Shulou(Shulou.com)06/02 Report--

This document gives the method to restore the mistakenly deleted files of the ext4 file system, the software you need to use is extundelete, this software has a high success rate for the recovery of the ext4 file system, so it is worth having!

[root@localhost ~] # rm-Rf / # execution is unsuccessful! Rm: recursive operation in "/" is very dangerous rm: use the-- no-preserve-root option to skip the safe mode [root@localhost ~] # rm-rf / * # this can be executed successfully! Heh heh. Delete files on the ext4 file system, you can restore: extundelete, ext3 restore use: ext3grepwindows restore mistakenly deleted files: final data v2.0 Chinese version and easyrecovery

Extend:

The Linux file system consists of three parts: the file name, and the inode,blockwindows also consists of these three parts. A.txt-- > inode-- > block File name Storage File metadata Information Real Storage data View File name: [root@localhost ~] # cp / etc/passwd a.txt [root@localhost ~] # ls a.txta.txt View inode number: common sense: each file has an inode number. [root@localhost ~] # ls-I a.txt440266 a.txt to view the file attributes in inode; view the contents contained in inode through the stat command [root@localhost ~] # stat a.txt # View inode information: [root@localhost ~] # ls-l a.txtmura rwantha: 1 root root 1720 Oct 25 10:21 a.txtblock block: logical deletion of the place where real data is stored: why is fake deletion faster than replication?

What is the first thing to do after mistakenly deleting a file? You don't want to delete the blockbuster that has been saved for decades!

How to avoid overwriting the contents of files that have been deleted by mistake?

Unmount the partition where the file needs to be recovered or mount it read-only

For example:

Mount-o remount,ro / mnt practice: restore files that have been mistakenly deleted by the ext4 file system

Download extundelete

Http://sourceforge.net/ Open Source Software release Center

Extundelete-0.2.4.tar.bz2

Link: https://pan.baidu.com/s/1n0dtGnhffcH7XrLv0TqUsw

Extraction code: a5m7

Prepare the test partition: [root@localhost ~] # ls / dev/sd*/dev/sda / dev/sda1 / dev/sda2 / dev/sdb [root@localhost ~] # fdisk / dev/sdbDevice contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabelBuilding a new DOS disklabel with disk identifier 0x539f33b8.Changes will remain in memory only, until you decide to write them.After that, of course, the previous content won't be recoverable.Warning: invalid flag 0x0000 of partition table 4 will be corrected by w (rite) WARNING: DOS-compatible mode is deprecated. It's strongly recommended to switch off the mode (command 'c') and change display units to sectors (command 'u') .Command (m for help): P # View partition table information Disk / dev/sdb: 21.5GB, 21474836480 bytes255 heads, 63 sectors/track 2610 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0x539f33b8 Device Boot Start End Blocks Id SystemCommand (m for help): n # create a new partition Command action e extended p primary partition (1-4) p # create a primary partition Partition number (1-4): 1First cylinder (1-2610, default 1): Using default value 1Last cylinder, + cylinders or + size {KJM G} (1-2610, default 2610): + 1G # specify partition size Command (m for help): P # View partition table information Disk / dev/sdb: 21.5GB, 21474836480 bytes255 heads, 63 sectors/track 2610 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0x539f33b8 Device Boot Start End Blocks Id System/dev/sdb1 1132 1060258 + 83 LinuxCommand (m for help): W # preserve The partition table has been altered calling ioctl () to re-read partition table.Syncing disks. [root@localhost ~] # partx-a / dev/sdb1 # get a new partition table or [root@localhost ~] # reboot

Extend:

What if I delete the file under the root and want to restore it?

Method 1: immediately power off, and then the disk is read-only, mounted to another computer for recovery.

Method 2: put the extundelete on the virtual machine (the virtual machine system should be the same as the server version), install it in advance and then copy it to the U disk, insert the U disk into the server, and save the recovered files to the U disk during recovery. (do not let the recovered data be written to /, which will overwrite the previously deleted files).

