First, the disk partition mounted as read-only
This step is very important and should be mounted read-only disk as soon as possible after accidentally deleted files. The sooner, the greater the chances of success of the recovery.
1. Check which partition is deleted files are located
[root@localhost ~]# mount
/dev/mapper/VolGroup-lv_root on / type ext4(rw)
/dev/mapper/VolGroup-lv_home on /home type ext4(rw)
2. Try to remount the corresponding directory read-only
[root@localhost ~]# mount -r -n -o remount /home
mount: /home is busy
3. If xxx is busy display
[root@localhost ~ ]# fuser -v -m /data
Identify the relevant processes, kill.
4. successfully directory is mounted as read-only
[root@localhost ~ ] # mount -r -n -o remount /home
At this point in the / home directory when a file touch, will get an error:
[root@localhost ~ ] # touch txt
touch: cannot touch `txt’: Read-only file system
Second, the use of data recovery tools extundelete
Before tried debugfs + dd, failed.
Later installation extundelete-0.2.4,:
1. Download
(1) because sourceforge is a wall, directly on the server wget is not successful, it can only be downloaded over the wall at the local, link as follows:
(2) the downloaded files on the server
Start the local Nginx, then wget on the server (by other methods may, of course, as long as to the server):
wget http://本机IP/extundelete-0.2.4.tar.bz2
(3) decompression
tar jxf extundelete - 0. 2. 4 .tar.bz2
2. Compile
(1) configure
[root@localhost extundelete-0.2.4]# ./configure
configure if a fault occurs, looked under config.log, did not determine the native build environment.
yum -y install gcc+ gcc-c++
Wait a little bit slow.
After installation is complete, re-config, still error
Configuring extundelete 0.2.4
configure: error: Can’t find ext2fs library
This is because extundelete dependent e2fsprogs.
After you install e2fsprogs configure again, successfully.
[root@localhost extundelete-0.2.4]# yum install e2fsprogs-devel
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
(2) make & make install
[root@localhost extundelete-0.2.4]#make & make install
Without exception information, the basic installation is successful.
(3) can go to the src directory authentication .
[root@localhost extundelete-0.2.4]# cd src
[root@localhost src]# ./extundelete
No action specified; implying --superblock.
./extundelete: Missing device name.
Usage: ./extundelete [options] [--] device-file
.............
[root@localhost src]# ./extundelete -v
extundelete version 0.2.4
libext2fs version 1.41.12
Processor is little endian.
As information to prove that the installation was successful.
The following data recovery really began.
Third, mount the new hard disk
(If the original server disk space is large enough, you can skip this step.)
Because a large accidental deletion of data (about 200G), there is no physical disk space on the server where the original machine. Because some need to mount a remote disk on another server B, B is a xen virtual machine, the space is not enough, but also the physical machine's disk space, the time required from the host partition to the space B.
1 to mount a disk on B xen
Because graphics operations, will not elaborate. Just allocate enough space on it, I was chosen is 300G.
2 logon server B, ready to mount the new disk.
(1) to see if the new disk is mounted
[nmen dev ubuntu-serverSelecting a] the ls / dev / sd *
/ dev / sda / dev / sda1 / dev / sda2 / dev / sda5 / dev / sda6 / dev / sda7 / dev / sda8 / dev / sdb
/ Dev / sdb really mounted.
At this time, the new disk is not partitioned, it is not formatted, and therefore need to make two things.
(2) partition
The figure is a hard disk hdb, sdb same disk operation.
(3) formatted
[nmen@dev -ubuntu-server]:~$ sudo mkfs -t ext3 /dev/sdb1
mke2fs 1.41.11 (14-Mar-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
22937600 inodes, 91749215 blocks
4587460 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
2800 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968
Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 33 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
The above information indicating that it has successfully formatted.
(4) a volume label
sudo e2label /dev/sdb1 /restore
(5) Mount
[nmen @dev -ubuntu-server]: ~ $ mkdir / restore
[nmen @dev - ubuntu - server]: ~ $ mount -t ext3 -vl / dev / sdb1 / restore
At this point mount the new hard disk on the server end B, do now have enough space to store the data to be restored.
Fourth, remotely mounted via NFS
Through the network, remote host B shared file system, mount the need to do data recovery machine A.
1. Installation NFS server B
(1) Installation
B is ubuntu system, not the default installation nfs.
