERED_FILES]# cd testdb/
[root@localhost testdb]# ll
total 4
-rw-r--r-- 1 root root 1188 Aug 23 15:58 passwd
[root@localhost testdb]# 

通过extundelete恢复所有误删除数据:　　

[root@localhost ~]# extundelete  /dev/vdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Loading journal descriptors ... 1292 descriptors loaded.
Searching for recoverable inodes in directory / ... 
4745 recoverable inodes found.
Looking through the directory structure for deleted files ... 
1 recoverable inodes still lost.
[root@localhost ~]# cd RECOVERED_FILES/ 
[root@localhost ~]#ll
drwxr-xr-x 5 root root 4096 Aug 23 16:10 local
drwxr-xr-x 2 root root 4096 Aug 23 16:10 testdb
drwxr-xr-x 7 root root 4096 Aug 23 16:10 aegis
drwxr-xr-x 2 root root 4096 Aug 23 16:10 bin
drwxr-xr-x 3 root root 4096 Aug 23 16:10 share

#有几个目录没有恢复出来，可能是设置只读模式时inode值已改变造成的.

5.将目录/data从只读模式恢复为读写模式.

[root@localhost ~]#mount -rw -n -o remount /data
[root@localhost ~]#mount -a 

6.将恢复的数据从RECOVERED_FILES目录下拷贝到/data目录，至此恢复完成，噢耶.

[root@localhost ~]#cp -rp /root/RECOVERED_FILES/testdb /data/

写这篇是我边测试边写的，数据都是恢复出来然后写的文档.希望有用.

恢复实例见参考文档：

　　http://ixdba.blog.51cto.com/2895551/1566856/