恢复误删除的文件(xfs文件系统)

误操作，不小心删除了多年的技术文档，于是乎想尽一切办法抢救，才有了此篇记录

误删除文件所在分区是Centos7.9 xfs

需要借助 xfs_undelete 工具

官方文档在这里：https://github.com/ianka/xfs_undelete

准备工作

Linux环境需要安装以下工具

tcl >= 8.6
tcllib

tcl 源码包

https://core.tcl-lang.org/tcl/info/00748475834c4942

下载解压，cd unix

./configure
make && make install
ln -s /usr/local/bin/tclsh8.7 /usr/bin/tclsh

tclsh
% info tclversion
8.7
% info patchlevel


# 如果 yum源有包切符合版本要求，直接通过yum安装
yum install tcl tcl-dev tcllib

or

apt install tcl tcl-dev tcllib

准备恢复目录

# 我在其他磁盘新建一个目录，与原数据盘区别开

mkdir -p /mnt/1t_path/recovery_date
ntfs-3g /dev/sdc1 /mnt/1t_path/recovery_date

需要扫描的磁盘是 /dev/sdd5 ，恢复后的数据保存在 sdc1 /1t_path/recovery_date路径下

目前 /dev/sdd5 磁盘仅仅通电，并没有挂载，也是为了避免复写，提高恢复概率

xfs_undelete 下载

https://github.com/ianka/xfs_undelete/releases

# 解压
tar xf xfs_undelete-11.0.tar.gz
cd xfs_undelete-11.0

# 恢复命令

./xfs_undelete -t -48hour -o /recovery_dir /dev/<disk-partiation>

./xfs_undelete -t 2022-06-04 -o /mnt/1t_path/recovery_date /dev/sdd5

等待扫描完成，扫描恢复后的文件在 /mnt/1t_path/recovery_date 目录下


# 官方文档还有更多使用方法
https://github.com/ianka/xfs_undelete



EXAMPLES
# cd ~ ; xfs_undelete /dev/mapper/cr_data

This stores the recovered files from /dev/mapper/cr_data in the directory ~/xfs_undeleted.

# xfs_undelete -o /mnt/external_harddisk /dev/sda3

This stores the recovered files from /dev/sda3 in the directory /mnt/external_harddisk.

# xfs_undelete -t 2020-03-19 /dev/sda3

This ignores files deleted before March 19th, 2020.

# xfs_undelete -t -1hour /dev/sda3

This ignores files deleted more than one hour ago. The -t option accepts all dates understood by Tcl’s [clock scan] command.

# xfs_undelete -i "" -t -2hour /dev/sda3

This recovers all files deleted not more than two hours ago, including "bin" files.

# xfs_undelete -r 'image/*,gimp-*' /dev/sda3

This only recovers files matching any image/ mimetype plus those getting assigned an extension starting with gimp-.