extundelete工具恢复误删文件

linux删除文件时其实删的是文件名，数据还是存储在硬盘中的。在误删除文件后不做其他操作（比如创建新的文件），然后用umount卸载掉存储该数据的硬盘，再进行恢复操作，可以通过一些工具来恢复被误删的文件，以extundelete文件恢复工具为例：

extundelete是文件恢复工具，支持ext3/ext4双格式分区恢复。

extundelete工具的下载地址：https://sourceforge.net/projects/extundelete/

安装extundelete工具前先安装依赖包：yum install e2fsprogs* -y

rz -y（从windows中下载extundelete软件包）

tar jxf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4.tar.bz2

./confgiure

make

make install

此时extundelete工具已经安装好了。下面我们模拟恢复误删文件。

首先添加一块测试的硬盘

然后开机查看一下硬盘是否成功加载到系统中

创建ext4文件系统并挂载到/data中：

mkfs -t ext4 /dev/sdb

mkdir /data

mount /dev/sdb /data/

向/data目录写入数据

删除/data中的数据rm -rf /data/*

卸载硬盘umount /data/并用extundelete /dev/sdb --inode 2查看可恢复文件

[root@liuhui ~]# umount /data/
[root@liuhui ~]# extundelete /dev/sdb --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 28 6a 9c 5b 24 6a 9c 5b | .A......(j.[$j.[
0010 | 24 6a 9c 5b 00 00 00 00 00 00 02 00 08 00 00 00 | $j.[............
0020 | 00 00 00 00 05 00 00 00 21 24 00 00 00 00 00 00 | ........!$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 68 dc ee 16 68 dc ee 16 44 83 ba de | ....h...h...D...
0090 | 9a 68 9c 5b 00 00 00 00 00 00 00 00 00 00 00 00 | .h.[............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1536977448
Creation time: 1536977444
Modification time: 1536977444
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0