centos下rm文件删除恢复

分类:CentOS教程 阅读:53529 次

系统是centos 6.5 x64位系统

rm文件删除之后,恢复比较麻烦。

可以使用extundelete进行恢复

目前最新版本是0.2.4

extundelete 主页:http://extundelete.sourceforge.net/

下载软件

wgethttp://fossies.org/linux/misc/extundelete-0.2.4.tar.gz

安装组件

yum install -y e2fsprogs e2fsprogs-devel e2fsprogs-libs

安装extundelete

tar zxvf extundelete-0.2.4.tar.gz -C /usr/src/

cd /usr/src/extundelete-0.2.4/

./configure

make

make install

恢复的时候,需要卸载分区。如果你需要的恢复的文件在根分区,那么需要在另外一台服务器进行恢复。

所以我挂载了一个测试分区

[root@localhost ~]#df -hT

Filesystem Type Size Used Avail Use% Mounted on

/dev/mapper/VolGroup-lv_root ext4 29G 1.2G 26G 5% /

tmpfs tmpfs 246M 0 246M 0% /dev/shm

/dev/sda1 ext4 485M 33M 427M 8% /boot

/dev/sdb1 ext4 1008M 18M 940M 2% /test

写入文件,内容是111

[root@localhost ~]#vi /test/1.txt

删除文件

[root@localhost ~]#rm -rf /test/*

结束使用某分区的进程树

[root@localhost ~]#fuser -k /test

卸载分区

[root@localhost ~]#umount /test/

使用extundelete查看分区上存在的文件

--inode 为查找某i节点中的内容,使用2则说明为搜索,如果需要进入目录搜索,只须要指定目录I节点即可

[root@localhost ~]#extundelete --inode 2 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 a9 bf 75 55 a8 bf 75 55 | .A........uU..uU

0010 | a8 bf 75 55 00 00 00 00 00 00 02 00 08 00 00 00 | ..uU............

0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........I.......

0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 28 6d b5 65 28 6d b5 65 78 80 59 bf | ....(m.e(m.ex.Y.

0090 | 6c bf 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | l.uU............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1433780137

Creation time: 1433780136

Modification time: 1433780136

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 2

Blocks count: 8

File flags: 0

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name | Inode number | Deleted status

. 2

.. 2

lost+found 11 Deleted

.1.txt.swp 12 Deleted

1.txt 13 Deleted

从以上信息,可以看出,需要恢复的文件1.txt的I节点为13

恢复文件

--restore-inode 恢复指定的I节点文件,默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下,文件名为 file.I节点号

[root@localhost ~]#extundelete --restore-inode 13 /dev/sdb1

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 8 groups loaded.

Loading journal descriptors ... 23 descriptors loaded.

查看目录是否有文件

[root@localhost ~]#ll RECOVERED_FILES/

total 4

-rw-r--r-- 1 root root 4 Jun 9 00:33 file.13

查看文件内容

[root@localhost ~]#cat RECOVERED_FILES/file.13

111

重新挂载分区,恢复文件,查看文件内容

[root@localhost ~]#mount /dev/sdb1 /test/

[root@localhost ~]#mv RECOVERED_FILES/file.13 /test/1.txt

[root@localhost ~]#cat /test/1.txt

111