Linux下誤删除後的恢複操作（ext3/ext4）

Linux是作為一個多使用者、多任務的作業系統，檔案一旦被删除是難以恢複的。盡管删除指令隻是在檔案節點中作删除标記，并不真正清除檔案内容，但是其他使用者和一些有寫盤動作的程序會很快覆寫這些資料。在日常工程中，誰也說不準永遠不犯錯誤，萬一哪天不小心誤操作删除了一些重要檔案，該怎麼辦呢？？

莫慌！這裡介紹一款神器extundelete，這是針對ext4檔案格式下檔案删除後的恢複工具，十分強大！！

廢話不多說，下面開始介紹這款神器的使用：

1）下載下傳并安裝軟體

擷取位址：xsmg

下載下傳到本機的/usr/local/src目錄下

[root@slave-node ~]# cd /usr/local/src

[root@slave-node src]# tar -jvxf extundelete-0.2.0.tar.bz2 

[root@slave-node src]# cd extundelete-0.2.0

[root@slave-node extundelete-0.2.0]# yum -y install e2fsprogs*                      //不然會提示找不到ext2fs庫

[root@slave-node extundelete-0.2.0]# ./configure

[root@slave-node extundelete-0.2.0]# make && make install

2)執行删除操作（要是/根分區之外的分區，并且隻能是檔案删除後的恢複，目錄删除不能恢複）

[root@slave-node ~]# df -T

Filesystem Type 1K-blocks Used Available Use% Mounted on

/dev/sda3 ext4 151189708 2370020 141139688 2% /

tmpfs tmpfs 32960412 0 32960412 0% /dev/shm

/dev/sda1 ext4 198337 26798 161299 15% /boot

/dev/sda2 ext4 806346400 201304 765185096 1% /home

[root@slave-node ~]# cd /home/

[root@slave-node home]# echo "123456"> test1

[root@slave-node home]# echo "hahahahha" > wangshibo

[root@slave-node home]# ls

lost+found test1 wangshibo zabbix

删除檔案

[root@slave-node home]# rm -rf test1 wangshibo 

lost+found zabbix

3）資料删除後的恢複操作

首先恢複前，解除安裝需要恢複檔案的分區

[root@slave-node ~]# umount /home/               //如果解除安裝失敗，就用指令"fuser -k /home"結束使用此分區的程序樹

/dev/sda3 ext4 151189708 2370024 141139684 2% /

使用extundelete檢視分區上存在的檔案,如下：

--inode 為查找某i節點中的内容，使用2則說明為搜尋，如果需要進入目錄搜尋，隻須要指定目錄I節點即可

[root@slave-node ~]# extundelete --inode 2 /dev/sda2

WARNING: Extended attributes are not restored.

Loading filesystem metadata ... 6250 groups loaded.

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 84 10 49 58 82 10 49 58 | .A........IX..IX

0010 | 82 10 49 58 00 00 00 00 00 00 04 00 08 00 00 00 | ..IX............

0020 | 00 00 00 00 07 00 00 00 21 24 00 00 00 00 00 00 | ........!$......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 00 00 00 00 00 00 00 00 11 10 00 00 00 00 00 00 | ................

0090 | 00 00 00 00 00 00 00 00 62 0e 49 58 62 0e 49 58 | ........b.IXb.IX

00a0 | 62 0e 49 58 00 00 00 00 00 00 00 00 00 00 00 00 | b.IX............

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

Group: 0

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1481183364

Creation time: 1481183362

Modification time: 1481183362

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 4

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name | Inode number | Deleted status

Directory block 9249:

. 2

.. 2

lost+found 11

haha 12 Deleted

zabbix 17432577

test1 12 Deleted

wangshibo 13 Deleted

如上可以看出，被删除的兩個檔案test1和wangshibo已經被找到，狀态為已經删除。

接下來就将它們恢複出來：

[root@slave-node ~]# extundelete --restore-inode 12 /dev/sda2

Loading journal descriptors ... 46 descriptors loaded.

