设为首页 收藏本站

运维网

 找回密码
 立即注册
查看: 378|回复: 0

[经验分享] centos6.5 恢复被删除的数据

[复制链接]
gacvd

尚未签到
发表于 2018-4-20 09:07:08 | 显示全部楼层 |阅读模式

  • 安装extundelete工具包，用于恢复数据用
    [root@centos01 ~]# yum install extundelete -y
    Loaded plugins: fastestmirror
    Loading mirror speeds from cached hostfile
    epel/metalink                                  | 8.0 kB

    • base: mirrors.zju.edu.cn
    • epel: mirrors.sohu.com
    • extras: mirrors.sohu.com
    • updates: mirrors.163.com
      base                                           | 3.7 kB
      epel                                           | 4.7 kB
      epel/primary_db                                | 6.0 MB
      extras                                         | 3.4 kB
      updates                                        | 3.4 kB
      Setting up Install Process
      Resolving Dependencies
      --> Running transaction check
      ---> Package extundelete.x86_64 0:0.2.4-6.el6 will be inst
      --> Finished Dependency Resolution

　　Dependencies Resolved
　　==========================================================
Package           Arch         Version              Repos
　　==========================================================
Installing:
extundelete       x86_64       0.2.4-6.el6          epel
　　Transaction Summary
　　==========================================================
Install       1 Package(s)
　　Total download size: 60 k
Installed size: 143 k
Downloading Packages:
extundelete-0.2.4-6.el6.x86_64.rpm             |  60 kB
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : extundelete-0.2.4-6.el6.x86_64
Verifying  : extundelete-0.2.4-6.el6.x86_64
　　Installed:
extundelete.x86_64 0:0.2.4-6.el6
　　Complete!
　　2.查看extundelete的用法
[root@centos01 ~]# extundelete --help
Usage: extundelete [options] [--] device-file
Options:
--version, -[vV]       Print version and exit successfully.
--help,                Print this help and exit successfully.
--superblock           Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
--journal              Show content of journal.
--after dtime          Only process entries deleted on or after 'dtime'.
--before dtime         Only process entries deleted before 'dtime'.
Actions:
--inode ino            Show info on inode 'ino'.
--block blk            Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path'  Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/'
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-directory 'path'
Will restore directory 'path'. 'path' is relative to the
root directory of the file system.  The restored
directory is created in the output directory as 'path'.
--restore-all          Attempts to restore everything.
-j journal             Reads an external journal from the named file.
-b blocknumber         Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize           Uses blocksize as the block size when opening the file
system.  The number should be the number of bytes.
--log 0                Make the program silent.
--log filename         Logs all messages to filename.
--log D1=0,D2=filename   Custom control of log messages with comma-separated
Examples below:       list of options.  Dn must be one of info, warn, or
--log info,error      error.  Omission of the '=name' results in messages
--log warn=0          with the specified level to be logged to the console.
--log error=filename  If the parameter is '=0', logging for the specified
level will be turned off.  If the parameter is
'=filename', messages with that level will be written
to filename.
-o directory          Save the recovered files to the named directory.
The restored files are created in a directory
named 'RECOVERED_FILES/' by default.

　　3.创建测试数据
[root@centos01 ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        18G  4.5G   13G  27% /
tmpfs           116M     0  116M   0% /dev/shm
/dev/sda1       194M   27M  158M  15% /boot
/dev/sdb1       6.0G  140M  5.5G   3% /test
[root@centos01 ~]# cp -pr /etc/ssh /test/

[root@centos01 ~]# ls -ltr /test/
total 24
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found

