**
**
1、 前言
在linux中,可能会误删文件,从而需要进行误删恢复,主要针对ext系列的文件系统,使用的到软件名称为extundelete-0.2.4.tar.gz。
在进行删除的时候,可以使用两种方式,分别如下:
① 在进行删除的时候,将需要删除的文件移动到/tmp目录中,然后定时清理/tmp目录下的文件,例如清楚七天以前的文件;
② 在进行删除等变更的时候,必须进行备份,例如将文件均备份在目录/backup/kel-20160913.bak中。
2、 安装恢复软件
安装步骤如下所示(所依赖的安装包记得阅读README文件):
[root@rsyncserver~]# tar -jxvf extundelete-0.2.4.tar.bz2 (解压缩)
[root@rsyncserverextundelete-0.2.4]# yum -y install e2fsprogs-devel(安装依赖包)
[root@rsyncserverextundelete-0.2.4]# ./configure (编译)
Configuringextundelete 0.2.4
Writinggenerated files to disk
[root@rsyncserverextundelete-0.2.4]# echo $?(查看是否编译成功)
0
[root@rsyncserverextundelete-0.2.4]# make && make install(安装)
make-s all-recursive
Makingall in src
extundelete.cc:571:warning: unused parameter ‘flags’
Makinginstall in src
/usr/bin/install -c extundelete'/usr/local/bin'
检查安装结果:
[root@rsyncserverextundelete-0.2.4]# extundelete --version(查看版本信息)
extundeleteversion 0.2.4
libext2fsversion 1.41.12
Processoris little endian.
3、 模拟误删恢复
分区和文件如下所示:
[root@rsyncserveropt]# ls -l(需要恢复的文件,一个是空文件,一个是有内容的目录)
total4
-rw-r--r--1 root root 0 Sep 13 07:46 123
drwxr-xr-x7 root root 4096 Sep 8 07:51 kel
[root@rsyncserveropt]# df -Ph(分区结构)
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 9.9G 5.1G 4.3G 55% /
tmpfs 67M 0 67M 0% /dev/shm
/dev/sda1 485M 32M 428M 7% /boot
/dev/sda5 9.9G 152M 9.2G 2% /opt
3.1 删除/opt目录下的文件
模拟先删除所有/opt下的文件,如下所示:
[root@rsyncserveropt]# rm -rf *(误删所有文件)
[root@rsyncserveropt]# ls -l
total0
3.2 卸载/opt所在的分区
在误删文件之后,应卸载误删文件所在的分区,或者将误删文件所在的分区挂载为只读模式,如下所示:
[root@rsyncserver~]# umount /opt(卸载所在分区)
[root@rsyncserver~]# mount -o ro /dev/sda5 /opt(挂载为只读模式)
这一步的主要作用是防止新加入的数据对原来的文件进行了覆盖。
3.3 恢复
在恢复的时候,必须考虑到恢复的文件的大小,从而需要有足够大的磁盘空间来容纳需要恢复的文件;并且恢复的软件不要安装在误删文件的分区中,如下所示:
[root@rsyncserver~]# mkdir restore(创建恢复文件目录)
[root@rsyncserver~]# cd restore/
[root@rsyncserverrestore]# extundelete --inode 2 /dev/sda5(查看所有删除文件)
NOTICE:Extended attributes are not restored.
Loadingfilesystem metadata ... 80 groups loaded.
Group:0
Contentsof inode 2:
0000| ed 41 00 00 00 10 00 00 05 3f d7 57 04 3f d7 57 | .A.......?.W.?.W
0010| 04 3f d7 57 00 00 00 00 00 00 02 00 08 00 00 00 | .?.W............
0020| 00 00 00 00 05 00 00 00 b1 22 00 00 00 00 00 00 | ........."......
0030| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080| 1c 00 00 00 98 96 e9 ae 98 96 e9 ae bc 35 f1 e1 | .............5..
0090| 83 89 d0 57 00 00 00 00 00 00 00 00 00 00 00 00 | ...W............
00a0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inodeis Allocated
Filemode: 16877
Low16 bits of Owner Uid: 0
Sizein bytes: 4096
Accesstime: 1473724165
Creationtime: 1473724164
Modificationtime: 1473724164
DeletionTime: 0
Low16 bits of Group Id: 0
Linkscount: 2
Blockscount: 8
Fileflags: 0
Fileversion (for NFS): 0
FileACL: 0
DirectoryACL: 0
Fragmentaddress: 0
Directblocks: 8881, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirectblock: 0
Doubleindirect block: 0
Tripleindirect block: 0
Filename | Inode number | Deleted status
. 2
.. 2
kel 393985 Deleted
123 11 Deleted
[root@rsyncserverrestore]# extundelete --restore-all /dev/sda5(恢复所有的文件)
NOTICE:Extended attributes are not restored.
Loadingfilesystem metadata ... 80 groups loaded.
Loadingjournal descriptors ... 1378 descriptors loaded.
Searchingfor recoverable inodes in directory / ...
109recoverable inodes found.
Lookingthrough the directory structure for deleted files ...
0recoverable inodes still lost.
[root@rsyncserverrestore]# ls -l(查看恢复结果)
total4
drwxr-xr-x3 root root 4096 Sep 13 07:56 RECOVERED_FILES(默认创建的恢复目录)
[root@rsyncserverrestore]# cd RECOVERED_FILES/
[root@rsyncserverRECOVERED_FILES]# ls -l(查看恢复的文件)
total4
drwxr-xr-x7 root root 4096 Sep 13 07:56 kel
在使用查看恢复目录的时候,使用的inode号为2,因为所有挂载的inode首节点为2,从而使用的inode为2,;
在使用设备的时候,必须使用设备名,例如/dev/sda5;
在恢复的时候,默认不会恢复空文件或者空文件夹,上述的空文件123未恢复。
3.4 挂载分区
挂载分区为可读可写模式,然后拷贝恢复文件回去,如下:
[root@rsyncserver~]# mount -o remount,rw /dev/sda5(挂载为可读写模式)
[root@rsyncserverRECOVERED_FILES]# mv kel/ /opt/(将恢复文件拷贝回去)
[root@rsyncserverRECOVERED_FILES]# cd /opt
[root@rsyncserveropt]# ls -l(查看结果)
total4
drwxr-xr-x7 root root 4096 Sep 13 07:56 kel
4、 格式化后恢复
在将分区格式化之后,利用此软件是无法恢复的,如下所示:
[root@rsyncserver~]# mkfs.ext4 /dev/sda5(格式化)
[root@rsyncserverrestore]# extundelete /dev/sda5 --restore-all(格式化磁盘后进行恢复)
NOTICE:Extended attributes are not restored.
Loadingfilesystem metadata ... 3085 groups loaded.
Loadingjournal descriptors ... 1 descriptors loaded.
Searchingfor recoverable inodes in directory / ...
0recoverable inodes found.
Lookingthrough the directory structure for deleted files ...
0recoverable inodes still lost.
Nofiles were undeleted.
本文分享自微信公众号 - SRE运维实践(gh_319dd73ec076)。
如有侵权,请联系 support@oschina.cn 删除。
本文参与“OSC源创计划”,欢迎正在阅读的你也加入,一起分享。