誤刪linux文件恢復
阿新 • • 發佈：2018-12-10
mod -s device spro name locate 4.0 res 誤刪 Linux下文件誤刪除，使用extundelete恢復測試過程
extundelete下載官網地址：https://pkgs.org/download/extundelete
- 給虛擬主機添加一塊磁盤，磁盤為/dev/sdb
[root@localhost bin]# cat /proc/scsi/scsi Attached devices: Host: scsi2 Channel: 00 Id: 00 Lun: 00 Vendor: VMware Model: Virtual disk Rev: 1.0 Type: Direct-Access ANSI SCSI revision: 02 Host: scsi1 Channel: 00 Id: 00 Lun: 00 Vendor: NECVMWar Model: VMware IDE CDR10 Rev: 1.00 Type: CD-ROM ANSI SCSI revision: 05 [root@localhost bin]# echo "scsi add-single-device 2 0 1 0">/proc/scsi/scsi [root@localhost bin]# fdisk -l [root@localhost bin]# fdisk /dev/sdb [root@localhost bin]# partprobe /dev/sdb [root@localhost bin]# mkfs.xfs /dev/sdb1 [root@localhost bin]# mount /dev/sdb1 /mnt/
- 執行誤操作：
[root@localhost mnt]# ls
redis-4.0.11 redis-4.0.11.tar.gz
[root@localhost mnt]# rm -rf redis-4.0.11*
- 將誤操作所在分區進行只讀保護
如果確定文件被誤刪，在沒有備份的情況下請馬上對分區實施寫入保護（預防新的寫入覆蓋誤刪的塊數據，因此權限給只讀）：
[root@localhost /]# mount -o remount,ro /dev/sdb1
[root@localhost /]# mount -o remount,ro /mnt/
- 安裝部署數據恢復工具extundelete
安裝依賴包
[root@localhost /]# yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64 [root@localhost /]# cd /app/soft/ [root@localhost soft]# wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 [root@localhost soft]# tar -jxvf extundelete-0.2.4.tar.bz2 [root@localhost soft]# cd extundelete-0.2.4 [root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4 Writing generated files to disk [root@localhost extundelete-0.2.4]# make make -s all-recursive Making all in src extundelete.cc: In function ‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’: extundelete.cc:1272:29: warning: narrowing conversion of ‘search_flags’ from ‘int’ to ‘ext2_ino_t {aka unsigned int}’ inside { } [-Wnarrowing] buf, match_name2, priv, 0}; ^ [root@localhost extundelete-0.2.4]# make install Making install in src /bin/install -c extundelete ‘/usr/local/bin‘ [root@localhost extundelete-0.2.4]# extundelete -v extundelete version 0.2.4 libext2fs version 1.42.9 Processor is little endian. [root@localhost extundelete-0.2.4]# extundelete --help 其中，參數（options）有： --version, -[vV]，顯示軟件版本號。 --help，顯示軟件幫助信息。 --superblock，顯示超級塊信息。 --journal，顯示日誌信息。 --after dtime，時間參數，表示在某段時間之後被刪的文件或目錄。 --before dtime，時間參數，表示在某段時間之前被刪的文件或目錄。 動作（action）有： --inode ino，顯示節點“ino”的信息。 --block blk，顯示數據塊“blk”的信息。 --restore-inode ino[,ino,...]，恢復命令參數，表示恢復節點“ino”的文件，恢復的文件會自動放在當前目錄下的RESTORED_FILES文件夾中，使用節點編號作為擴展名。 --restore-file ‘path‘，恢復命令參數，表示將恢復指定路徑的文件，並把恢復的文件放在當前目錄下的RECOVERED_FILES目錄中。 --restore-files ‘path‘，恢復命令參數，表示將恢復在路徑中已列出的所有文件。 --restore-all，恢復命令參數，表示將嘗試恢復所有目錄和文件。 -j journal，表示從已經命名的文件中讀取擴展日誌。 -b blocknumber，表示使用之前備份的超級塊來打開文件系統，一般用於查看現有超級塊是不是當前所要的文件。 -B blocksize，通過指定數據塊大小來打開文件系統，一般用於查看已經知道大小的文件。
- 文件恢復
原理：從根節點(inode=2)開始找到被刪除文件的i節點，然後recover i節點。 以下是模擬刪除redis-4.0.11.tar.gz（文件）和redis-4.0.11 （目錄）
[root@localhost extundelete-0.2.4]# extundelete /dev/sdb --inode 2
extundelete: Bad magic number in super-block when trying to open filesystem /dev/sdb
[root@localhost extundelete-0.2.4]# df -Th /dev/sdb1
Filesystem Type Size Used Avail Use% Mounted on
/dev/sdb1 xfs 100G 176K 100G 1% /mnt
[root@localhost extundelete-0.2.4]#不支持xfs文件格式的恢復，實驗中重新格式化成ext4格式測試。
[root@localhost /]# extundelete /dev/sdb1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 800 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 8a 33 0e 5c 3e 34 0e 5c | .A.......3.\>4.0010 | 3e 34 0e 5c 00 00 00 00 00 00 03 00 08 00 00 00 | >4.\............
0020 | 00 00 08 00 04 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 2e 24 00 00 | .............$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 24 de 02 30 24 de 02 30 24 0e 0b d4 | ....$..0$..0$...
0090 | a0 31 0e 5c 00 00 00 00 00 00 00 00 00 00 00 00 | .1.\............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1544434570
Creation time: 1544434750
Modification time: 1544434750
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9262, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11
redis-4.0.11.tar.gz 12 Deleted
redis-4.0.11 5505025 Deleted
[root@localhost /]# 恢復過程不要在誤刪分區進行，謹防inode. block塊相互覆蓋
恢復文件（可根據文件名進行恢復）：
[root@localhost /]# extundelete /dev/sdb1 --restore-file redis-4.0.11.tar.gz
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Successfully restored file redis-4.0.11.tar.gz
[root@localhost /]# 恢復目錄（根據目錄名恢復）：
[root@localhost /]# extundelete /dev/sdb1 --restore-directory redis-4.0.11
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Searching for recoverable inodes in directory redis-4.0.11 ...
26 recoverable inodes found.
Looking through the directory structure for deleted files ...
5 recoverable inodes still lost.
[root@localhost /]# 恢復所有數據
[root@localhost /]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 153 groups loaded.
Loading journal descriptors ... 79 descriptors loaded.
Searching for recoverable inodes in directory / ...
26 recoverable inodes found.
Looking through the directory structure for deleted files ...
1 recoverable inodes still lost.
[root@localhost /]#在當前目錄下ECOVERED_FILES的目錄，在目錄裏就可以看到被誤刪除的文件以及目錄，恢復回來的文件權限可能會變化。extundelete還可以實現恢復某個時間段的數據。可以通過“--after”和“--before”參數實現！
誤刪linux文件恢復