linux下误删除，恢复数据，extundelete比较好用

1：作为系统管理员来说，误删除数据是难免的，总在河边走，哪有不湿邪的道理啊！，所以我经历过多次这样的误删除状况，最多一次是上百G的数据（这次是客户误删除的）。

2：Linux下比较常见的反删除工具有debugfs、R-Linux、ext3grep和extundelete。

3：我用的比较多的是ext3grep和extundelete，相比ext3grep来说，extundelete更加好用，支持Linux下主流文件系统ext2/3/4，并且恢复速度很快，扫描inode和恢复数据同时进行，支持单个文件恢复、单个目录恢复、inode恢复，block恢复，完全恢复等，而ext3grep就略显笨拙了，仅能恢复ext3文件系统数据，恢复速度也很慢，不支持目录恢复，这点不太好！

4：一句话：备份不是万能的，但是没有备份是万万不行的！

hades@hades-desktop:/$ sudo apt-get install ext2fs-dev

hades@hades-desktop:/$ tar jxvf extundelete-0.2.0.tar.bz2

hades@hades-desktop:/$ cd extundelete-0.2.0

hades@hades-desktop:/$ ./configure

hades@hades-desktop:/$ make

hades@hades-desktop:/$ make install

hades@hades-desktop:/$ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 75432064 3735752 67864556 6% /
none 250076 268 249808 1% /dev
none 254288 80 254208 1% /dev/shm
none 254288 376 253912 1% /var/run
none 254288 0 254288 0% /var/lock
none 254288 0 254288 0% /lib/init/rw

hades@hades-desktop:/$ sudo extundelete /dev/sda1 --restore-file /home/hades/work/test

WARNING: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 143 groups loaded.
Loading journal descriptors ... 29535 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Restored inode 4223596 to file RECOVERED_FILES/home/hades/work/test

ok,这样就恢复成功了。