Use the new partition: [root@localhost ~] # mkdir / tmp/sdb1 # to create a mount point [root@localhost ~] # mkfs.ext4 / dev/sdb1 # format the / dev/sdb1 partition file system into ext4 [root@localhost ~] # mount / dev/sdb1 / tmp/sdb1 # mount the / dev/sdb1 partition to / tmp/sdb1 [root@localhost ~] # df-h Filesystem Size Used Avail Use% Mounted on/dev/mapper/VolGroup- Lv_root 18G 1.3G 16G 8% / tmpfs 499M 0 499M 0% / dev/shm/dev/sda1 485M 33M 427M 8% / boot/dev/sr0 3.6G 3.6G 0% / media/cdrom/dev/sdb1 1020M 34M 935M 4% / tmp/sdb1 copy some test files And then delete these files. Then demonstrate recovery: [root@localhost ~] # cp / etc/passwd / tmp/sdb1 [root@localhost ~] # cp / etc/hosts / tmp/sdb1 [root@localhost ~] # echo aaa > a.txt [root@localhost ~] # mkdir-p / tmp/sdb1/a/b/c [root@localhost ~] # cp a.txt / tmp/sdb1/a [root@localhost ~] # cp a.txt / tmp/sdb1/a/b [root@localhost ~] # touch / tmp/sdb1 / a/b/kong.txt [root@localhost ~] # yum install-y tree [root@localhost ~] # tree / tmp/sdb1/tmp/sdb1 ├── a │ ├── a.txt │ └── b │ ├── a.txt │ ├── c # empty directory │ └── kong.txt # empty file ├── hosts ├── lost+found └── passwd4 directories 5 files delete file: [root@localhost ~] # cd / tmp/sdb1 [root@localhost sdb1] # lsa hosts lost+found passwd [root@localhost sdb1] # rm-rf a hosts passwd [root@localhost sdb1] # lslost+found

What is the first thing to do after mistakenly deleting a file?

How to prevent the contents of files deleted by mistake from being overwritten?

Unmount the partition where the file needs to be recovered or mount it read-only

[root@localhost sdb1] # cd / root [root@localhost ~] # df-hFilesystem Size Used Avail Use% Mounted on/dev/mapper/VolGroup-lv_root 18G 1.3G 16G 8% / tmpfs 499M 0499m 0% / dev/shm/dev/sda1 485M 33M 427M 8% / boot/dev/sr0 3.6G 3.6G 0% / media/cdrom/dev/sdb1 1020M 34M 935M 4% / tmp/sdb1 [root@localhost ~] # echo "/ dev/sdb1 / tmp/sdb1 ext4 defaults 00" > > / etc/fstab [root@localhost ~] # mount-o remount Ro / tmp/sdb1 # remounts / tmp/sdb1 partition [root@localhost ~] # df-hFilesystem Size Used Avail Use% Mounted on/dev/mapper/VolGroup-lv_root 18G 1.3G 16G 8% / tmpfs 499m 0499m 0% / dev/shm/dev/sda1 485m 33m 427m 8% / boot/dev/sr0 3.6G 3.6G 0100% / media/cdrom/dev/sdb1 1020M 34M 935M 4% / tmp/sdb1 [root@localhost ~] # touch / tmp//sdb1/testfiletouch: cannot touch `/ tmp//sdb1/testfile': Read-only file system

