How to recover Linux system files deleted by mistake

1. EXT file recovery

EXT (extundelete) is an open source Linux data recovery tool that supports ext3 and ext4 file systems. (ext4 can only be restored in centos6 version)

experiment procedure

(1) First create a new disk partition

fdisk -l              
fdsik /dev/sdb                     ##创建分区
mkfs.ext3 /dev/sdb1                ##格式化ext3文件系统
mkdir /test                        ##创建一个目录用来测试
mount /dev/sdb1 /test              ##挂载

"Df -Th" check it out

(2) The installation of dependent packages requires the system image to be mounted
mount /dev/cdrom /mnt

(3) Install dependency package
yum -y install e2fsprogs-devel e2fsprogs-libs

(4) First switch to the test directory
cd /test

Download the installation package from the official website (or you can directly drag in the software package in your computer)
wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

(5) Unzip
tar jxvf extundelete-0.2.4.tar.bz2

(6) cd extundelete-0.2.4 /

Specify the installation directory and start the installation./configure
--prefix=/usr/local/extundelete && make && make install

Note: If the following error report appears, it means that the gcc components are not fully installed

The following command needs to be executed:
yum install gcc gcc-c++ gcc-g77

(7) Create a soft connection (in order for the system to recognize the command)
ln -s /usr/local/extundelete/bin/* /usr/bin/

(8) First switch to the test directory
cd /test

Simulate deletion and perform the recovery operation (first use the echo command to define the content a in files A, B, C, D, create 4 files, or use vim to create it)
echo a>A
echo a>B
echo a>C
echo a>D

(7) Check which files exist in the file system /dev/sdb1, the i node starts from 2, and 2 represents the initial directory of the file system.
extundelete /dev/sdb1 --inode 2

(8) Delete files

(9) Check again, you can see that A and B have been deleted


(10) Switch to the root directory and unmount it

(11) Restore the contents of the /dev/sdb1 file system
extundelete /dev/sdb1 --restore-all

(12) Check ls and find that there is an additional RECOVERED_FILES directory, and the deleted files are also in it

Two, xfs type file backup and recovery

The Centos 7 system uses xfs type files by default, and xfs type files can be backed up and restored using xfsdump (backup tool) and xfsrestore (restore tool).
There are two backup levels for xfsdump: 0 means full backup; 1-9 means incremental backup. The default backup level of xfsdump is 0.

The command format of xfsdump is:
xfsdump -f backup storage location path or device file to be backed up

常用的选项：
-f：指定备份文件目录
-L：指定会话标签 session label
-M：指定设备标签 media label
-S：备份单个文件， -s后面不能直接跟路径

xfsdump 使用限制:
1、只能备份已挂载的文件系统
2、必须使用root的权限才能操作
3、只能备份XFS文件系统
4、备份后的数据只能让 xfsrestore 恢复
5、不能备份两个具有相同UUID的文件系统（可用 blkid 命令查看）

experiment procedure

Directly use the disk partition
mkfs.xfs from the previous experiment -f /dev/sdb1 plus "-f" is mandatory formatting

(1) Create a new partition fdisk /dev/sdb
(2) Create a directory and mount
mkdir /data
mount / dev/sdb1 /data

(3) Enter the /date directory and back up the passwd information (the file information will be restored later to prevent the backup from being unable to be retrieved)

(4) Create a new directory and create a file in the directory

(5) Check if xfsdump is installed, if not, install
rpm -qa | grep xfsdump
yum install -y xfsdump

(6) Back up the files in /dv/sdb1 to dump_sdb1 under /opt, followed by -L File name, followed by -M is the device name
xfsdump -f /opt/dump_sdb1 /dev/sdb1 -L dump_sdb1 -M sdb1

(7) Delete all files and directories and restore
xfsrestore -f /opt/dump_sdb1 /data/

You can see that the passwd file is restored