Linux系统下部署文件恢复神器extundelete恢复误删的文件
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]最近看到群里提到如何恢复LINUX下ext4误删的文件，之前听说过ext3分区恢复工具ext3grep，恢复ext4刚是用extundelet，该工具最给力的一点就是支持ext3/ext4双格式分区恢复，对我们运维攻城狮算是一款神器级别的软件，这里整理了如下文档，供大家参考。
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]虚拟机: vmware workstation 9.0.2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]操作系统: CentOS6.3 x64[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]extundelete: extundelete-0.2.4
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]一.模拟环境[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]1.首先关闭SELINUX[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# setenforce 0[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# vi /etc/sysconfig/selinux[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]SELINUX=disabled[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]2.在虚拟机上创建一个2G的磁盘[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,][img]http://www.centoscn.com/uploads/allimg/130924/001P93132-0.jpg[/img]
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]3.进入系统，创建一个2G的主分区[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# fdisk /dev/sdb[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]n+p+1+回车+回车+w[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]4.使分区无需重启就能生效[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# partx -a /dev/sdb
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]5.格式化为ext4分区并挂载[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# mkfs.ext4 /dev/sdb1[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# mkdir /data[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# mount /dev/sdb1 /data[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注: 在实际线上恢复过程中，切勿将extundelete安装到你误删的文件所在硬盘，这样会有一定几率将需要恢复的数据彻底覆盖。[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]建议加装一块硬盘将extundelete安装到此硬盘，再做以下操作。
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]二.extundelete安装[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]1.安装依赖包[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# yum install e2fsprogs* -y
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]2.下载并安装extundelete[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2]http://nchc.dl.sourceforge.net/p ... elete-0.2.4.tar.bz2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# tar -jxvf extundelete-0.2.4.tar.bz2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# cd extundelete-0.2.4[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# ./configure --prefix=/usr/local/extundelete[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# make && make install
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]3.验证是否安装成功[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# cd /usr/local/extundelete/bin[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# ./extundelete -v[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]extundelete version 0.2.4[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]libext2fs version 1.41.12[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]Processor is little endian.[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]4.设置环境变量[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# echo "PATH=/usr/local/extundelete/bin:$PATH" >> /etc/profile[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# echo "export PATH" >> /etc/profile[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# source /etc/profile
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]5.上传一些图片，安装包等文件到/data目录[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# cd /data[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# yum install lrzsz -y[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# rz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]本地文件.....[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# ls[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]lost+found mysql-5.6.10.tar.gz nginx.conf pic.jpg[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]6.全部删除[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# rm -rf *
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]7.查看被删除文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]1).查看前需卸载该磁盘分区[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# cd ~[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# umount /dev/sdb1
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]2).查看文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注:一般一个分区挂载到一个目录下时，这个”根”目录的inode值为2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]我们为了查看根目录所有文件，所以查看分区inode为2的这个部分[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# extundelete /dev/sdb1 --inode 2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]--------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,].....
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]File name | Inode number | Deleted status[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]. 2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,].. 2[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]lost+found 11 Deleted[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]mysql-5.6.10.tar.gz 12 Deleted[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]nginx.conf 13 Deleted[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]pic.jpg 14 Deleted[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]--------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注:标记为”Deleted”的文件则是被删除的文件
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]8.恢复指定的文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注: 默认被删文件会恢复到当前目录下的RECOVERED_FILES目录中去[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# extundelete --restore-file pic.jpg /dev/sdb1 [p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# cd RECOVERED_FILES/[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# ll[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]----------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-rw-r--r-- 1 root root 52592 8月 13 07:18 pic.jpg[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]----------------
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]9.完全恢复设备上文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# extundelete --restore-all /dev/sdb1[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# ll[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-----------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]总用量 34464[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-rw-r--r-- 1 root root 35174149 8月 13 07:24 mysql-5.6.10.tar.gz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-rw-r--r-- 1 root root 4551 8月 13 07:24 nginx.conf[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-rw-r--r-- 1 root root 52592 8月 13 07:18 pic.jpg[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-rw-r--r-- 1 root root 52592 8月 13 07:24 pic.jpg.v1[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-----------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注:这里完全恢复并不会把之前恢复的pic.jpg文件覆盖掉，而是重命名为pic.jpg.v1
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]10.恢复指定的时间点后被删文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]1).指定一个时间点[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# date -d "Sep 4 03:09:13 2013" +%s[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]1378235353[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]2).恢复这个时间点后的文件[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# extundelete --restore-all --after “1378235353” /dev/sdb1[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]--------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]..........[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]--------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]注:如果要恢之前的就用before参数。extundelete命令与after结合使用，在进行恢复时非常有用，可以过滤掉那太旧的文件，减小恢复压力。
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]11.检验是否恢复成功[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# md5sum RECOVERED_FILES/mysql-5.6.10.tar.gz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]9dcee911fb4bc7e977a6b63f4d3ffa63 RECOVERED_FILES/mysql-5.6.10.tar.gz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]------------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]上传刚才误删的mysql安装包[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# rz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]...[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]# md5sum mysql-5.6.10.tar.gz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]9dcee911fb4bc7e977a6b63f4d3ffa63 mysql-5.6.10.tar.gz[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]---------------------------------[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]MD5值相同，恢复成功。。。
[p=28, null, left][color=rgb(85, 85, 85)][font=宋体,]-----------大功告成-------------