# sudo apt-get install nfs-kernel-server
(2) Configuration
Modify / etc / exports, add the following statement.
# /etc/exports: the access control list for filesystems which may be exported
# to NFS clients. See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
#
/restore *(rw,sync,no_root_squash,no_subtree_check)
among them:
/ Restore - need to share with the client directory;
* - Indicates any host can access the catalog, you can also specify IP;
(w, Sync, no_root_squash, no_subtree_check) - configuring client privilege;
For the temporary use, and are located within the network server, so arranged relatively freely.
(3) to validate the configuration
# exportfs –rv
# /etc/init.d/nfs-kernel-server restart
(4) verify that the configuration is successful
Display NFS server output directory listing:
nmen@dev -ubuntu-server: showmount -e
Export list for chinahrd-ubuntu-dev:
/restore *
(5) firewall
Because of the time of emergency, and is within the network, so the temporary closure of the firewall on B:
sudo ufw disable
To enable the firewall with the following command:
sudo ufw enable
2. Mount the remote directory on the server A
The / restore directory is mounted from the server B to / mnt.
mount -t nfs [B的IP]:/restore /mnt
Detailed command as follows:
Mount -t nfs # [-o-Mount Options] Server: / Directory / Mount-Point
-o-Mount Options
to specify mount options can be used to mount the NFS file system.
server: / directory
Specifies the host name of the server that contains the shared resources, and the path to the file or directory you want to mount.
/ mount-point
specifies the directory of the file system to mount.
Fifth, data recovery
1. The approximate time to get deleted
This step is not necessary, but this contributes to a faster return the desired data.
date -d "Fri Apr 15:40:00 2014" +%s
1397202000
1397202000 This time value, we will use the latter.
2. Review the deleted file
# extundelete /dev/sdb1 --inode 2
File name | Inode number | Deleted status
. 9
.. 11
lost+found 24 Deleted
data 82 Deleted
When a partition is mounted to a directory, inode is "root" directory is generally 2.
Status deleted is deleted files.
3. Data Recovery
Just mount into the remote directory / restore;
Designated --after "1397202000", indicates that the file recovery after this point in time;
The default file will be restored to RECOVERED_FILES directory under the current directory.
CD / Restore
[the root @localhost Restore] # [installation path of extundelete] ./ extundelete --restore-all --after " 1397202000" / dev / mapper / VolGroup-lv_home
Only show and process deleted entries if they are deleted on or after 1397202000 and before 9223372036854775807.
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 6924 groups loaded.
Loading journal descriptors ... 27149 descriptors loaded.
Searching for recoverable inodes in directory / ...
696 recoverable inodes found.
Looking through the directory structure for deleted files ...
Unable to restore inode 27394319 (VMware/9.50_ps/9.55locate.vmx.lck): Space has been reallocated.
Unable to restore inode 27402241 (VMware/9.35win7/9.35win7.vmx.lck): Space has been reallocated.
Unable to restore inode 27396032 (VMware/9.35win7/9.35win7-Snapshot1.vmsn): No undeleted copies found in the journal.
Unable to restore inode 27394051 (VMware/9.36win2008/9.36win2008R2.vmx.lck/E00633.lck): Space has been reallocated.
Unable to restore inode 27394603 (lost+found/E09292.lck): Space has been reallocated.
8 recoverable inodes still lost.
In general, I want to wait a long time. . .
cd restore/RECOVERED_FILES$
ls
110_open_dns 111_open_dns_node1 112_DNS_node2 116_svn
Deleted files back, bringing relief.
Six, finishing work
(1) remount A disk is writable:
[root@localhost src]# mount -o remount, rw /home/
Uninstall directory on the server B.
(2) Open B firewall.
sudo ufw enable
(3) in A pair rm enabled alias, and avoid the silent type deleted.
vi /etc/bashrc
source /etc/bashrc
# do not delete / or prompt if deleting more than 3 files at a time #
alias rm='rm -I --preserve-root'
# confirmation #
alias mv='mv -i'
alias cp='cp -i' alias ln='ln -i'
# Parenting changing perms on / #
alias chown='chown --preserve-root'
alias chmod='chmod --preserve-root'
alias chgrp='chgrp --preserve-root'
(4) at B using the Rsync , regular backups A data.
Reference blog: https://www.cnblogs.com/zhangyin6985/p/6008741.html