centos rm文件删除恢复

124q31

系统是centos 6.5 x64位系统
rm文件删除之后，恢复比较麻烦。
可以使用extundelete进行恢复
目前最新版本是0.2.4
extundelete 主页：http://extundelete.sourceforge.net/
下载软件
wget http://fossies.org/linux/misc/extundelete-0.2.4.tar.gz
安装组件
yum install -y e2fsprogs e2fsprogs-devel e2fsprogs-libs
安装extundelete

tar zxvf extundelete-0.2.4.tar.gz -C /usr/src/
cd /usr/src/extundelete-0.2.4/
./configure
make
make install

恢复的时候，需要卸载分区。如果你需要的恢复的文件在根分区，那么需要在另外一台服务器进行恢复。
所以我挂载了一个测试分区
[iyunv@localhost ~]# df -hT
Filesystem                   Type   Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root ext4    29G  1.2G   26G   5% /
tmpfs                        tmpfs  246M     0  246M   0% /dev/shm
/dev/sda1                    ext4   485M   33M  427M   8% /boot
/dev/sdb1                    ext4  1008M   18M  940M   2% /test

写入文件，内容是111

[iyunv@localhost ~]# vi /test/1.txt
删除文件
[iyunv@localhost ~]# rm -rf /test/*


结束使用某分区的进程树

[iyunv@localhost ~]# fuser -k /test

卸载分区
[iyunv@localhost ~]# umount /test/
使用extundelete查看分区上存在的文件
--inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可

[iyunv@localhost ~]# extundelete --inode 2 /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 8 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 a9 bf 75 55 a8 bf 75 55 | .A........uU..uU
0010 | a8 bf 75 55 00 00 00 00 00 00 02 00 08 00 00 00 | ..uU............
0020 | 00 00 00 00 09 00 00 00 49 00 00 00 00 00 00 00 | ........I.......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 28 6d b5 65 28 6d b5 65 78 80 59 bf | ....(m.e(m.ex.Y.
0090 | 6c bf 75 55 00 00 00 00 00 00 00 00 00 00 00 00 | l.uU............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1433780137
Creation time: 1433780136
Modification time: 1433780136
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
.1.txt.swp                                        12             Deleted
1.txt                                             13             Deleted

从以上信息，可以看出，需要恢复的文件1.txt的I节点为13

恢复文件
--restore-inode 恢复指定的I节点文件，默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下，文件名为 file.I节点号

[iyunv@localhost ~]# extundelete --restore-inode 13 /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 8 groups loaded.
Loading journal descriptors ... 23 descriptors loaded.
查看目录是否有文件
[iyunv@localhost ~]# ll RECOVERED_FILES/
total 4
-rw-r--r-- 1 root root 4 Jun  9 00:33 file.13
查看文件内容

[iyunv@localhost ~]# cat RECOVERED_FILES/file.13
111
重新挂载分区，恢复文件，查看文件内容

[iyunv@localhost ~]# mount /dev/sdb1 /test/
[iyunv@localhost ~]# mv RECOVERED_FILES/file.13 /test/1.txt
[iyunv@localhost ~]# cat /test/1.txt
111