使用extundelete恢复误删除的文件

使用extundelete恢复误删除的文件
 
2012.07.25 TsengYia#126.com http://tsengyia.blog.chinaunix.net/

 

    针对Linux下的EXT文件系统来说，常用的误删恢复工具有debugfs、ext3grep、extundelete等等。extundelete是一个开源的数据恢复工具，支持ext3、ext4文件系统，其官方站点位于

，目前最新稳定版本为0.2.0。
 
#################################################################
 
系统环境： 
    RHEL 6.2 [2.6.32-220.el6.i686]
 
软件环境：
    e2fsprogs-devel-1.41.12-11.el6.i686
    extundelete-0.2.0.tar.bz2
 
#################################################################

 

一、安装extundelete

 

1. 安装依赖包

[root@localhost ~]# yum -y install e2fsprogs e2fsprogs-devel

 

2. 配置、编译及安装
[root@localhost ~]# tar jxf extundelete-0.2.0.tar.bz2
[root@localhost ~]# cd extundelete-0.2.0/
[root@localhost extundelete-0.2.0]# ./configure
[root@localhost extundelete-0.2.0]# make && make install

 

二、执行各种恢复操作

 

1. 准备测试环境（挂载指定分区，删除部分文件）

[root@localhost ~]# mkdir /media/recdisk
[root@localhost ~]# mount /dev/sdb7 /media/recdisk/

[root@localhost ~]# ls -R /media/recdisk/
/media/recdisk/:
file1.txt    lost+found    testdir

/media/recdisk/lost+found:

/media/recdisk/testdir:
httpd.conf

 

[root@localhost ~]# rm -rf /media/recdisk/*
[root@localhost ~]# umount /dev/sdb7

 

2. 恢复所有已删除的文件、文件夹

 

[root@localhost ~]# extundelete /dev/sdb7 --restore-all
.. ..
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ...
3 recoverable inodes found.
Looking through the directory structure for deleted files ...
Restored inode 12 to file RECOVERED_FILES/file1.txt
Failed to restore inode 2017 to file RECOVERED_FILES/testdir:Inode does not correspond to a regular file.
Restored inode 13 to file RECOVERED_FILES/testdir/httpd.conf
0 recoverable inodes still lost.

 

[root@localhost ~]# ls -R RECOVERED_FILES/      //检查恢复结果
RECOVERED_FILES/:
file1.txt    testdir
RECOVERED_FILES/testdir:
httpd.conf

 

3. 只恢复指定的某个文件、文件夹

 

[root@localhost ~]# extundelete /dev/sdb7 --restore-file /file1.txt
.. ..
Writing output to directory RECOVERED_FILES/
Restored inode 12 to file RECOVERED_FILES/file1.txt

 

[root@localhost ~]# extundelete /dev/sdb7 --restore-directory /testdir
.. ..
3 recoverable inodes found.
Looking through the directory structure for deleted files ...
Restored inode 13 to file RECOVERED_FILES/testdir/httpd.conf
2 recoverable inodes still lost.

#################################################################