下载extundelete:http://sourceforge.net/
[root@locahost ~] tar jxvf extundelete-0.2.4.tar.bz2
[root@locahost ~] cd extundelete-0.2.4
[root@locahost ~] yum install e2fsprogs-devel
[root@locahost ~] ./configure
[root@locahost ~] make
[root@locahost ~] make install
开始恢复:
方法一:通过inode结点恢复
1)通过inode结点查看被删除的文件名字:
[root@locahost ~] extundelete /dev/sda4 --inode 2
. 2
lost+found 11
passwd 12 Deleted
hosts 13 Deleted
a 7313 Deleted
注:ext4文件系统的分区根目录的inode值为2,xfs分区根目录的inode值为64
2)通过inode结点恢复
[root@locahost ~] extundelete /dev/sda4 --restore-inode 12
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 9 groups loaded.
Loading journal descriptors ... 63 descriptors loaded.
[root@xuegod63 test]# ls
RECOVERED_FILES
[root@locahost ~] diff /etc/passwd RECOVERED_FILES/file.12 # 没有任何输出,说明一样
方法二:通过文件名恢复
[root@locahost ~] extundelete /dev/sda4 --restore-file passwd
[root@locahost ~] diff /etc/passwd RECOVERED_FILES/passwd # 没有任何输出,说明一样
方法三:恢复某个目录,如目录a下的所有文件:
[root@locahost ~] extundelete /dev/sda4 --restore-directory a
[root@locahost ~] tree RECOVERED_FILES/a/
方法四:恢复所有的文件
[root@locahost ~] extundelete /dev/sda4 --restore-all
注:extundelete在恢复文件的时候不能创建空文件和目录。