Linux's use extundelete recover deleted files

Disclaimer: This article is a blogger original article, follow the CC 4.0 BY-SA copyright agreement, reproduced, please attach the original source link and this statement.

This link: https://blog.csdn.net/m0_37814112/article/details/102738712

Linux's use extundelete recover deleted files

1. Background

手动误删除某目录或文件，没有备份，现在需要使用extundelete来恢复已经删除的文件。

2. Deploy

2.1 epel仓库安装
yum install extundelete -y

2.2 源码编译安装
wget  http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2
yum -y install  bzip2  e2fsprogs-devel  e2fsprogs  gcc-c++ make
tar -xvjf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4 ./configure
make && make install

3.umount disk where the file is, or to read only way remounting

In order to avoid partition deleted file data storage location is overwritten unable to continue after recovery, so our first move was to restore the partition you want to unload data or re-read-only mount.

3.1 首先需要umount该文件所在磁盘，或者以read only方式重新挂载
umount  /data
或者
mount -o remount,ro /data  
注意：个人建议第二种方式只读挂载。

4. Before resuming operation

删除前
[root@docker1 data]# ll
总用量 5120800
-rwxr-xr-x. 1 root root        477 10月 25 10:07 bzip2.sh
drwxr-xr-x. 2 root root       4096 10月 25 10:07 docker
drwxr-xr-x. 5 root root       4096 10月 25 10:07 elasticsearch
-rwxr-xr-x. 1 root root        473 10月 25 10:06 gzip.sh
drwx------. 2 root root      16384 10月 24 21:29 lost+found
-rwxr-xr-x. 1 root root        461 10月 25 10:06 lz4.sh
-rwxr-xr-x. 1 root root        458 10月 25 10:06 lzop.sh
-rw-r--r--. 1 root root 5242880000 10月 25 10:08 test5
-rw-r--r--. 1 root root     762784 10月 25 10:08 test5.tar.xz
-rw-r--r--. 1 root root        260 10月 25 10:08 time.txt
-rwxr-xr-x. 1 root root        472 10月 25 10:08 xz.sh

删除
rm -f test5.tar.xz

查看删除文件或目录的名称
[root@docker1 data]# extundelete /dev/sdb1 --inode 2  (根分区inode值为2)
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
bzip2.sh                                          12
gzip.sh                                           13
lz4.sh                                            14
lzop.sh                                           15
test5                                             16
docker                                            131073
elasticsearch                                     524289
test5.tar.xz                                      17             Deleted
time.txt                                          18
xz.sh                                             19

4.extundelete restore individual files

[root@docker1 data]# extundelete /dev/sdb1 --restore=file  test5.tar.xz

5.extundelete restore a single directory

[root@docker1 data]# extundelete /dev/sdb1 --restore-dirctory  /data/redis

6.extundelete restore all files

[root@docker1 data]# extundelete /dev/sdb1 --restore-all