Linux 磁盘恢复工具 - AaronPei/blog GitHub Wiki

Extundelete工具

原理

安装

下载目录：https://pkgs.org/download/extundelete

# 下载
wget  http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2
# 安装相关包
yum -y install e2fsprogs-libs e2fsprogs e2fsprogs-devel
rpm -q e2fsprogs-libs e2fsprogs e2fsprogs-devel
# 源码编译安装
# 解压
[root@vm21046 yuekun]# tar -xvjf extundelete-0.2.4.tar.bz2
tar (child): bzip2: Cannot exec: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
# 缺少bizp2包，无法安装，安装后再解压
[root@vm21046 yuekun]#cd 
# 缺少C++ 无法make
[root@vm21046 yuekun]# cd extundelete-0.2.4
[root@vm21046 extundelete-0.2.4]# ./configure && make && make install 
Configuring extundelete 0.2.4
configure: error: in `/usr/home/yuekun/extundelete-0.2.4':
configure: error: C++ compiler cannot create executables
See `config.log' for more details
# 因此安装 gcc-c++ make
[root@vm21046 extundelete-0.2.4]# yum install -y gcc-c++ make
[root@vm21046 extundelete-0.2.4]# ./configure && make && make install

试验

创建测试的目录及文件

# 在/data0下构建如此的目录及文件用来测试，并记录md5值
[root@centos-7 data0]# tree
.
├── lost+found
├── password
└── test1
    ├── test2
    │   └── password.bak
    └── test.txt

3 directories, 3 files
[root@centos-7 data0]# md5sum password
f447b20a7fcbf53a5d5be013ea0b15af  password
[root@centos-7 data0]# md5sum test1/test2/password.bak
f447b20a7fcbf53a5d5be013ea0b15af  test1/test2/password.bak
[root@centos-7 data0]# md5sum test1/test.txt
d857e51e3911cc8d659dc5f16e77ada9  test1/test.txt
[root@centos-7 data0]#

删除并恢复

删除
[root@vm21046 data0]# rm -rf *
[root@vm21046 data0]# umount /data0
umount: /data0: target is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1))
[root@vm21046 data0]#  fuser -m -v -i -k /data0/
-bash: fuser: command not found
# yum install -y psmisc  即可
[root@vm21046 ~]#  fuser -m -v -i -k /data0
                     USER        PID ACCESS COMMAND
/data0:              root     kernel mount /data0
[root@vm21046 ~]# umount /data0

恢复

# 查看可以恢复的文件
[root@vm21046 ~]# extundelete /dev/vdb1 --inode 2
.....
.....
.....
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
passwd                                            12             Deleted
test1                                             131073         Deleted
# 恢复下尝试，失败。在网上看各种文档都能正常恢复，不知道是否是因为虚机qcow2磁盘的问题
[root@vm21046 data1]# extundelete /dev/vdb1 --restore-file passwd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 181 descriptors loaded.
Unable to restore inode 12 (passwd): No undeleted copies found in the journal.
Unable to restore file passwd
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
[root@vm21046 data1]# ll RECOVERED_FILES/
total 0
[root@vm21046 data1]# extundelete /dev/vdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 40 groups loaded.
Loading journal descriptors ... 181 descriptors loaded.
Searching for recoverable inodes in directory / ... 
0 recoverable inodes found.
Looking through the directory structure for deleted files ... 
0 recoverable inodes still lost.

其他工具

  1. ext4magic /dev/sda7 -R -a $(date -d "-19days" +%s) -d /data10/backup_dir/
wget https://www.o2oxy.cn/ext4magic-0.3.1-1.2.x86_64.rpm.tar.gz
tar -zxvf ext4magic-0.3.1-1.2.x86_64.rpm.tar.gz
rpm -ivh ext4magic-0.3.1-1.2.x86_64.rpm
ext4magic /dev/vdb1 -I 2
ext4magic /dev/vdb1 -R -a $(date -d "-5days" +%s) -d /mnt/
⚠️ **GitHub.com Fallback** ⚠️