linux数据恢复软件extunelete安装及实战讲解

快来打我* 2022-10-01 00:58 1766阅读 0赞

**一、安装数据恢复软件****extundelete**

1、安装必要依赖包e2fsprogse2fsprogs-libs

\[root@localhost~\]\# yum -y install e2fsprogs e2fsprogs-libs

2、下载extundelete,地址https://sourceforge.net/projects/extundelete/files/latest/download

3、安装报错解决

\[root@localhost~\]\# tar jxvf extundelete-0.2.4.tar.bz2

\[root@localhost~\]\# cd extundelete-0.2.4/

\[root@localhostextundelete-0.2.4\]\# ./configure

Configuringextundelete 0.2.4

configure:error: Can't find ext2fs library

configure时报错，未找到ext2fslibrary，安装e2fsprogs-libs-devel即可

\[root@localhostextundelete-0.2.4\]\# yum install e2fsprogs-libs-devel

……

Installed:

e2fsprogs-devel.x86\_640:1.41.12-22.el6

Complete!

4、重新编译安装extundelete

\[root@localhostextundelete-0.2.4\]\# ./configure

Configuringextundelete 0.2.4

Writinggenerated files to disk

\[root@localhostextundelete-0.2.4\]\# make

make-s all-recursive

Makingall in src

extundelete.cc:571:警告：未使用的参数‘flags’

\[root@localhostextundelete-0.2.4\]\# make install

Makinginstall in src

/usr/bin/install-c extundelete '/usr/local/bin'

\[root@localhostextundelete-0.2.4\]\#

**二、****extundelete****用法详解：**

\[root@localhost/\]\# extundelete --help

Usage:extundelete \[options\] \[--\] device-file

Options:

\--version,-\[vV\] 显示软件版本号Printversion and exit successfully.

\--help,  显示软件帮助信息Printthis help and exit successfully.

\--superblock 显示超级块信息Printcontents of superblock in addition to the rest.Ifno action is specified then this option is implied.

\--journal 显示日志信息Showcontent of journal.

\--afterdtime 时间参数，表示在某段时间之后被删除的数据Onlyprocess entries deleted on or after 'dtime'.

\--beforedtime 时间参数，表示在某段时间之前被删除的数据Onlyprocess entries deleted before 'dtime'.

Actions动作有:

\--inodeino 显示节点'ino'信息Showinfo on inode 'ino'.

\--blockblk 显示数据块'blk'信息Showinfo on block 'blk'.

\--restore-inodeino\[,ino,...\] 恢复命令参数，表示恢复节点“ino”的文件，恢复的文件会自动放在当前

目录下的RECOVERED\_FILES文件夹中，使用节点编号作为扩展名

Restorethe file(s) with known inode number 'ino'.Therestored files are created in ./RECOVERED\_FILESwiththeir inode number as extension (ie, file.12345).

\--restore-file 'path'恢复命令参数，表示恢复指定路径的文件，恢复的文件会自动放在当前

目录下的RECOVERED\_FILES文件夹中，使用节点编号作为扩展名

Will restore file 'path'. 'path' is relative to root of the partition and does not start with a '/'

Therestored file is created in the current directoryas 'RECOVERED\_FILES/path'.

\--restore-files 'path'恢复命令参数，表示恢复在路径中已列出的所有文件

Willrestore files which are listed in the file 'path'.Eachfilename should be in the same format as an option to--restore-file, and there should be one per line.

\--restore-directory 'path'恢复命令参数，表示将尝试恢复指定路径下的目录

Willrestore directory 'path'. 'path' is relative to the root directory of the file system. The restored

directoryis created in the output directory as 'path'.

\--restore-all 表示将尝试恢复所有目录和文件 Attemptsto restore everything.

\-jjournal 表示从已经命名的文件中读取扩展日志 Readsan external journal from the named file.

\-bblocknumber表示使用之前备份的超级块来打开文件系统，一般用于查看现有超级块是不是当前索要文件

Usesthe backup superblock at blocknumber when opening the file system.

\-Bblocksize通过指定数据块大小来打开文件系统，一般用于查看已经知道大小的文件Usesblocksize as the block size when opening the filesystem. The number should be the number of bytes.

\--log0 Make the program silent.

\--logfilename Logs all messages to filename.

\--logD1=0,D2=filename Custom control of log messages withcomma-separated

Examplesbelow: list of options. Dn must be one of info, warn, or

\--loginfo,error error. Omission of the '=name' results in messages

\--logwarn=0 with the specified level to be logged to the console.

\--logerror=filename If the parameter is '=0', logging for the specifiedlevelwill be turned off. If the parameter is'=filename',messages with that level will be writtentofilename.

\-o directory Save the recovered files to the named directory.Therestored files are created in a directory named'RECOVERED\_FILES/' by default

**三、创建分区，模拟数据误删除环境**

1、创建分区，模拟数据误删除环境

\[root@localhosttmp\]\# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 \* 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 \* 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

\[root@localhosttmp\]\# fdisk /dev/sda

WARNING:DOS-compatible mode is deprecated. It's strongly recommended to

switchoff the mode (command 'c') and change display units to

sectors(command 'u').

