一：环境搭建
1.下载http://extundelete.sourceforge.net/
2.安装e2fsprogs和e2fsprogs-libs
|
1
|
yum
install
e2fsprogs e2fsprogs-libs -y
|
3.上传文件至linux主机
|
1
|
put C:
/Users/CPIC/Desktop/extundelete-0
.2.4.
tar
.bz2
|
4.安装软件
|
1
2
3
4
|
tar
jxvf extundelete-0.2.4.
tar
.bz2
cd
/root/extundelete-0
.2.4
.
/configure
make
&
make
install
|
|
1
2
3
4
5
6
7
8
|
报错：
（1）configure: error:
in
`
/root/Desktop/extundelete-0
.2.4':
configure: error: C++ compiler cannot create executables
解决：yum
install
gcc* -y
（2）Configuring extundelete 0.2.4
configure: error: Can't
find
ext2fs library
解决：yum
install
e2fsprogs* -y
|
二：实验
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
mkdir
/shiyan
#创建挂载目录
fdisk
/dev/sdb
#划分为一个主分区
n-p-1-w
mount
/dev/sdb1
/shiyan
#挂载
cp
-a
/etc/passwd
/shiyan/
#复制文件
cd
/shiyan
rm
-rf
passwd
#删除文件
umount
/shiyan
#卸载文件系统
[root@node1 /]
# extundelete /dev/sdb1 --inode 2 #查看inode信息，重要！！
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 8
groups
loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 7c 8f ed 59 77 8f ed 59 | .A......|..Yw..Y
0010 | 77 8f ed 59 00 00 00 00 00 00 02 00 08 00 00 00 | w..Y............
0020 | 00 00 00 00 03 00 00 00 49 00 00 00 00 00 00 00 | ........I.......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 00 19 23 02 00 19 23 02
dc
ff 9c b1 | ......
#...#.....
0090 | 33 8f ed 59 00 00 00 00 00 00 00 00 00 00 00 00 | 3..Y............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size
in
bytes: 4096
Access
time
: 1508740988
Creation
time
: 1508740983
Modification
time
: 1508740983
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (
for
NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11 Deleted
passwd
12 Deleted
|
恢复单个文件：extundelete /dev/sdb1 --restore-file 原来文件存储的相对路径
原来文件的存储路径为/data/passwd ,那么参数后面直接指定passwd；如果原来的文件路径为/data/test/passwd,那么参数后面test/passwd.
恢复单个目录：extundelete /dev/sdb1 --restore-directory /aaa
原来存储目录路径为： /data/aaa
恢复所有删除的数据：extundelete /dev/sdb1 --restore-all
最后在当前目录下的RECOVERED_FILES目录中找到误删的文件。
注意：删除的第一时间要卸载文件系统。
本文转自 a8757906 51CTO博客，原文链接:http://blog.51cto.com/nxyboy/1975244
