工具：extundelete
关于ext4 文件系统的知识：/developerworks/cn/linux/l-cn-filesrc5/
一、安装#wgethttp://nchc./project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2
#tar-xvfextundelete-0.2.0.tar.bz2
#cdextundelete-0.2.0
#mkdir/usr/local/extundelete
#./configure--prefix=/usr/local/extundelete
[root@paylm-164extundelete-0.2.0]#./configure--prefix=/usr/local/extundelete
Configuringextundelete0.2.0
configure:error:C++compilercannotcreateexecutables
See`config.log'formoredetails.
[root@paylm-164extundelete-0.2.0]yuminstallgcc-c++.x86_64//安装编译工具包
[root@paylm-164extundelete-0.2.0]./configure--prefix=/usr/local/extundelete
[root@paylm-164extundelete-0.2.0]yum-yinstalle2fsprogs*#如果提示找不到ext2fs库，使用yum-yinstalle2fsprogs*安装
[root@paylm-164extundelete-0.2.0]./configure--prefix=/usr/local/extundelete
[root@paylm-164extundelete-0.2.0]make&&makeinstall
[root@paylm-164extundelete-0.2.0]makeclean
#安装完成。
下面挂载分区作为测试：
三、 恢复被删除去的文件
1. 马上umount 要恢复的文件分区
# umount /mnt1/loop100M
2. 使用extundelete查看分区上存在的文件:
# --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 2 /loop/disk_ 100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Contents of inode 2:
0000 | ed 41 00 00 00 04 00 00 55 db c4 56 49 db c4 56 | .A......U..VI..V
0010 | 49 db c4 56 00 00 00 00 00 00 04 00 02 00 00 00 | I..V............
0020 | 00 00 00 00 01 00 00 00 10 01 00 00 00 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1455741781
Creation time: 1455741769
Modification time: 1455741769
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 4
Blocks count: 2
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name| Inode number | Deleted status
Directory block 272:
.2
.. 2
lost+found11
test 12
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 12 /lo
loop/ lost+found/
2.1 再次搜索inod 12下面的文件
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --inode 12 /loop/disk _100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Contents of inode 12:
0000 | ed 41 00 00 00 04 00 00 5b db c4 56 b4 db c4 56 | .A......[..V...V
0010 | b4 db c4 56 00 00 00 00 00 00 02 00 04 00 00 00 | ...V............
0020 | 00 00 08 00 07 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 b7 0d 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 95 32 29 7e b6 0d 00 00 00 00 00 00 | .....2)~........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1455741787
Creation time: 1455741876
Modification time: 1455741876
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 4
File flags: 524288
File version (for NFS): 2116629141
File ACL: 3510
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 3511, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name| Inode number | Deleted status
Directory block 3511:
.12
.. 2
xaa 13 Deleted
xab 14 Deleted
xac 15 Deleted
3 .恢复inode 为12的文件
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 12 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Unable to restore inode 12 (file.12): No undeleted copies found in the journal.
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 13 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 13 to file RECOVERED_FILES/file.13
[root@paylm-164 /]#
[root@paylm-164 /]#
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 14 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 14 to file RECOVERED_FILES/file.14
[root@paylm-164 /]# /usr/local/extundelete/bin/extundelete --restore-inode 15 /l oop/disk_100M
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 31 descriptors loaded.
Restored inode 15 to file RECOVERED_FILES/file.15
[root@paylm-164 /]#
[root@paylm-164 /]#
[root@paylm-164 /]#
[root@paylm-164 /]# mount -o loop /loop/disk_100M /mnt1/loop100M/
[root@paylm-164 /]# ls /mnt1/loop100M/
lost+found test
4. 查看恢复的文件：
[root@paylm-164 /]# ls RECOVERED_FILES/
file.13 file.14 file.15
跟据恢复过程中的信息，将文件重命名回来，根据橙色的文字对照:
原文件名 -->> inod -->> 恢复后文件名
xaa13 file.13
xab14 file.14
xac15 file.15
#mv file.13 /test/xaa
#mv file.14 /test/xab
#mv file.15 /test/xac
done
如果觉得《linux恢复rm删除文件ext4 EXT4中恢复使用rm命令误删除的文件》对你有帮助，请点赞、收藏，并留下你的观点哦！
