Tips: 本文创建于2015年11月15日,已超过 2 年,内容或图片可能已经失效!

extundelete

extundelete.png

extundelete 解决 rm -rf 的困扰

官网

安装

yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel  
  
tar jxvf extundelete-0.2.4.tar.bz2  
cd extundelete-0.2.4  
./configure  
make && make instll  

参数

extundelete --help  
Usage: extundelete [options] [--] device-file  
Options:  
  --version, -[vV]       Print version and exit successfully.   #显示软件版本号  
  --help,                Print this help and exit successfully.     #显示软件帮助信息  
  --superblock           Print contents of superblock in addition to the rest.  #显示超级块信息  
                         If no action is specified then this option is implied.  
  --journal              Show content of journal.   #显示日志信息  
  --after dtime          Only process entries deleted on or after 'dtime'.  #时间参数,表示在某段时间之后被删除的文件或目录  
  --before dtime         Only process entries deleted before 'dtime'.   #时间参数,表示在某段时间值钱被删除的文件或目录  
Actions:  
  --inode ino            Show info on inode 'ino'.  #显示节点 ino 的信息  
  --block blk            Show info on block 'blk'.  #显示数据块 blk 的信息  
  --restore-inode ino[,ino,...]     #恢复命令参数,表示恢复节点 ino 的文件,恢复的文件会自动放在当前目录下的 RESTORED_FILES目录中  
                         Restore the file(s) with known inode number 'ino'.  
                         The restored files are created in ./RECOVERED_FILES  
                         with their inode number as extension (ie, file.12345).  
  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root   #恢复命令参数,表示将恢复指定路径的文件,并把恢复的文件放到当前目录下的 RESTORED_FILES 目录中  
                         of the partition and does not start with a '/'  
                         The restored file is created in the current  
                         directory as 'RECOVERED_FILES/path'.  
  --restore-files 'path' Will restore files which are listed in the file 'path'.    #恢复命令参数,表示将恢复在路径中已列出的所有文件  
                         Each filename should be in the same format as an option  
                         to --restore-file, and there should be one per line.  
  --restore-directory 'path'  
                         Will restore directory 'path'. 'path' is relative to the  
                         root directory of the file system.  The restored  
                         directory is created in the output directory as 'path'.  
  --restore-all          Attempts to restore everything.    #恢复命令参数,表示将尝试恢复所有目录和文件  
  -j journal             Reads an external journal from the named file. #表
示从已经命名的文件中读取扩展日志  
  -b blocknumber         Uses the backup superblock at blocknumber when opening #表示使用之前备份的超级块来打开文件系统,一般用于查看现有超级块是不是当前所要的文件  
                         the file system.  
  -B blocksize           Uses blocksize as the block size when opening the file     #通过指定数据块大小来打开文件系统,一般用于查看已经知道大小的文件  
                         system.  The number should be the number of bytes.  
  --log 0                Make the program silent.  
  --log filename         Logs all messages to filename.  
--log D1=0,D2=filename   Custom control of log messages with comma-separated  
   Examples below:       list of options.  Dn must be one of info, warn, or  
   --log info,error      error.  Omission of the '=name' results in messages  
   --log warn=0          with the specified level to be logged to the console.  
   --log error=filename  If the parameter is '=0', logging for the specified  
                         level will be turned off.  If the parameter is  
                         '=filename', messages with that level will be written  
                         to filename.  
   -o directory          Save the recovered files to the named directory.  
                         The restored files are created in a directory  
                         named 'RECOVERED_FILES/' by default.  