[root@centos01 ~]# ls -ltr /test/ssh/
total 156
-rw-------. 1 root root   3879 Sep  1 01:40 sshd_config
-rw-r--r--. 1 root root   2047 Sep  1 01:40 ssh_config
-rw-------. 1 root root 125811 Sep  1 01:40 moduli
-rw-r--r--. 1 root root    627 Dec  7 01:17 ssh_host_key.pub
-rw-------. 1 root root    963 Dec  7 01:17 ssh_host_key
-rw-r--r--. 1 root root    382 Dec  7 01:17 ssh_host_rsa_key.pub
-rw-------. 1 root root   1675 Dec  7 01:17 ssh_host_rsa_key
-rw-r--r--. 1 root root    590 Dec  7 01:17 ssh_host_dsa_key.pub
-rw-------. 1 root root    672 Dec  7 01:17 ssh_host_dsa_key

[root@centos01 ~]# ls -ltr /test/
total 24
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found

[root@centos01 ~]# mkdir /test/cbm.sh

[root@centos01 ~]# echo test > /test/cbm.sh/CBN

[root@centos01 ~]# ls -ltr /test/
total 28
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found
drwxr-xr-x. 2 root root  4096 Dec 25 22:10 cbm.sh

[root@centos01 ~]# ls -ltrR /test/
/test/:
total 28
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found
drwxr-xr-x. 2 root root  4096 Dec 25 22:10 cbm.sh

　　/test/ssh:
total 156
-rw-------. 1 root root   3879 Sep  1 01:40 sshd_config
-rw-r--r--. 1 root root   2047 Sep  1 01:40 ssh_config
-rw-------. 1 root root 125811 Sep  1 01:40 moduli
-rw-r--r--. 1 root root    627 Dec  7 01:17 ssh_host_key.pub
-rw-------. 1 root root    963 Dec  7 01:17 ssh_host_key
-rw-r--r--. 1 root root    382 Dec  7 01:17 ssh_host_rsa_key.pub
-rw-------. 1 root root   1675 Dec  7 01:17 ssh_host_rsa_key
-rw-r--r--. 1 root root    590 Dec  7 01:17 ssh_host_dsa_key.pub
-rw-------. 1 root root    672 Dec  7 01:17 ssh_host_dsa_key
　　/test/lost+found:
total 0
　　/test/cbm.sh:
total 4
-rw-r--r--. 1 root root 5 Dec 25 22:10 CBN
[root@centos01 ~]# ls -ltr /test/
total 28
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found
drwxr-xr-x. 2 root root  4096 Dec 25 22:10 cbm.sh
[root@centos01 ~]# md5sum --help
Usage: md5sum [OPTION]... [FILE]...
Print or check MD5 (128-bit) checksums.
With no FILE, or when FILE is -, read standard input.

　　-b, --binary            read in binary mode
-c, --check             read MD5 sums from the FILEs and check them
-t, --text              read in text mode (default)
Note: There is no difference between binary and text mode option on GNU system.
　　The following three options are useful only when verifying checksums:
--quiet             don't print OK for each successfully verified file
--status            don't output anything, status code shows success
-w, --warn              warn about improperly formatted checksum lines

  --help     display this help and exit
--version  output version information and exit
　　The sums are computed as described in RFC 1321.  When checking, the input
should be a former output of this program.  The default mode is to print
a line with checksum, a character indicating type (*' for binary, ' for
text), and name for each FILE.
　　Report md5sum bugs to bug-coreutils@gnu.org
GNU coreutils home page: <http://www.gnu.org/software/coreutils/>
General help using GNU software: <http://www.gnu.org/gethelp/>
For complete documentation, run: info coreutils 'md5sum invocation'
[root@centos01 ~]# ls -ltr /test/
total 28
-rw-r--r--. 1 root root  1006 Dec 18 23:12 passwd
drwxr-xr-x. 2 root root  4096 Dec 20 23:15 ssh
drwx------. 2 root root 16384 Dec 25 19:46 lost+found
drwxr-xr-x. 2 root root  4096 Dec 25 22:10 cbm.sh

　　4.先检查几个文件md5校验值，由于后面恢复数据后做对比
[root@centos01 ~]# md5sum /test/passwd
8614b886726a2c67b112e6f624196827  /test/passwd

