联系：手机/微信(+86 17813235971) QQ(107644445)
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
今天群中有个朋友的客户闲着没事rm掉了数据文件,然后讨论到使用extundelete进行了恢复,抢救了部分未被覆盖的数据文件。该软件官方地址:http://extundelete.sourceforge.net/
安装extundelete
[root@xifenfei tmp]# bunzip2 extundelete-0.2.0.tar.bz2 [root@xifenfei tmp]# tar xvf extundelete-0.2.0.tar extundelete-0.2.0/ extundelete-0.2.0/README extundelete-0.2.0/acinclude.m4 extundelete-0.2.0/configure.ac extundelete-0.2.0/aclocal.m4 extundelete-0.2.0/Makefile.am extundelete-0.2.0/Makefile.in extundelete-0.2.0/config.h.in extundelete-0.2.0/configure extundelete-0.2.0/compile extundelete-0.2.0/depcomp extundelete-0.2.0/install-sh extundelete-0.2.0/missing extundelete-0.2.0/LICENSE extundelete-0.2.0/autogen.sh extundelete-0.2.0/src/ extundelete-0.2.0/src/Makefile.am extundelete-0.2.0/src/Makefile.in extundelete-0.2.0/src/extundelete.cc extundelete-0.2.0/src/block.c extundelete-0.2.0/src/insertionops.cc extundelete-0.2.0/src/block.h extundelete-0.2.0/src/extundelete.h extundelete-0.2.0/src/extundelete-priv.h extundelete-0.2.0/src/jfs_compat.h extundelete-0.2.0/src/kernel-jbd.h [root@xifenfei tmp]# cd extundelete-0.2.0 [root@xifenfei extundelete-0.2.0]# ./configure Configuring extundelete 0.2.0 Writing generated files to disk [root@xifenfei extundelete-0.2.0]# make && make install make -s all-recursive Making all in src Making install in src /usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'
恢复操作命令
--umount或者read only 分区(如果umount不成功,可以通过fuser -km /www类似方法找出来占用进程） umount /dev/partition mount -o remount,ro /dev/partition --恢复文件 extundelete /dev/partition --restore-all extundelete /dev/partition --restore-directory /backup/gnutool-delete extundelete /dev/partition --restore-files /etc/passwd
测试恢复
--基于目录恢复 [root@xifenfei tmp]#extundelete /dev/sdb1 --restore-directory /u01/xifenfei Loading filesystem metadata ... 160 groups loaded. Loading journal descriptors ... 23 descriptors loaded. Writing output to directory RECOVERED_FILES/ Failed to restore file /u01/xifenfei Could not find correct inode number past inode 2. [root@xifenfei tmp]# cd RECOVERED_FILES/ [root@xifenfei RECOVERED_FILES]# ll total 0 --未成功 --基于磁盘恢复 [root@xifenfei RECOVERED_FILES]#extundelete /dev/sdb1 --restore-all Loading filesystem metadata ... 160 groups loaded. Loading journal descriptors ... 23 descriptors loaded. Writing output to directory RECOVERED_FILES/ Searching for recoverable inodes in directory / ... 4 recoverable inodes found. Looking through the directory structure for deleted files ... Failed to restore inode 1966081 to file RECOVERED_FILES/xifenfei:Inode does not correspond to a regular file. Restored inode 1966082 to file RECOVERED_FILES/xifenfei/xff.txt Failed to restore inode 1966083 to file RECOVERED_FILES/xifenfei/xff:Inode does not correspond to a regular file. Restored inode 1966084 to file RECOVERED_FILES/xifenfei/xff/xff.txt132 0 recoverable inodes still lost. [root@xifenfei RECOVERED_FILES]# ll total 4 drwxr-xr-x 3 root root 4096 Aug 31 21:36 RECOVERED_FILES [root@xifenfei RECOVERED_FILES]# cd RECOVERED_FILES/ [root@xifenfei RECOVERED_FILES]# ll total 4 drwxr-xr-x 3 root root 4096 Aug 31 21:36 xifenfei [root@xifenfei RECOVERED_FILES]# cd xifenfei/ [root@xifenfei xifenfei]# ll total 20 drwxr-xr-x 2 root root 4096 Aug 31 21:36 xff -rw-r--r-- 1 root root 13231 Aug 31 21:36 xff.txt [root@xifenfei xifenfei]# cd xff [root@xifenfei xff]# ll total 16 -rw-r--r-- 1 root root 13231 Aug 31 21:36 xff.txt132 --恢复成功 --基于文件恢复 [root@xifenfei xff]# extundelete /dev/sdb1 --restore-files /u01/xifenfei/xff.txt Loading filesystem metadata ... 160 groups loaded. Loading journal descriptors ... 23 descriptors loaded. Writing output to directory RECOVERED_FILES/ [root@xifenfei xff]# cd RECOVERED_FILES/ [root@xifenfei RECOVERED_FILES]# ll total 0 --未成功
通过上述实验证明extundelete还是有很大的不完整性,基于整个磁盘的恢复功能较为强大,基于目录和文件的恢复还不够强大.不过该软件在很多时候还是有救火的功能,特别是当蛋筒的人员删除了数据库的部分文件之时.
