In Linux
the delete rm
command need to be cautious, and sometimes may be due to misuse, leading to important files are deleted, then do not be too nervous, operating properly, or can be restored.
EXT type of file recovery #
Deleting a file does not actually remove inode
nodes and block
data, but in the parent directory of the file inside block
, delete the name of this file. Linux
By Link
controlling the number of deleted files, a file only if there is no Link
time, this file will be deleted.
Of course, referred to here is completely removed, that has not pass 回收站
the case back, such as the use rm -rf
to delete data. For Linux
under the EXT
file system, available recovery tools debugfs
, ext3grep
, extundelete
and so on. Which extundelete
is an open source Linux
data recovery tools, support ext3
, ext4
file system.
After the data is accidentally deleted, the first time to do is to uninstall the partition where the data is deleted, if the data is the root partition was removed in error, you need to enter the system single-user mode, and the root partition in read-only mode mount. The reason for this is very simple, because after the file is deleted, the file is only inode
sectors pointer node is cleared, the actual file is also stored on the disk, if the disk continues to mount in read-write mode, these deleted files the operating system data blocks can be re-allocated out, after which the database is overwritten with the new data, which really lost, recovery tools also conceding. So mounted read-only mode disk can minimize the risk of data in the database is overwritten, in order to increase the proportion of successful data recovery.
Demo#
In compiling the installation extundelete
before you need to install two dependencies e2fsprogs-libs
and e2fsprogs-devel
, two packages installation disc in the system /Package
directory there, use rpm
or yum
command to install it. e2fsprogs-devel
Installation depends on libcom_err-devel
package.
1. The system is used rhel6.5
, to mount the discs, the installation dependencies, herein is rpm
mounting.
[root@localhost ~]# mkdir /mnt/cdrom
[root@localhost ~]# mount /dev/cdrom /mnt/cdrom/
mount: block device /dev/sr0 is write-protected, mounting read-only
[root@localhost ~]# cd /mnt/cdrom/Packages/
[root@localhost Packages]# rpm -ivh e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
package e2fsprogs-libs-1.41.12-18.el6.x86_64 is already installed
[root@localhost Packages]# rpm -ivh libcom_err-devel-1.41.12-18.el6.x86_64.rpm
warning: libcom_err-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
1:libcom_err-devel ########################################### [100%]
[root@localhost Packages]# rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
1:e2fsprogs-devel ########################################### [100%]
2. Create a local yum
source, install the build environment.
[root@localhost ~]# yum install gcc gcc-c++ -y
3. Extract extundelete
the package.
[root@localhost ~]# tar jxvf extundelete-0.2.4.tar.bz2 -C ~
extundelete-0.2.4/
extundelete-0.2.4/acinclude.m4
extundelete-0.2.4/missing
extundelete-0.2.4/autogen.sh
extundelete-0.2.4/aclocal.m4
extundelete-0.2.4/configure
extundelete-0.2.4/LICENSE
extundelete-0.2.4/README
extundelete-0.2.4/install-sh
extundelete-0.2.4/config.h.in
extundelete-0.2.4/src/
extundelete-0.2.4/src/extundelete.cc
extundelete-0.2.4/src/block.h
extundelete-0.2.4/src/kernel-jbd.h
extundelete-0.2.4/src/insertionops.cc
extundelete-0.2.4/src/block.c
extundelete-0.2.4/src/cli.cc
extundelete-0.2.4/src/extundelete-priv.h
extundelete-0.2.4/src/extundelete.h
extundelete-0.2.4/src/jfs_compat.h
extundelete-0.2.4/src/Makefile.in
extundelete-0.2.4/src/Makefile.am
extundelete-0.2.4/configure.ac
extundelete-0.2.4/depcomp
extundelete-0.2.4/Makefile.in
extundelete-0.2.4/Makefile.am
4. Configure, compile and install extundelete
the package
[root@localhost ~]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ls
acinclude.m4 aclocal.m4 autogen.sh config.h.in configure configure.ac depcomp install-sh LICENSE Makefile.am Makefile.in missing README src
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost extundelete-0.2.4]# make
make -s all-recursive
Making all in src
extundelete.cc:571: 警告:未使用的参数‘flags’
[root@localhost extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
5. ready for the test partition, /dev/sdb1
to ext4
format, to mount /mnt/ext4
the directory.