Command(m for help): n

Firstcylinder (4106-4178, default 4106):

Usingdefault value 4106

Lastcylinder, +cylinders or +size\{K,M,G\} (4106-4178, default 4178): +100M

Command(m for help): W

Thepartition table has been altered!

Callingioctl() to re-read partition table.

WARNING:Re-reading the partition table failed with error 16:设备或资源忙.

Thekernel still uses the old table. The new table will be used at

thenext reboot or after you run partprobe(8) or kpartx(8)

Syncingdisks.

\[root@localhosttmp\]\# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 \* 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 \* 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

/dev/sda6 4106 4119 109964 83 Linux

2、格式化磁盘分区

\[root@localhost~\]\# mount /dev/sda6 /data

mount:you must specify the filesystem type

显示分区未格式化

\[root@localhost~\]\# mkfs -t ext3 -c /dev/sda6

mke2fs1.41.12 (17-May-2010)

mkfs.ext3:inode\_size (128) \* inodes\_count (0) too big for a

filesystemwith 0 blocks, specify higher inode\_ratio (-i)

orlower inode count (-N).

3、格式化扩展分区报错解决

格式磁盘时发现如下错误，原因是扩展分区无法格式化，

解决方法是在扩展分区上创建主分区（p）或逻辑分区（l）

\[root@localhost~\]\# fdisk /dev/sda6

Devicecontains neither a valid DOS partition table, nor Sun, SGI or OSFdisklabel

Buildinga new DOS disklabel with disk identifier 0xcbd45cde.

Changeswill remain in memory only, until you decide to write them.

Afterthat, of course, the previous content won't be recoverable.

Warning:invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

WARNING:DOS-compatible mode is deprecated. It's strongly recommended to

switchoff the mode (command 'c') and change display units to

sectors(command 'u').

Command(m for help): p

Disk/dev/sda6: 112 MB, 112603136 bytes

255heads, 63 sectors/track, 13 cylinders

Units= cylinders of 16065 \* 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0xcbd45cde

DeviceBoot Start End Blocks Id System

Command(m for help):n

Commandaction

e extended

p primary partition (1-4)

Partitionnumber (1-4): 1

Firstcylinder (1-13, default 1):

Usingdefault value 1

Lastcylinder, +cylinders or +size\{K,M,G\} (1-13, default 13): 13M

Command(m for help): P

Disk/dev/sda6: 112 MB, 112603136 bytes

255heads, 63 sectors/track, 13 cylinders

Units= cylinders of 16065 \* 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0xcbd45cde

DeviceBoot Start End Blocks Id System

/dev/sda6p1 1 13 104391 83 Linux

Command(m for help): W

Thepartition table has been altered!

Callingioctl() to re-read partition table.

WARNING:Re-reading the partition table failed with error 22:无效的参数.

Thekernel still uses the old table. The new table will be used at

thenext reboot or after you run partprobe(8) or kpartx(8)

Syncingdisks.

此处要重启使生效，也可以使用partprobe命令

\[root@localhost~\]\# partprobe

Warning:WARNING: the kernel failed to re-read the partition table on /dev/sda(设备或资源忙). As a result, it may not reflect all of your changes until afterreboot.

Warning:无法以读写方式打开/dev/sr0(只读文件系统)。/dev/sr0已按照只读方式打开。

Error:无效的分区表-/dev/sr0出现递归分区。

\[root@localhost~\]\# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 \* 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 \* 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

/dev/sda6 4106 4119 109964 83 Linux

\[root@localhost~\]\# mkdir /data

再次格式化，显示格式化成功。

\[root@localhost~\]\# mkfs.ext3 /dev/sda6

mke2fs1.41.12 (17-May-2010)

文件系统标签=

操作系统:Linux

块大小=1024(log=0)

分块大小=1024(log=0)

Stride=0blocks, Stripe width=0 blocks

27552inodes, 109964 blocks

5498blocks (5.00%) reserved for the super user

第一个数据块=1

Maximumfilesystem blocks=67371008

14block groups

8192blocks per group, 8192 fragments per group

1968inodes per group

Superblockbackups stored on blocks:

8193,24577, 40961, 57345, 73729

正在写入inode表:完成

Creatingjournal (4096 blocks):完成

Writingsuperblocks and filesystem accounting information:完成

Thisfilesystem will be automatically checked every 24 mounts or

180days, whichever comes first. Use tune2fs -c or -i to override.

