日期:2014-05-16  浏览次数:20629 次

linux恢复 rm -rf 删除的文件:extundelete

http://blog.csdn.net/pang601355182/article/details/7947011

?

?



extundelete需要依赖两个包

----e2fsprogs

下载地址:http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-1.41.14.tar.gz/download

----e2fsprogs-libs

下载地址:
http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-libs-1.41.14.tar.gz/download

?
----官网:http://www.sourceforge.net/?? -->? extundelete

下载地址:http://sourceforge.net/projects/extundelete/files/extundelete/0.2.0/extundelete-0.2.0.tar.bz2/download
tar -xjf extundelete-0.2.0.tar.bz2




e2fsprogs -- e2fsprogs-libs -- extundelete的顺序逐一编译安装
./configure
make
make install

?

必须先umount要恢复文件的分区或者把分区改为只读模式,命令:mount –o remout,ro 分区(例如:dev/hda1)
或者
mount -n -r -o remount /db? 最好尽快将所在分区修改为只读方式,防止数据被覆盖使用。



# df -h
文件系统????????????? 容量? 已用? 可用 已用%% 挂载点
/dev/sda3???????????? 9.9G? 6.7G? 2.8G? 71% /
tmpfs???????????????? 736M? 8.0K? 736M?? 1% /dev/shm
/dev/sda1????????????? 97M?? 25M?? 68M? 27% /boot
/dev/sdb1????????????? 20G? 6.0G?? 13G? 32% /var/www
假如有个分区/dev/sdb1,我把它挂载在/var/www。

cd /var/www

--------------恢复分区所有被删除的文件:
/usr/local/bin/extundelete /dev/sdb1 --restore-all

所以恢复的文件都会储存在当前目录下的一个名为RECOVERED_FILES目录下。


--------------根据时间:

假如删除的时间大概是2011-7-26 14:30

date -d "Jul 26 14:30" +%s

得出秒数 1234567890

恢复此时间后删除的所有文件

/usr/local/bin/extundelete /dev/sdb1 --after 1234567890 --restore-all

--------------根据文件名:

/usr/local/bin/extundelete /dev/sdb1 --restore-file '1'

--------------根据inode恢复文件。

查看文件inode:ls -i

/usr/local/bin/extundelete /dev/hda3 --restore-inode 222



--------------恢复多个文件:

创建一个文档,在文档输入文件的路径和名字,一个一行。如

restore的内容为:

/test/a

/test2/b

c

/usr/local/bin/extundelete /dev/hda3 --restore-files 'restore'

?

--------------恢复一个被误删除的文件

?

?

extundelete /dev/sda3 --restore-file /an/important/file

?

--------------恢复一个被误删除的文件夹

extundelete /dev/sda3 --restore-directory /an/important

?

?

?

?

?

==================================usr/local/bin/extundelete --help
Usage: /usr/local/bin/extundelete [options] [--] device-file
Options:
? --version, -[vV]?????? Print version and exit successfully.
? --help,??????????????? Print this help and exit successfully.
? --superblock?????????? Print contents of superblock in addition to the rest.
???????????????????????? If no action is specified then this option is implied.
? --journal????????????? Show content of journal.
? --after dtime????????? Only process entries deleted on or after 'dtime'.
? --before dtime???????? Only process entries deleted before 'dtime'.
Actions:
? --inode ino??????????? Show info on inode 'ino'.
? --block blk??????????? Show info on block 'blk'.
? --restore-inode ino[,ino,...]
???????????????????????? Restore the file(s) with known inode number 'ino'.
???????????????????????? The restored files are created in ./RESTORED_FILES
???????????????????????? with their inode number as extension (ie, file.12345).
? --restore-file 'path'? Will restore file 'path'. 'path' is relative to root
???????????????????????? of the partition and does not start with a '/' (it
??????????????