[root@centos01 ~]# md5sum /test/ssh
md5sum: /test/ssh: Is a directory

[root@centos01 ~]# md5sum /test/cbm.sh/CBN
d8e8fca2dc0f896fd7cb4cb0031ba249  /test/cbm.sh/CBN

[root@centos01 ~]# cd /test/

　　5.删除测试数据
[root@centos01 test]# rm -rf *
[root@centos01 test]# ls -ltr
total 0
[root@centos01 test]# cd /

[root@centos01 /]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        18G  4.5G   13G  27% /
tmpfs           116M     0  116M   0% /dev/shm
/dev/sda1       194M   27M  158M  15% /boot
/dev/sdb1       6.0G  140M  5.5G   3% /test

　　6.卸载数据所在的分区
[root@centos01 /]# umount /test

[root@centos01 /]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        18G  4.5G   13G  27% /
tmpfs           116M     0  116M   0% /dev/shm
/dev/sda1       194M   27M  158M  15% /boot

　　7.检查数据所在分区文件的inode值
[root@centos01 /]# extundelete /dev/sdb1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 48 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 24 07 41 5a 22 07 41 5a | .A......$.AZ&quot;.AZ
0010 | 22 07 41 5a 00 00 00 00 00 00 02 00 08 00 00 00 | &quot;.AZ............
0020 | 00 00 00 00 07 00 00 00 a1 21 00 00 00 00 00 00 | .........!......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 bc b8 81 48 bc b8 81 48 e8 ed 3a 72 | .......H...H..:r
0090 | 26 e5 40 5a 00 00 00 00 00 00 00 00 00 00 00 00 | &.@Z............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

　　Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1514211108
Creation time: 1514211106
Modification time: 1514211106
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 8609, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
　　File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
passwd                                            12             Deleted
ssh                                               262145         Deleted
cbm.sh                                            8193           Deleted
[root@centos01 /]# pwd
/
[root@centos01 /]# ls -ltr
total 94
drwxr-xr-x.  2 root root  4096 Sep 23  2011 srv
drwxr-xr-x.  2 root root  4096 Sep 23  2011 mnt
drwxr-xr-x.  2 root root  4096 Sep 23  2011 media
drwxr-xr-x.  2 root root  4096 Sep 23  2011 home
drwx------.  2 root root 16384 Dec  7 01:01 lost+found
drwxr-xr-x. 13 root root  4096 Dec  7 01:07 usr
drwxr-xr-x. 17 root root  4096 Dec  7 01:07 var
dr-xr-xr-x.  8 root root  4096 Dec  7 01:11 lib
dr-xr-xr-x.  5 root root  1024 Dec  7 01:15 boot
dr-xr-xr-x.  2 root root  4096 Dec 13 23:13 bin
drwxr-xr-x. 10 root root  4096 Dec 13 23:18 cgroup
drwxr-xr-x.  3 root root  4096 Dec 18 23:16 thmmedia
dr-xr-xr-x.  2 root root  4096 Dec 18 23:22 sbin
dr-xr-xr-x.  8 root root 12288 Dec 18 23:31 lib64
dr-xr-x---.  4 root root  4096 Dec 21 18:47 root
drwxr-xr-x.  7 root root  4096 Dec 25 19:26 opt
drwxr-xr-x.  2 root root  4096 Dec 25 19:47 test
dr-xr-xr-x. 94 root root     0 Dec 25 19:48 proc
drwxr-xr-x. 13 root root     0 Dec 25 19:48 sys
drwxr-xr-x.  7 root root     0 Dec 25 19:48 selinux
drwxr-xr-x. 17 root root  3760 Dec 25 19:50 dev
drwxrwxrwt.  4 root root  4096 Dec 25 20:32 tmp
drwxr-xr-x. 75 root root  4096 Dec 25 22:12 etc

