http://blog.csdn.net/pang601355182/article/details/7947011
?
?
extundelete需要依赖两个包
----e2fsprogs
下载地址：http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-1.41.14.tar.gz/download
----e2fsprogs-libs
下载地址：
http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-libs-1.41.14.tar.gz/download
?
----官网：http://www.sourceforge.net/?? -->? extundelete
下载地址：http://sourceforge.net/projects/extundelete/files/extundelete/0.2.0/extundelete-0.2.0.tar.bz2/download
tar -xjf extundelete-0.2.0.tar.bz2
按e2fsprogs -- e2fsprogs-libs -- extundelete的顺序逐一编译安装：
./configure
make
make install
?
必须先umount要恢复文件的分区或者把分区改为只读模式，命令：mount –o remout,ro 分区（例如：dev/hda1）
或者
mount -n -r -o remount /db? 最好尽快将所在分区修改为只读方式，防止数据被覆盖使用。
# df -h
文件系统????????????? 容量? 已用? 可用 已用%% 挂载点
/dev/sda3???????????? 9.9G? 6.7G? 2.8G? 71% /
tmpfs???????????????? 736M? 8.0K? 736M?? 1% /dev/shm
/dev/sda1????????????? 97M?? 25M?? 68M? 27% /boot
/dev/sdb1????????????? 20G? 6.0G?? 13G? 32% /var/www
假如有个分区/dev/sdb1,我把它挂载在/var/www。
cd /var/www
--------------恢复分区所有被删除的文件：
/usr/local/bin/extundelete /dev/sdb1 --restore-all
所以恢复的文件都会储存在当前目录下的一个名为RECOVERED_FILES目录下。
--------------根据时间：
假如删除的时间大概是2011-7-26 14：30
date -d "Jul 26 14:30" +%s
得出秒数 1234567890
恢复此时间后删除的所有文件
/usr/local/bin/extundelete /dev/sdb1 --after 1234567890 --restore-all
--------------根据文件名：
/usr/local/bin/extundelete /dev/sdb1 --restore-file '1'
--------------根据inode恢复文件。
查看文件inode:ls -i
/usr/local/bin/extundelete /dev/hda3 --restore-inode 222
--------------恢复多个文件：
创建一个文档，在文档输入文件的路径和名字，一个一行。如
restore的内容为：
/test/a
/test2/b
c
/usr/local/bin/extundelete /dev/hda3 --restore-files 'restore'
?
--------------恢复一个被误删除的文件
?
?
extundelete /dev/sda3 --restore-file /an/important/file
?
--------------恢复一个被误删除的文件夹
extundelete /dev/sda3 --restore-directory /an/important
?
?
?
?
?
==================================usr/local/bin/extundelete --help
Usage: /usr/local/bin/extundelete [options] [--] device-file
Options:
? --version, -[vV]?????? Print version and exit successfully.
? --help,??????????????? Print this help and exit successfully.
? --superblock?????????? Print contents of superblock in addition to the rest.
???????????????????????? If no action is specified then this option is implied.
? --journal????????????? Show content of journal.
? --after dtime????????? Only process entries deleted on or after 'dtime'.
? --before dtime???????? Only process entries deleted before 'dtime'.
Actions:
? --inode ino??????????? Show info on inode 'ino'.
? --block blk??????????? Show info on block 'blk'.
? --restore-inode ino[,ino,...]
???????????????????????? Restore the file(s) with known inode number 'ino'.
???????????????????????? The restored files are created in ./RESTORED_FILES
???????????????????????? with their inode number as extension (ie, file.12345).
? --restore-file 'path'? Will restore file 'path'. 'path' is relative to root
???????????????????????? of the partition and does not start with a '/' (it
??????????????
