今天群中有个朋友的客户闲着没事rm掉了数据文件,然后讨论到使用extundelete进行了恢复,抢救了部分未被覆盖的数据文件。该软件官方地址:http://extundelete.sourceforge.net/
安装extundelete
[root@xifenfei tmp]# bunzip2 extundelete-0.2.0.tar.bz2[root@xifenfei tmp]# tar xvf extundelete-0.2.0.tarextundelete-0.2.0/extundelete-0.2.0/READMEextundelete-0.2.0/acinclude.m4extundelete-0.2.0/configure.acextundelete-0.2.0/aclocal.m4extundelete-0.2.0/Makefile.amextundelete-0.2.0/Makefile.inextundelete-0.2.0/config.h.inextundelete-0.2.0/configureextundelete-0.2.0/compileextundelete-0.2.0/depcompextundelete-0.2.0/install-shextundelete-0.2.0/missingextundelete-0.2.0/LICENSEextundelete-0.2.0/autogen.shextundelete-0.2.0/src/extundelete-0.2.0/src/Makefile.amextundelete-0.2.0/src/Makefile.inextundelete-0.2.0/src/extundelete.ccextundelete-0.2.0/src/block.cextundelete-0.2.0/src/insertionops.ccextundelete-0.2.0/src/block.hextundelete-0.2.0/src/extundelete.hextundelete-0.2.0/src/extundelete-priv.hextundelete-0.2.0/src/jfs_compat.hextundelete-0.2.0/src/kernel-jbd.h[root@xifenfei tmp]# cd extundelete-0.2.0[root@xifenfei extundelete-0.2.0]# ./configureConfiguring extundelete 0.2.0Writing generated files to disk[root@xifenfei extundelete-0.2.0]# make && make installmake -s all-recursiveMaking all in srcMaking install in src /usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete' |
恢复操作命令
--umount或者read only 分区 umount /dev/partition mount -o remount,ro /dev/partition--恢复文件xtundelete /dev/partition --restore-allextundelete /dev/partition --restore-directory /backup/gnutool-deleteextundelete /dev/partition --restore-files /etc/passwd |
测试恢复
--基于目录恢复[root@xifenfei tmp]#extundelete /dev/sdb1 --restore-directory /u01/xifenfeiLoading filesystem metadata ... 160 groups loaded.Loading journal descriptors ... 23 descriptors loaded.Writing output to directory RECOVERED_FILES/Failed to restore file /u01/xifenfeiCould not find correct inode number past inode 2.[root@xifenfei tmp]# cd RECOVERED_FILES/[root@xifenfei RECOVERED_FILES]# lltotal 0--未成功--基于磁盘恢复[root@xifenfei RECOVERED_FILES]#extundelete /dev/sdb1 --restore-allLoading filesystem metadata ... 160 groups loaded.Loading journal descriptors ... 23 descriptors loaded.Writing output to directory RECOVERED_FILES/Searching for recoverable inodes in directory / ...4 recoverable inodes found.Looking through the directory structure for deleted files ...Failed to restore inode 1966081 to file RECOVERED_FILES/xifenfei:Inode does not correspond to a regular file.Restored inode 1966082 to file RECOVERED_FILES/xifenfei/xff.txtFailed to restore inode 1966083 to file RECOVERED_FILES/xifenfei/xff:Inode does not correspond to a regular file.Restored inode 1966084 to file RECOVERED_FILES/xifenfei/xff/xff.txt1320 recoverable inodes still lost.[root@xifenfei RECOVERED_FILES]# lltotal 4drwxr-xr-x 3 root root 4096 Aug 31 21:36 RECOVERED_FILES[root@xifenfei RECOVERED_FILES]# cd RECOVERED_FILES/[root@xifenfei RECOVERED_FILES]# lltotal 4drwxr-xr-x 3 root root 4096 Aug 31 21:36 xifenfei[root@xifenfei RECOVERED_FILES]# cd xifenfei/[root@xifenfei xifenfei]# lltotal 20drwxr-xr-x 2 root root 4096 Aug 31 21:36 xff-rw-r--r-- 1 root root 13231 Aug 31 21:36 xff.txt[root@xifenfei xifenfei]# cd xff[root@xifenfei xff]# lltotal 16-rw-r--r-- 1 root root 13231 Aug 31 21:36 xff.txt132--恢复成功--基于文件恢复[root@xifenfei xff]# extundelete /dev/sdb1 --restore-files /u01/xifenfei/xff.txtLoading filesystem metadata ... 160 groups loaded.Loading journal descriptors ... 23 descriptors loaded.Writing output to directory RECOVERED_FILES/[root@xifenfei xff]# cd RECOVERED_FILES/[root@xifenfei RECOVERED_FILES]# lltotal 0--未成功 |
通过上述实验证明extundelete还是有很大的不完整性,基于整个磁盘的恢复功能较为强大,基于目录和文件的恢复还不够强大.不过该软件在很多时候还是有救火的功能,特别是当蛋筒的人员删除了数据库的部分文件之时.