[root@centos01 /]# mkdir /restore

[root@centos01 /]# cd /restore

　　8.恢复一个文件
[root@centos01 restore]# extundelete /dev/sdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 48 groups loaded.
Loading journal descriptors ... 63 descriptors loaded.
Successfully restored file passwd
[root@centos01 restore]# ls -ltr
total 4
drwxr-xr-x. 2 root root 4096 Dec 25 22:14 RECOVERED_FILES

[root@centos01 restore]# ls -ltr RECOVERED_FILES
total 4
-rw-r--r--. 1 root root 1006 Dec 25 22:14 passwd

　　9.校验所恢复文件的md5值，和删除前是一样的
[root@centos01 restore]# md5sum RECOVERED_FILES/passwd
8614b886726a2c67b112e6f624196827  RECOVERED_FILES/passwd

　　10.恢复文件夹
[root@centos01 restore]# extundelete /dev/sdb1 --restore-directory ssh
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 48 groups loaded.
Loading journal descriptors ... 63 descriptors loaded.
Searching for recoverable inodes in directory ssh ...
14 recoverable inodes found.
Looking through the directory structure for deleted files ...
5 recoverable inodes still lost.
[root@centos01 restore]# ls -ltr
total 4
drwxr-xr-x. 3 root root 4096 Dec 25 22:16 RECOVERED_FILES
[root@centos01 restore]# ls -ltr RECOVERED_FILES/
total 8
-rw-r--r--. 1 root root 1006 Dec 25 22:14 passwd
drwxr-xr-x. 2 root root 4096 Dec 25 22:16 ssh

　　11.所恢复的文件夹里的文件权限有变化，可以自己更正过来
[root@centos01 restore]# ls -ltr RECOVERED_FILES/ssh/
total 156
-rw-r--r--. 1 root root    590 Dec 25 22:16 ssh_host_dsa_key.pub
-rw-r--r--. 1 root root    382 Dec 25 22:16 ssh_host_rsa_key.pub
-rw-r--r--. 1 root root   1675 Dec 25 22:16 ssh_host_rsa_key
-rw-r--r--. 1 root root    627 Dec 25 22:16 ssh_host_key.pub
-rw-r--r--. 1 root root   3879 Dec 25 22:16 sshd_config
-rw-r--r--. 1 root root    963 Dec 25 22:16 ssh_host_key
-rw-r--r--. 1 root root    672 Dec 25 22:16 ssh_host_dsa_key
-rw-r--r--. 1 root root   2047 Dec 25 22:16 ssh_config
-rw-r--r--. 1 root root 125811 Dec 25 22:16 moduli
[root@centos01 restore]# date
Mon Dec 25 22:17:01 CST 2017

　　12.对比文件权限
[root@centos01 restore]# ls -ltr /etc/ssh/
total 156
-rw-------. 1 root root   3879 Sep  1 01:40 sshd_config
-rw-r--r--. 1 root root   2047 Sep  1 01:40 ssh_config
-rw-------. 1 root root 125811 Sep  1 01:40 moduli
-rw-r--r--. 1 root root    627 Dec  7 01:17 ssh_host_key.pub
-rw-------. 1 root root    963 Dec  7 01:17 ssh_host_key
-rw-r--r--. 1 root root    382 Dec  7 01:17 ssh_host_rsa_key.pub
-rw-------. 1 root root   1675 Dec  7 01:17 ssh_host_rsa_key
-rw-r--r--. 1 root root    590 Dec  7 01:17 ssh_host_dsa_key.pub
-rw-------. 1 root root    672 Dec  7 01:17 ssh_host_dsa_key
　　13.一键恢复所有数据
[root@centos01 restore]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 48 groups loaded.
Loading journal descriptors ... 63 descriptors loaded.
Searching for recoverable inodes in directory / ...
14 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.
[root@centos01 restore]# ls -ltr
total 4
drwxr-xr-x. 4 root root 4096 Dec 25 22:18 RECOVERED_FILES

