1. 程式人生 > >使用extundelete恢復測試liunx的刪除檔案

使用extundelete恢復測試liunx的刪除檔案

環境:rhel6.5
給虛擬主機新增一塊磁碟,磁碟為/dev/vdb 格式化ext4格式,因為它恢復只支援ext2,3,4等格式
[[email protected] ~]# mount /dev/vdb /mnt/disk/
[[email protected] ~]# cd /mnt/disk/
[[email protected] disk]# cd lost+found/
在當磁碟下cop點東西
[[email protected] lost+found]# ls
boke
工具安裝部署
官方網站是http://extundelete.sourceforge.net/ ,其目前的穩定版本是extundelete-0.2.4.
編譯:
[

[email protected] ~]#yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
[[email protected] ~]#tar -jxvf extundelete-0.2.4.tar.bz2
[[email protected] ~]#cd extundelete-0.2.4
[[email protected] ~]#./configure
[[email protected] ~]#make && make install
驗證安裝結果
[[email protected]
~]#extundelete -v
[[email protected] lost+found]# extundelete /dev/vdb --inode 2
#掃描
. 2
.. 2
#最後幾行lost+found 11
boke 131073 Deleted
[[email protected] lost+found]# extundelete /dev/vdb --restore-directory boke
[[email protected] lost+found]# ls #生成資料夾
RECOVERED_FILES
[[email protected] lost+found]# cd RECOVERED_FILES/
[
[email protected]
RECOVERED_FILES]# ls #檢視
boke book
先恢復檔案(可根據檔名進行恢復):

extundelete /dev/sdb --restore-file

恢復目錄(根據目錄名恢復):

extundelete /dev/sdb --restore-directory

總結:可用但不理想,恢復檔案不是源目錄而是自動排列,二次掃描恢復就不行了