4、挂载磁盘分区

\[root@localhost~\]\# mount /dev/sda6 /data

\[root@localhost~\]\# df -hT

Filesystem Type Size Used Avail Use% Mounted on

/dev/sda2 ext4 15G 8.4G 5.9G 59% /

/dev/sda1 ext4 969M 54M 865M 6% /boot

/dev/sda3 ext4 14G 525M 13G 5% /home

/dev/sr0 iso9660 1.8G 1.8G 0 100% /mnt/iso

share vboxsf 222G 93G 129G 42% /mnt/share

/dev/sda6 ext3 104M 5.6M 94M 6% /data

**四、实战：使用****extundelete****恢复数据**

\[root@localhost~\]\# cd /data

\[root@localhostdata\]\# ll

总用量12

drwx------2 root root 12288 3月2409:55 lost+found

前提：模拟在磁盘上添加数据并删除

\[root@localhostdata\]\# cp /etc/passwd /data

\[root@localhostdata\]\# cp /bin/ls /data

\[root@localhostdata\]\# mkdir /data/test

\[root@localhostdata\]\# echo "extundelete test" > /data/test/mytest.txt

\[root@localhostdata\]\# cd /data

\[root@localhostdata\]\# ll

总用量131

drwx------2 root root 12288 3月2409:55 lost+found

\-rwxr-xr-x1 root root 117048 3月2410:02 ls

\-rw-r--r--1 root root 2044 3月2410:01 passwd

drwxr-xr-x2 root root 1024 3月2410:03 test

\[root@localhostdata\]\# md5sum passwd

265e460e2065cdacdbb70e6af3fbcd57 passwd

\[root@localhostdata\]\# md5sum test/mytest.txt

eb42e4b3f953ce00e78e11bf50652a80 test/mytest.txt

\[root@localhostdata\]\# mkdir /data/lianxi/

\[root@localhostdata\]\# echo "lianxi"> /data/lianxi/lianxi.txt

\[root@localhostdata\]\# ll

总用量132

drwxr-xr-x2 root root 1024 3月2410:06 lianxi

drwx------2 root root 12288 3月2409:55 lost+found

\-rwxr-xr-x1 root root 117048 3月2410:02 ls

\-rw-r--r--1 root root 2044 3月2410:01 passwd

drwxr-xr-x2 root root 1024 3月2410:03 test

模拟误删磁盘数据

\[root@localhostdata\]\# rm -rf /data/\*

\[root@localhostdata\]\# cd ~

以下演示恢复数据

将数据误删后，首先应该卸载该磁盘分区

\[root@localhost~\]\# cd /mnt

\[root@localhostmnt\]\# umount /data

1、使用--inode参数查看可以恢复的数据信息

\[root@localhostmnt\]\# extundelete /dev/sda6 --inode 2

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Group:0

.......

Directblocks: 507, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirectblock: 0

Doubleindirect block: 0

Tripleindirect block: 0

Filename | Inode number | Deletedstatus

. 2

.. 2

lost+found 11 Deleted

passwd 12 Deleted

ls 13 Deleted

test 17713 Deleted

lianxi 19681 Deleted

\[root@localhostmnt\]\# cd /

2、使用--restore-file恢复单个文件，注意，后面所接路径为相对路径，

即原项为/data/test/mytest,则只需指定为/test/mytesj即可

\[root@localhost/\]\# extundelete /dev/sda6 --restore-file passwd

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Loadingjournal descriptors ... 69 descriptors loaded.

Successfullyrestored file passwd

\[root@localhost/\]\# cd /RECOVERED\_FILES/

\[root@localhostRECOVERED\_FILES\]\# ls

passwd

使用md5sum校验，检查恢复的数据是否与原数据相同，结果一致

\[root@localhostRECOVERED\_FILES\]\# md5sum passwd

265e460e2065cdacdbb70e6af3fbcd57 passwd

3、使用--restore-directory恢复单个目录

\[root@localhostRECOVERED\_FILES\]\# extundelete /dev/sda6 --restore-directory /lianxi

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Loadingjournal descriptors ... 69 descriptors loaded.

Searchingfor recoverable inodes in directory /lianxi ...

7recoverable inodes found.

Lookingthrough the directory structure for deleted files ...

6recoverable inodes still lost.

\[root@localhostRECOVERED\_FILES\]\# ls

passwd RECOVERED\_FILES

\[root@localhostRECOVERED\_FILES\]\# cd RECOVERED\_FILES/

\[root@localhostRECOVERED\_FILES\]\# ls

lianxi

4、使用--restore-all恢复所有误删除的数据

\[root@localhostRECOVERED\_FILES\]\# cd /mnt</span%

linux数据恢复软件extunelete安装及实战讲解

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关 Oracle数据恢复：实战案例及操作步骤

相关 linux中安装的mysql数据做恢复

相关 Linux中redis安装及软件安装相关Linux知识要点

相关 linux 文件恢复软件,EasyRecovery轻松实现Linux数据恢复

相关 Wondershare数据恢复软件

相关 linux数据恢复软件extunelete安装及实战讲解

相关【Linux】rar软件安装方法及使用

相关 Linux软件安装

相关 Linux软件安装：boost软件安装

相关讲解Linux数据库安装