使用extundelete恢复删除的文件

雨点打透心脏的1/2处 2022-07-12 03:58 325阅读 0赞

# 声明：本博文用于学习总结及工作心得 #

环境 LINUX Ubuntu14.04

下午因误操作删除了部署在tomcat 上的项目 ，所以需要使用extundelete来恢复

当前误删除了 /var/lib/tomcat7/webapps/ 所有项目

1.安装extundelete

apt-get install extundelete

2.查看误删除的文件或者目录的上级目录的inode

ls -id /var/lib/tomcat7/webapps

得到inode 918944

3.查看当前删除的文件的磁盘分区

当前是 /dev/xvda1

4.查询可可恢复的数据信息

extundelete  /dev/xvda1  --inode 918944

WARNING: Extended attributes are not restored.
    WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
    The partition should be unmounted to undelete any files without further data loss.
    If the partition is not currently mounted, this message indicates
    it was improperly unmounted, and you should run fsck before continuing.
    If you decide to continue, extundelete may overwrite some of the deleted
    files and make recovering those files impossible.  You should unmount the
    file system and check it with fsck before using extundelete.
    Would you like to continue? (y/n)
    y
    Loading filesystem metadata ... 160 groups loaded.
    Contents of inode 918944:
    0000 | ff 41 69 00 00 10 00 00 ae 38 9c 58 aa 38 9c 58 | .Ai......8.X.8.X
    0010 | aa 38 9c 58 00 00 00 00 6f 00 02 00 08 00 00 00 | .8.X....o.......
    0020 | 00 00 08 00 df 00 00 00 0a f3 01 00 04 00 00 00 | ................
    0030 | 00 00 00 00 00 00 00 00 01 00 00 00 f5 20 38 00 | ............. 8.
    0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0060 | 00 00 00 00 9e 50 2e b5 00 00 00 00 00 00 00 00 | .....P..........
    0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
    0080 | 90 00 00 00 00 00 00 00 11 04 00 00 00 00 00 00 | ................
    0090 | 00 00 14 00 00 fe 4f 00 e6 ff 03 00 28 38 45 00 | ......O.....(8E.
    00a0 | ee f7 12 00 00 00 00 00 02 00 00 00 02 00 00 00 | ................
    00b0 | 00 80 00 00 00 80 00 00 00 20 00 00 2e 27 20 58 | ......... ...' X
    00c0 | 0c fe f3 54 14 00 ff ff 53 ef 01 00 01 00 00 00 | ...T....S.......
    00d0 | 0f 9d e8 53 00 00 00 00 00 00 00 00 01 00 00 00 | ...S............
    00e0 | 00 00 00 00 0b 00 00 00 00 01 00 00 3c 00 00 00 | ............<...
    00f0 | 46 02 00 00 7b 00 00 00 8f 91 cd 21 b0 ca 45 d7 | F...{......!..E.
    
    Inode is Allocated
    Group: 112
    File mode: 16895
    Low 16 bits of Owner Uid: 105
    Size in bytes: 4096
    Access time: 1486633134
    Creation time: 1486633130
    Modification time: 1486633130
    Deletion Time: 0
    Low 16 bits of Group Id: 111
    Links count: 2
    Blocks count: 8
    File flags: 524288
    File version (for NFS): 3039711390
    File ACL: 0
    Directory ACL: 0
    Fragment address: 0
    Direct blocks: 127754, 4, 0, 0, 1, 3678453, 0, 0, 0, 0, 0, 0
    Indirect block: 0
    Double indirect block: 0
    Triple indirect block: 0
    
    File name                                       | Inode number | Deleted status
    Directory block 3678453:
    .                                                 918944
    ..                                                918912
    ROOT                                              917620         Deleted
    ROOT2                                             917523         Deleted
    ROOT.war                                          920771         Deleted
    .README.swp                                       923876         Deleted
    README                                            917514         Deleted
    ROOT.war                                          918702         Deleted

5.开始恢复 可选择恢复单个文件还是整个目录,或者是恢复所有

当前是恢复所有

extundelete /dev/xvda1 --restore-all

恢复单个文件

extundelete /dev/xvda1 --restore-file  文件名

恢复目录

extundelete /dev/xvda1 --restore-directory 目录名

输出内容太多 这里就不显示了 但是你可以注意有没有： Restored inode 917679 to file RECOVERED\_FILES/恢复的文件名称

然后进入当前目录的RECOVERED\_FILES中 就能看见恢复的数据了 ,如果没有数据则恢复失败