Restored inode 12 to file RECOVERED_FILES/file.12

[root@slave-node ~]# extundelete --restore-inode 13 /dev/sda2

Restored inode 13 to file RECOVERED_FILES/file.13

[root@slave-node ~]# ls RECOVERED_FILES/

file.12 file.13

[root@slave-node ~]# mount /dev/sda2 /home/               //重新挂載home分區

[root@slave-node ~]# mv RECOVERED_FILES/file.12 /home/test1

[root@slave-node ~]# mv RECOVERED_FILES/file.13 /home/wangshibo

再次檢視home分區，發現删除的檔案已經恢複回來了,很強大！！！

[root@slave-node home]# cat test1 

123456

[root@slave-node home]# cat wangshibo 

hahahahha

------------------------------------------------------------------------------------------------------

上面介紹的是在ext4檔案格式下的檔案删除後的恢複，那如果是ext3檔案格式下的檔案删除後想恢複，怎麼辦呢？

可以使用debugfs工具，這是linux系統自帶工具，debugfs恢複Ext3的檔案系統中被rm、rm -f 掉的檔案。

執行個體說明：

[root@slave-node ~]# df -T

/dev/sda3 ext3 151189708 2370036 141139672 2% /

/dev/sda1 ext3 198337 26798 161299 15% /boot

建立一個檔案

[root@slave-node ~]# mkdir test

[root@slave-node ~]# echo "123456" > /root/test/test.file

[root@slave-node ~]# rm -rf /root/test/test.file

接着運用系統自帶工具debugfs來恢複已删除的檔案

首先打開，剛剛被删除檔案所在的分區

注意上面顯示的有<>尖括号内的數字就是我們要找的檔案Inode号，執行logdump –i <8654024>

[root@slave-node ~]# debugfs 

debugfs 1.41.12 (17-May-2010)

debugfs: open /dev/sda3

debugfs: ls -d /root/test

8654023 (12) . 8519681 (4084) .. <8654024> (4072) test.file 

debugfs: logdump -i 8654024

FS block 1006 logged at sequence 404351, journal block 7241

(inode block for inode 15):

Inode: 15 Type: regular Mode: 0664 Flags: 0×0 Generation: 0

User: 0 Group: 0 Size: 20

File ACL: 0 Directory ACL: 0

Links: 1 Blockcount: 8

Fragment: Address: 0 Number: 0 Size: 0

ctime: 0×48159f2d — Mon Apr 28 15:25:57 2008

atime: 0×48159f27 — Mon Apr 28 15:25:51 2008

mtime: 0×4806f070 — Thu Apr 17 12:08:40 2008

Blocks: (0+1): 102348

No magic number at block 7247: end of journal.

執行完指令後，顯示了一屏資訊，需要注意的是下面Blocks這一行後面的值（如上資訊，需要記住Blocks這一行後面的數字102348）

輸入quit，退出debugfs

debugfs: quit

[root@slave-node ~]#

執行如下指令進行恢複：

[root@slave-node ~]# dd if=/dev/sda3 of=/tmp/test.file.bk bs=4096 count=1 skip=102348

1+0 records in

1+0 records out

4096 bytes (4.1 kB) copied, 0.0110028 s, 372 kB/s

最後檢視tmp目錄下，發現已經恢複了我們之前删除的檔案内容

[root@slave-node ~]# cd /tmp/

[root@slave-node tmp]# cat test.file.bk

[root@slave-node tmp]# mv test.file.bk /root/test.file

[root@slave-node tmp]# cat /root/test.file

***************當你發現自己的才華撐不起野心時，就請安靜下來學習吧***************

本文轉自散盡浮華部落格園部落格，原文連結：http://www.cnblogs.com/kevingrace/p/6145308.html，如需轉載請自行聯系原作者