[root@localhost ~]# mkdir /mnt/ext4
[root@localhost ~]# mount /dev/sdb1 /mnt/ext4/
[root@localhost ~]# df -hT /mnt/ext4/
Filesystem Type Size Used Avail Use% Mounted on
/dev/sdb1 ext4 20G 172M 19G 1% /mnt/ext4
6. Create a test file.
[root@localhost ~]# cd /mnt/ext4/
[root@localhost ext4]# echo 1 > a
[root@localhost ext4]# echo 2 > b
[root@localhost ext4]# echo 3 > c
[root@localhost ext4]# ls
a b c lost+found
7. Delete test file.
[root@localhost ext4]# rm -f a b
[root@localhost ext4]# ls
c lost+found
8. unloading corresponding partition.
[root@localhost ext4]# cd
[root@localhost ~]# umount /mnt/ext4/
9. Restore deleted content.
[root@localhost ~]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Loading journal descriptors ... 24 descriptors loaded.
Searching for recoverable inodes in directory / ...
2 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.
10. The documents will be recovered in the current directory RECOVERED_FILES
within the folder.
[root@localhost ~]# ls RECOVERED_FILES/
a b
XFS type of file backup and restore #
xfs
Types of files can be used xfsdump
with xfsrestore
backup restore tool. If the system is not installed in xfsdump
the xfsrestore
tool, through yum install -y xfsdump
the install command. xfsdump
According to inode
the order to back up a xfs
file system.
xfsdump
There are two levels of backup: 0
indicates a full backup; 1-9
represents an incremental backup. The default is 0
.
xfsdump -f 备份存放位置 要备份路径或设备文件
-f
: The backup file directory -L
: Specifies the label session label
-M
: Specifies the device label media label
-s
: backup a single file, -s
behind not directly with the path.
- Use
xfsdump
, you need to pay attention to the following several limitations:
1. xfsdump
does not support the mounted file system backup, so only back up the mounted;
2. xfsdump
You must use root
permissions to operate (relationship involving file system); and
3 xfsdump
can only back up XFS
the file system;
4. xfsdump
backed down data (file or storage media) can only make xfsrestore
parsing;
5 xfsdump
is through the file system UUID
to distinguish between each of the backup file, backup two can not have the same UUID
file system.
xfsrestore -f 恢复文件的位置 存放恢复后文件的路径
Demo#
1. Prepare a partition for testing, /dev/sdb1
to ext4
format, to mount /mnt/ext4
the directory.
[root@localhost ~]# mkdir /mnt/xfs
[root@localhost ~]# mount /dev/sdb1 /mnt/xfs/
[root@localhost ~]# df -hT /mnt/xfs/
Filesystem Type Size Used Avail Use% Mounted on
/dev/sdb1 xfs 20G 33M 20G 1% /mnt/xfs
2. Create a test file.
[root@localhost ~]# cd /mnt/xfs/
[root@localhost xfs]# mkdir test
[root@localhost xfs]# touch a.txt
[root@localhost xfs]# touch test/b.txt
3. You can use tree
to view the directory structure.
[root@localhost ~]# yum install tree -y
[root@localhost ~]# tree /mnt/xfs/
/mnt/xfs/
├── a.txt
└── test
└── b.txt
1 directory, 2 files
4. xfsdump
command to back up the entire partition.
