First, install
(1) Firstly, extundelete e2fsprogs software rely on e2fsprogs-libs e2fsprogs-devel packages
(2) download extundelete, official site is http://extundelete.sourceforge.NET/the current stable version is extundelete-0.2.4
[root@local app]# tar jxvf extundelete-0.2.4.tar.bz2
[root@localapp]# cd extundelete-0.2.4
[Root@localapp]#./configure Writing the results generated files to disk
[Root@localapp]# make the results extundelete.cc:571: warning: unused parameter ‘flags’
[root@localapp]# make install
Results/usr/bin/extundelete’/usr/local/bin’
(3) extract the installation
(4) after the installation is complete, you can perform data recovery operations
Second, a practical method
(1) command format extundelete [options’ options] [action’ order ‘] device-file’ device file ‘
(2) the parameter introduced extundelete – help
Parameters:
–Version,-[vV] to display the software version number
–Help, display help information
–Superblock display the superblock information
–Journal, display log information
–After DTIME, time parameter, which means that after a certain period of time the file or directory was deleted
–Before DTIME, time parameter indicating a time period before the file or directory was deleted
Action:
–Inode INO, INO displayed node information
–Block displays information about block BLK BLK
–restore-inode ino [,ino,…] Restore command parameters, said recovering the node “INO“ files, restore files automatically
Stored in the RESTORED_FILES folder in the current directory, use the node number as an extension
–Restore-file ‘path’, restore command eroded, says it will restore the file to the specified path and file in recovery when
In the directory under the RECOVERED_FILES directory before
–Restore-files’path’, the restore command parameters, saying it will restore all files that are listed in the path
–Restore-all, the restore command parameters, said it would try to recover all the directories and files
-J journal that reads from a file already named extended log
-B blocknumber, super fast to open file system backup before you can use, to view the existing super fast
If the file
-B BLOCKSIZE, through the development of block size to open the file system, generally used to view already know the size of the file
Third, extundelete data recovery process
In data was errors by deleting Hou, first time to do of is uninstall was delete data where of disk or disk partition, if is system root partition of data was errors by deleting, on need will system into single user, and will root directory to only read of mode hanging contains, such do of reasons is Dang asked was delete Hou, just is will file of inode node in the of fan district pointer clear zero, actual file also store in disk Shang, if disk to only read mode hanging contains, these has delete file of data block on May was operating system again distribution out has , In the block of data after it has been overwritten with new data, the data is really gone, recovery tool can’t restore.
(1) by extundelete restore individual files to the ext4 file system environment, for example, I added a disk device for/dev/sdb4
[Root@local desktop]#
[Root@local desktop]# mkfs./sdb4
[Root@local desktop]#//
[Root@local desktop]#//
[root@local data]# cp -r /root/app/extundelete-0.2.4 /data/
[root@local data]# md5sum passwd
90a8c0bb0bea88d6ce2ab252bd55ecfc passwd
[root@local data]# rm -rf /data/*
(2) the uninstall disk partitions
[root@local data]# cd
[root@local ~]# umount /data/
(3) by extundelete commands check the/dev/sdb4 partition recoverable data “root“ directory inode is
2, when a partition is mounted to a directory, the “root“ directory inode value 2
[root@local ~]# extundelete /dev/sdb4 –inode 2
………
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11 Deleted
passwd 12 Deleted
extundelete-0.2.4 131073 Deleted
Leave a Reply