使用

mount /dev/sdb1 /data  
cd /data  
cp -rf /etc/passwd .  
cp -rf /usr/local/src/extundelete-0.2.4 .  
mkdir test  
echo "extundelete test" > /data/test/mytest.txt  
md5sum passwd  
499b16cbdef03e814f3405fccd188dcc  passwd  
md5sum test/mytest.txt  
eb42e4b3f953ce00e78e11bf50652a80  test/mytest.txt  
rm -rf *  

查询可恢复的数据信息

extundelete /dev/sdb1 --inode 2  
NOTICE: Extended attributes are not restored.  
Loading filesystem metadata ... 40 groups loaded.  
Group: 0  
Contents of inode 2:  
0000 | ed 41 00 00 00 10 00 00 af dc 30 56 e0 dc 30 56 | .A........0V..0V  
0010 | e0 dc 30 56 00 00 00 00 00 00 02 00 08 00 00 00 | ..0V............  
0020 | 00 00 00 00 0d 00 00 00 61 21 00 00 00 00 00 00 | ........a!......  
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
0080 | 1c 00 00 00 44 dc 7d 52 44 dc 7d 52 a0 ae e6 cf | ....D.}RD.}R....  
0090 | b7 da 30 56 00 00 00 00 00 00 00 00 00 00 00 00 | ..0V............  
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................  
  
Inode is Allocated  
File mode: 16877  
Low 16 bits of Owner Uid: 0  
Size in bytes: 4096  
Access time: 1446042799  
Creation time: 1446042848  
Modification time: 1446042848  
Deletion Time: 0  
Low 16 bits of Group Id: 0  
Links count: 2  
Blocks count: 8  
File flags: 0  
File version (for NFS): 0  
File ACL: 0  
Directory ACL: 0  
Fragment address: 0  
Direct blocks: 8545, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0  
Indirect block: 0  
Double indirect block: 0  
Triple indirect block: 0  
  
File name                                       | Inode number | Deleted status  
.                                                 2  
..                                                2  
passwd                                            11             Deleted  
extundelete-0.2.4                                 131073         Deleted  
test                                              12             Deleted  
test                   &nb
sp;                          131090         Deleted  

恢复单个文件

# --restore-file 恢复的是相对路径,比如原来的文件路径是/data/passwd,那么在参数后面直接指定 passwd 即可  
  
extundelete /dev/sdb1 --restore-file passwd  
NOTICE: Extended attributes are not restored.  
Loading filesystem metadata ... 40 groups loaded.  
Loading journal descriptors ... 123 descriptors loaded.  
Successfully restored file passwd  
[[email protected] /]# cd RECOVERED_FILES/  
[[email protected] RECOVERED_FILES]# ls  
passwd  
  
md5sum passwd  
499b16cbdef03e814f3405fccd188dcc  passwd 

恢复单个目录

extundelete /dev/sdb1 --restore-directory /extundelete-0.2.4  
NOTICE: Extended attributes are not restored.  
Loading filesystem metadata ... 40 groups loaded.  
Loading journal descriptors ... 123 descriptors loaded.  
Searching for recoverable inodes in directory /extundelete-0.2.4 ...  
57 recoverable inodes found.  
Looking through the directory structure for deleted files ...  
4 recoverable inodes still lost.  
  
ls -al RECOVERED_FILES/  
总用量 16  
drwxr-xr-x.  3 root root 4096 10月 28 22:43 .  
dr-xr-xr-x. 24 root root 4096 10月 28 22:40 ..  
drwxr-xr-x.  3 root root 4096 10月 28 22:43 extundelete-0.2.4  
-rw-r--r--.  1 root root  856 10月 28 22:40 passwd  

恢复所有误删除数据

extundelete /dev/sdb1 --restore-all  
NOTICE: Extended attributes are not restored.  
Loading filesystem metadata ... 40 groups loaded.  
Loading journal descriptors ... 123 descriptors loaded.  
Searching for recoverable inodes in directory / ...  
57 recoverable inodes found.  
Looking through the directory structure for deleted files ...  
0 recoverable inodes still lost.  

恢复某个时间段的数据

#恢复一小时之内的  
date +%s - 3600  
1446046272-3600  
  
extundelete --after 1446042672 --restore-all /dev/sdb1