linux恢复 rm -rf 删除的文件:extundelete

http://blog.csdn.net/pang601355182/article/details/7947011

 

 

extundelete需要依赖两个包

----e2fsprogs

下载地址：http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-1.41.14.tar.gz/download

----e2fsprogs-libs

下载地址：
http://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/1.41.14/e2fsprogs-libs-1.41.14.tar.gz/download

 
----官网：http://www.sourceforge.net/   -->  extundelete

下载地址：http://sourceforge.net/projects/extundelete/files/extundelete/0.2.0/extundelete-0.2.0.tar.bz2/download
tar -xjf extundelete-0.2.0.tar.bz2




按e2fsprogs -- e2fsprogs-libs -- extundelete的顺序逐一编译安装：
./configure
make
make install

 

必须先umount要恢复文件的分区或者把分区改为只读模式，命令：mount –o remout,ro 分区（例如：dev/hda1）
或者
mount -n -r -o remount /db  最好尽快将所在分区修改为只读方式，防止数据被覆盖使用。



# df -h
文件系统              容量  已用  可用 已用%% 挂载点
/dev/sda3             9.9G  6.7G  2.8G  71% /
tmpfs                 736M  8.0K  736M   1% /dev/shm
/dev/sda1              97M   25M   68M  27% /boot
/dev/sdb1              20G  6.0G   13G  32% /var/www
假如有个分区/dev/sdb1,我把它挂载在/var/www。

cd /var/www

--------------恢复分区所有被删除的文件：
/usr/local/bin/extundelete /dev/sdb1 --restore-all

所以恢复的文件都会储存在当前目录下的一个名为RECOVERED_FILES目录下。

--------------根据时间：

假如删除的时间大概是2011-7-26 14：30

date -d "Jul 26 14:30" +%s

得出秒数 1234567890

恢复此时间后删除的所有文件

/usr/local/bin/extundelete /dev/sdb1 --after 1234567890 --restore-all

--------------根据文件名：

/usr/local/bin/extundelete /dev/sdb1 --restore-file '1'

--------------根据inode恢复文件。

查看文件inode:ls -i

/usr/local/bin/extundelete /dev/hda3 --restore-inode 222



--------------恢复多个文件：

创建一个文档，在文档输入文件的路径和名字，一个一行。如

restore的内容为：

/test/a

/test2/b

c

/usr/local/bin/extundelete /dev/hda3 --restore-files 'restore'

 

--------------恢复一个被误删除的文件

 

 

extundelete /dev/sda3 --restore-file /an/important/file

 

--------------恢复一个被误删除的文件夹

extundelete /dev/sda3 --restore-directory /an/important

 

 

 

 

 

==================================usr/local/bin/extundelete --help
Usage: /usr/local/bin/extundelete [options] [--] device-file
Options:
  --version, -[vV]       Print version and exit successfully.
  --help,                Print this help and exit successfully.
  --superblock           Print contents of superblock in addition to the rest.
                         If no action is specified then this option is implied.
  --journal              Show content of journal.
  --after dtime          Only process entries deleted on or after 'dtime'.
  --before dtime         Only process entries deleted before 'dtime'.
Actions:
  --inode ino            Show info on inode 'ino'.
  --block blk            Show info on block 'blk'.
  --restore-inode ino[,ino,...]
                         Restore the file(s) with known inode number 'ino'.
                         The restored files are created in ./RESTORED_FILES
                         with their inode number as extension (ie, file.12345).
  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root
                         of the partition and does not start with a '/' (it
                         must be one of the paths returned by --dump-names).
                         The restored file is created in the current
                         directory as 'RECOVERED_FILES/path'.
  --restore-files 'path' Will restore files which are listed in the file 'path'.
                         Each filename should be in the same format as an option
                         to --restore-file, and there should be one per line.
  --restore-all          Attempts to restore everything.
  -j journal             Reads an external journal from the named file.
  -b blocknumber         Uses the backup superblock at blocknumber when opening
                         the file system.
  -B blocksize           Uses blocksize as the block size when opening the file
                         system.  The number should be the number of bytes.
You have new mail in /var/spool/mail/root