[root@centos01 restore]# ls -ltr RECOVERED_FILES/
total 16
-rw-r--r--. 1 root root 1006 Dec 25 22:14 passwd
-rw-r--r--. 1 root root 1006 Dec 25 22:18 passwd.v1
drwxr-xr-x. 2 root root 4096 Dec 25 22:18 ssh
drwxr-xr-x. 2 root root 4096 Dec 25 22:18 cbm.sh

[root@centos01 restore]# ls -ltr RECOVERED_FILES/cbm.sh/
total 4
-rw-r--r--. 1 root root 5 Dec 25 22:18 CBN

[root@centos01 restore]# ls -ltr RECOVERED_FILES/cbm.sh/CBN
-rw-r--r--. 1 root root 5 Dec 25 22:18 RECOVERED_FILES/cbm.sh/CBN

[root@centos01 restore]# md5sum RECOVERED_FILES/cbm.sh/CBN
d8e8fca2dc0f896fd7cb4cb0031ba249  RECOVERED_FILES/cbm.sh/CBN

运维网声明 1、欢迎大家加入本站运维交流群:群②:261659950 群⑤:202807635 群⑦870801961 群⑧679858003
2、本站所有主题由该帖子作者发表，该帖子作者与运维网享有帖子相关版权
3、所有作品的著作权均归原作者享有，请您和我们一样尊重他人的著作权等合法权益。如果您对作品感到满意，请购买正版
4、禁止制作、复制、发布和传播具有反动、淫秽、色情、暴力、凶杀等内容的信息，一经发现立即删除。若您因此触犯法律，一切后果自负，我们对此不承担任何责任
5、所有资源均系网友上传或者通过网络收集，我们仅提供一个展示、介绍、观摩学习的平台，我们不对其内容的准确性、可靠性、正当性、安全性、合法性等负责，亦不承担任何法律责任
6、所有作品仅供您个人学习、研究或欣赏，不得用于商业或者其他用途，否则，一切后果均由您自己承担，我们对此不承担任何法律责任
7、如涉及侵犯版权等问题，请您及时通知我们，我们将立即采取措施予以解决
8、联系人Email：admin@iyunv.com 网址：www.yunweiku.com

所有资源均系网友上传或者通过网络收集,我们仅提供一个展示、介绍、观摩学习的平台,我们不对其承担任何法律责任,如涉及侵犯版权等问题,请您及时通知我们,我们将立即处理,联系人Email:kefu@iyunv.com,QQ:1061981298 本贴地址：https://www.yunweiku.com/thread-449428-1-1.html 上篇帖子： centos6.9安装confluence 6.5.0 下篇帖子： Centos7.4 安装 zabbix3.2.0
回复

使用道具 举报

返回列表
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

扫码加入运维网微信交流群X

扫码加入运维网微信交流群

扫描二维码加入运维网微信交流群，最新一手资源尽在官方微信交流群！快快加入我们吧...

扫描微信二维码查看详情

客服 E-mail:iyunvcom@gmail.com

本站由青云提供云计算服务

运维网--中国最专业的运维工程师交流社区

豫ICP备20007574号-1 Copyright © 2012-2025

关于我们

发展历程

联系我们

关注我们

广告服务

广告案例

隐私条款

免责声明

用户登录

用户注册

版主守则

申请版主

手机版

金币获取

帮助中心

每日签到

Good Good

Study

Day Day

UP


客服E-mail:kefu@iyunv.com 客服QQ：1061981298


QQ群⑦：运维网交流群⑦ QQ群⑧：运维网交流群⑧ k8s群：运维网kubernetes交流群


提醒：禁止发布任何违反国家法律、法规的言论与图片等内容；本站内容均来自个人观点与网络等信息，非本站认同之观点.


本站大部分资源是网友从网上搜集分享而来，其版权均归原作者及其网站所有，我们尊重他人的合法权益，如有内容侵犯您的合法权益，请及时与我们联系进行核实删除！



合作伙伴: 青云cloud

快速回复 返回顶部 返回列表