恢复误删除的文件(xfs文件系统)
恢复误删除的文件(xfs文件系统)
误操作，不小心删除了多年的技术文档，于是乎想尽一切办法抢救，才有了此篇记录
误删除文件所在分区是Centos7.9 xfs
需要借助 xfs_undelete 工具
官方文档在这里：https://github.com/ianka/xfs_undelete
准备工作
Linux环境需要安装以下工具
- tcl >= 8.6
- tcllib
tcl 源码包
https://core.tcl-lang.org/tcl/info/00748475834c4942
下载解压，cd unix
./configure
make && make install
ln -s /usr/local/bin/tclsh8.7 /usr/bin/tclsh
tclsh
% info tclversion
8.7
% info patchlevel
# 如果 yum源有包切符合版本要求，直接通过yum安装
yum install tcl tcl-dev tcllib
or
apt install tcl tcl-dev tcllib
准备恢复目录
# 我在其他磁盘新建一个目录，与原数据盘区别开
mkdir -p /mnt/1t_path/recovery_date
ntfs-3g /dev/sdc1 /mnt/1t_path/recovery_date
需要扫描的磁盘是 /dev/sdd5 ，恢复后的数据保存在 sdc1 /1t_path/recovery_date路径下
目前 /dev/sdd5 磁盘仅仅通电，并没有挂载，也是为了避免复写，提高恢复概率
xfs_undelete 下载
https://github.com/ianka/xfs_undelete/releases
# 解压
tar xf xfs_undelete-11.0.tar.gz
cd xfs_undelete-11.0
# 恢复命令
./xfs_undelete -t -48hour -o /recovery_dir /dev/<disk-partiation>
./xfs_undelete -t 2022-06-04 -o /mnt/1t_path/recovery_date /dev/sdd5
等待扫描完成，扫描恢复后的文件 在 /mnt/1t_path/recovery_date 目录下
# 官方文档还有更多使用方法
https://github.com/ianka/xfs_undelete
EXAMPLES
# cd ~ ; xfs_undelete /dev/mapper/cr_data
This stores the recovered files from /dev/mapper/cr_data in the directory ~/xfs_undeleted.
# xfs_undelete -o /mnt/external_harddisk /dev/sda3
This stores the recovered files from /dev/sda3 in the directory /mnt/external_harddisk.
# xfs_undelete -t 2020-03-19 /dev/sda3
This ignores files deleted before March 19th, 2020.
# xfs_undelete -t -1hour /dev/sda3
This ignores files deleted more than one hour ago. The -t option accepts all dates understood by Tcl’s [clock scan] command.
# xfs_undelete -i "" -t -2hour /dev/sda3
This recovers all files deleted not more than two hours ago, including "bin" files.
# xfs_undelete -r 'image/*,gimp-*' /dev/sda3
This only recovers files matching any image/ mimetype plus those getting assigned an extension starting with gimp-.
