Shulou(Shulou.com)06/02 Report--

This article mainly introduces the use of open source tool Extundelete to quickly recover deleted data, the article is very detailed, has a certain reference value, interested friends must read it!

How to recover data after mistakenly deleting files

In daily use, it is sometimes inevitable that the data will be mistakenly deleted. How to recover the data quickly and effectively at this time? There are several ways to recover data on Ali Cloud, such as:

Roll back the backed-up snapshot and customize the image recovery through the Ali Cloud console.

Purchase multiple ECS to achieve load balancing of business, with high availability.

Use object storage OSS (Object Storage Service) to store static web pages and massive pictures, videos and other important data.

This document mainly takes the CentOS7 operating system as an example to introduce how to use the open source tool Extundelete to quickly recover mistakenly deleted data.

Under Linux, there are many open source-based data recovery tools, such as debugfs, R-Linux, ext3grep, extundelete, etc., and the more commonly used ones are ext3grep and extundelete. The recovery principles of these two tools are basically the same, but extundelete is more powerful.

Extundelete is an open source data recovery software based on linux. If you accidentally delete data when using Aliyun's CVM, and the Linux system does not have similar features as the Recycle Bin under the Windows system, you can easily and quickly install this tool.

Extundelete can use inode information combined with logs to query the block location of the inode to find and recover the required data. The most powerful point of the tool is to support ext3/ext4 dual-format partition recovery, and the recovery function based on the whole disk is more powerful.

Matters needing attention

After the data is deleted by mistake, the first thing to do is to uninstall the disk or disk partition where the deleted data is located. Because after deleting the file, only the inode node of the file in the sector pointer zero, the actual file is also stored on disk, if the disk is mounted in read-write mode, the data blocks of these deleted files may be re-allocated by the operating system, in these data blocks are covered by new data, these data is really lost, recovery tools are powerless. Therefore, mounting the disk in read-only mode can minimize the risk of data overwriting in the block and improve the chances of successful data recovery.

Note: during the actual online recovery process, do not install extundelete to the hard disk where the file you deleted by mistake, as there is a certain chance that the data that needs to be restored will be completely overwritten. Remember to make a snapshot backup before operation.

Applicable object

Users who mistakenly delete files on the disk and have not written to the disk.

Users with a small number of visits to the website and a small number of ECS instances

Usage

Software and version to be installed: e2fsprogs-devel e2fsprogs gcc-c++ make (compiler, etc.) Extundelete-0.2.4

Note: extundelete requires libext2fs version 1.39 or later to run, but for ext4 support, make sure you have e2fsprogs version 1.41 or later (you can run the command "dumpe2fs" and record its output)

Note: the above version is the software version when writing the document. The version you downloaded may be different.

Deploy extundelete tools

Wget http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2yum-y install bzip2 e2fsprogs-devel e2fsprogs gcc-c++ make # installation related dependencies and libraries tar-xvjf extundelete-0.2.4.tar.bz2cd extundelete-0.2.4 # enter the program directory. / configure # the figure below shows that make & & make install has been installed successfully

At this time, the src directory appears, and there is an extundelete executable file and the corresponding path below, as shown in the following figure. In fact, the default file is installed under usr/local/bin, and the following demonstration is in the usr/local/bin directory.

Use extundelete to simulate the process of mistakenly deleting and then restoring data

1. Check ECS's existing disks and available partitions, and partition and format / dev/vdb. Disk partition formatting is not described here. If not, you can click this document to view the operation mode "format and mount data disk".

Fdisk-l

two。 Mount the partitioned disk to the / zhuyun directory, then create a new test file, hello, under / zhuyun, and write it to test.

Mkdir / zhuyun # create a new zhuyun directory mount / dev/vdb1 / zhuyun # Mount the disk to the zhuyun directory echo test > hello # write the test file

3. Record the MD5 value of the file, and the md5sum command is used to generate and verify the MD5 value of the two files before and after deletion.

Md5sum hello

4. Simulate the deletion of hello files.

Rm-rf hellocd ~ fuser-k / zhuyun # ends the process tree of a partition (you can skip this step if you confirm that there is no resource usage)

5. Uninstall the data disk.

Umount / dev/vdb1 # any file recovery tool should unmount or mount the recovered partition as read-only before use to prevent data from being overwritten

6. Use the Extundelete tool to restore files.

Extundelete-- inode 2 / dev/vdb1 # to find the content in an I node, using 2 means to search for the entire partition. If you need to enter the directory search, you only need to specify the directory I node. This is where you can see the deleted file name and inode/usr/local/bin/extundelete-- restore-inode 12 / dev/vdb1 # restore deleted file

At this point, the RECOVERED_FILES directory appears in the same level directory where the command was executed to see if it has been restored.

Through the MD5 value view, before and after two files, the same indicates that the recovery is successful.

Note:

-- restore-inode 12 #-- restore-inode restores according to the specified I node-- extundelete-- restore-all #-- restore-all restores all of the above is the use of the open source tool Extundelete to quickly restore the method of mistakenly deleted data, thank you for reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.