Or

[root@localhost ~] # umount / tmp/sdb1 # Uninstall / tmp/sdb1 partition [root@localhost ~] # df-hFilesystem Size Used Avail Use% Mounted on/dev/mapper/VolGroup-lv_root 18G 1.3G 16G 8% / tmpfs 499m 0499m 0% / dev/shm/dev/sda1 485M 33M 427M 8% / Boot/dev/sr0 3.6G 3.6G 0100% / media/cdrom install extundelete tool upload extundelete to Linux: upload extundelete file from Windows to Linux Install SecureCRT or XShell [root @ localhost ~] # yum install-y lrzsz # after installation, you will have the rz command and the sz command rz: upload the files in Windows to Linuxsz: download the files in Linux to the Windows source installation [root @ localhost ~] # cd / usr/local/src [root@localhost src] # ls [root@localhost src] # rzrz waiting to receive. Zmodem trl+C 100% KB 105 KB/s 00:00:01 0 Errorsbz2... [root@localhost src] # lsextundelete-0.2.4.tar.bz2 [root@localhost src] # tar xjvf extundelete-0.2.4.tar.bz2 [root@localhost src] # cd extundelete-0.2.4 [root@localhost extundelete-0.2.4] # yum install-y e2fsprogs-devel gcc* [root@localhost extundelete-0.2.4] #. / configure # Check the system installation environment [root@localhost extundelete-0.2.4] # make-j 4 # compilation Compile the source code into executable binaries. -j 4 use 4 processes to compile at the same time, increase compilation speed or use 4 core CPU to compile at the same time. [root@localhost extundelete-0.2.4] # make install # compile and install

Extend:

What's the difference between install and cp? During install replication, you can specify permission cp. No example: [root@localhost ~] # install-m 777 / bin/find / opt/a.sh [root@localhost ~] # ll / opt/ starts recovery:

Method 1: restore through inode node

Method 2: restore through file name

Method 3: restore a directory, such as all the files under directory a:

Method 4: restore all files

[root@localhost extundelete-0.2.4] # mkdir / test # create a directory to store the recovered data [root@localhost extundelete-0.2.4] # cd / test [root@localhost test] # check the deleted file name through the inode node: [root@localhost test] # extundelete / dev/sdb1-- inode 2 File name | Inode number | Deleted status. 2.. 2lost+found 11passwd 12 Deletedhosts 13 Deleteda 7377 Deleted extension: the partition root of the ext4 file system has an inode value of 2 The inode value of the root directory of the xfs partition is 64 [root@localhost test] # ls-id / boot/ # xfs file system 64 / boot/ [root@localhost test] # ls-id / tmp/sdb12 / tmp/sdb1 method 1: restore [root@localhost test] # ls [root@localhost test] # extundelete / dev/sdb1-- restore-inode 12NOTICE: Extended attributes are not restored.Loading filesystem metadata. 9 groups loaded.Loading journal descriptors. 61 descriptors loaded. [root @ localhost test] # lsRECOVERED_ files [root @ localhost test] # lsRECOVERED_FILES / file.12 [root @ localhost test] # diff / etc/passwd RECOVERED_FILES/file.12 # compare the contents of the file There is no output, indicating that there is no change in the restored file content. Method 2: restore [root@localhost test] # extundelete / dev/sdb1-- restore-file passwd [root@localhost test] # diff / etc/passwd RECOVERED_FILES/passwd # through the file name, there is no output, indicating that there is no change in the restored file content. Method 3: restore a directory. For example, all the files under directory a: [root@localhost test] # extundelete / dev/sdb1-- restore-directory a [root@localhost test] # tree RECOVERED_FILES/a/RECOVERED_FILES/a/ ├── a.txt └── b └── a.txt1 directory 2 files method 4: restore all files [root@localhost test] # rm-rf RECOVERED_FILES/* [root @ localhost test] # extundelete / dev/sdb1-- restore-all [root@localhost test] # ls RECOVERED_FILES/a hosts passwd [root@localhost test] # tree RECOVERED_FILES/RECOVERED_FILES/ ├── a │ ├── a.txt │ └── b │ └── a.txt ├── hosts └── passwd2 directories 4 before files data comparison and deletion: [root@localhost ~] # tree / tmp/sdb1/tmp/sdb1 ├── a │ ├── a.txt │ └── b │ ├── a.txt │ ├── c # empty directory │ └── kong.txt # empty file ├── hosts ├── lost+found └── passwd4 directories 5 after files recovery: [root@localhost test] # tree RECOVERED_FILES/RECOVERED_FILES/ ├── a │ ├── a.txt │ └── b │ └── a.txt ├── hosts └── passwd2 directories, 4 files

Can extundelete automatically create empty files and directories when restoring files?

A: no

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.