[root@localhost ~]# xfsdump -f /opt/dump_sdb1 /dev/sdb1
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.4 (dump format 3.0) - type ^C for status and control
============================= dump label dialog ==============================
please enter label for this dump session (timeout in 300 sec)
-> dump_sdb1 //指定备份会话标签
session label entered: "dump_sdb1"
--------------------------------- end dialog ---------------------------------
xfsdump: level 0 dump of localhost.localdomain:/mnt/xfs
xfsdump: dump date: Fri Sep 6 13:36:12 2019
xfsdump: session id: 74232f85-124c-4486-8d91-f35208534f74
xfsdump: session label: "dump_sdb1"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: skipping (no pruning necessary)
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 21760 bytes
xfsdump: /var/lib/xfsdump/inventory created
============================= media label dialog =============================
please enter label for media in drive 0 (timeout in 300 sec)
-> sdb1 //指定设备标签,就是对要备份的设备做一个描述
media label entered: "sdb1"
--------------------------------- end dialog ---------------------------------
xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 22952 bytes
xfsdump: dump size (non-dir files) : 0 bytes
xfsdump: dump complete: 46 seconds elapsed
xfsdump: Dump Summary:
xfsdump: stream 0 /opt/dump_sdb1 OK (success)
xfsdump: Dump Status: SUCCESS
5. Review the backup information and content.
[root@localhost ~]# xfsdump -I
file system 0:
fs id: f8805a3e-089e-4875-ad54-d31e5dc98835
session 0:
mount point: localhost.localdomain:/mnt/xfs
device: localhost.localdomain:/dev/sdb1
time: Fri Sep 6 13:36:12 2019
session label: "dump_sdb1"
session id: 74232f85-124c-4486-8d91-f35208534f74
level: 0
resumed: NO
subtree: NO
streams: 1
stream 0:
pathname: /opt/dump_sdb1
start: ino 68 offset 0
end: ino 70 offset 0
interrupted: NO
media files: 1
media file 0:
mfile index: 0
mfile type: data
mfile size: 22952
mfile start: ino 68 offset 0
mfile end: ino 70 offset 0
media label: "sdb1"
media id: cc32446f-42e8-489b-867f-84a55949c1fa
xfsdump: Dump Status: SUCCESS
6. Delete test file was created, simulated data loss.
[root@localhost ~]# rm -rf /mnt/xfs/*
[root@localhost ~]# tree /mnt/xfs/
/mnt/xfs/
0 directories, 0 files
7. recover files lost files.
[root@localhost ~]# xfsrestore -f /opt/dump_sdb1 /mnt/xfs/
xfsrestore: using file dump (drive_simple) strategy
xfsrestore: version 3.1.4 (dump format 3.0) - type ^C for status and control
xfsrestore: searching media for dump
xfsrestore: examining media file 0
xfsrestore: dump description:
xfsrestore: hostname: localhost.localdomain
xfsrestore: mount point: /mnt/xfs
xfsrestore: volume: /dev/sdb1
xfsrestore: session time: Fri Sep 6 13:36:12 2019
xfsrestore: level: 0
xfsrestore: session label: "dump_sdb1"
xfsrestore: media label: "sdb1"
xfsrestore: file system id: f8805a3e-089e-4875-ad54-d31e5dc98835
xfsrestore: session id: 74232f85-124c-4486-8d91-f35208534f74
xfsrestore: media id: cc32446f-42e8-489b-867f-84a55949c1fa
xfsrestore: using online session inventory
xfsrestore: searching media for directory dump
xfsrestore: reading directories
xfsrestore: 2 directories and 3 entries processed
xfsrestore: directory post-processing
xfsrestore: restoring non-directory files
xfsrestore: restore complete: 0 seconds elapsed
xfsrestore: Restore Summary:
xfsrestore: stream 0 /opt/dump_sdb1 OK (success)
xfsrestore: Restore Status: SUCCESS
[root@localhost ~]# tree /mnt/xfs/
/mnt/xfs/
├── a.txt
└── test
└── b.txt
1 directory, 2 files