Linux恢复删除后数据文件

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

简介

在使用Linux系统时，有时候会不小心误删除数据，由于Linux系统也没有与Windows系统下回收站类似的功能，一般会认为该文件将无法找回。

本文主要以CentOS7操作系统为例，介绍如何使用开源工具Extundelete快速恢复被误删除掉的数据。

原理

在Linux下，基于开源的数据恢复工具有很多，常见的有debugfs、R-Linux、ext3grep、extundelete等，比较常用的有ext3grep和extundelete，这两个工具的恢复原理基本一样，只是extundelete功能更加强大。

Extundelete是基于linux的开源数据恢复软件，能够利用inode信息结合日志去查询该inode所在的block位置，以次来查找和恢复所需的数据，该工具最给力的一点就是支持ext3/ext4双格式分区恢复，基于整个磁盘的恢复功能较为强大。

在数据被误删除后，第一时间要做的是卸载被删除数据所在的磁盘或磁盘分区。因为将文件删除后，仅仅是将文件的inode结点中的扇区指针清零，实际文件还存储在磁盘上，如果磁盘以读写模式挂载，这些已删除的文件的数据块就可能被操作系统重新分配出去，在这些数据块被新的数据覆盖后，这些数据就真的丢失了，恢复工具也回力无天。所以，以只读模式挂载磁盘可以尽量降低数据块中数据被覆盖的风险，以提高恢复数据成功的几率。

在实际线上恢复过程中，切勿将extundelete安装到您误删的文件所在硬盘，这样会有一定几率将需要恢复的数据彻底覆盖，切记操作前做好快照备份。

安装依赖包

yum -y install  bzip2  e2fsprogs-devel  e2fsprogs  gcc-c++  make

部署extundelete工具

wget  http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2

tar -xvjf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4                                #进入程序目录

./configure                                         #如下图表示安装成功

make && make install

默认文件安装在usr/local/bin

创建文件

[root@ecs-prod-wiki extundelete-0.2.4]# mkdir /testDeleteFile

[root@ecs-prod-wiki extundelete-0.2.4]# cd /testDeleteFile

[root@ecs-prod-wiki testDeleteFile]#  touch helloWorld.txt

[root@ecs-prod-wiki testDeleteFile]# echo "hello world" > helloWorld.txt

[root@ecs-prod-wiki testDeleteFile]# cat helloWorld.txt

hello world

记录文件的md5值

md5sum helloWorld.txt

6f5902ac237024bdd0c176cb93063dc4  helloWorld.txt

删除文件

[root@ecs-prod-wiki testDeleteFile]# rm helloWorld.txt  -f

离开磁盘

[root@ecs-prod-wiki testDeleteFile]# cd

[root@ecs-prod-wiki ~]#

卸载磁盘

结束使用某分区的进程树，保证磁盘没进程使用

[root@ecs-prod-wiki ~]# fuser -k /testDeleteFile/

[root@ecs-prod-wiki ~]#

卸载磁盘

[root@ecs-prod-wiki ~]# umount /dev/vdb

[root@ecs-prod-wiki ~]#

任何的文件恢复工具，在使用前，均要将要恢复的分区卸载或挂载为只读，防止数据被覆盖使用

使用Extundelete工具恢复文件

查找删除的文件

[root@ecs-prod-wiki ~]# extundelete --inode 2 /dev/vdb

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 160 groups loaded.

Group: 0

Contents of inode 2:

0000 | ed 41 00 00 00 10 00 00 74 bd 89 5c 23 be 89 5c | .A......t..\#..\

0010 | 23 be 89 5c 00 00 00 00 00 00 03 00 08 00 00 00 | #..\............

0020 | 00 00 08 00 0a 00 00 00 0a f3 01 00 04 00 00 00 | ................

0030 | 00 00 00 00 00 00 00 00 01 00 00 00 21 24 00 00 | ............!$..

0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

0080 | 1c 00 00 00 c8 05 c3 b3 c8 05 c3 b3 ac 60 11 00 | .............`..

0090 | 0a bc 89 5c 00 00 00 00 00 00 00 00 00 00 00 00 | ...\............

00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated

File mode: 16877

Low 16 bits of Owner Uid: 0

Size in bytes: 4096

Access time: 1552530804

Creation time: 1552530979

Modification time: 1552530979

Deletion Time: 0

Low 16 bits of Group Id: 0

Links count: 3

Blocks count: 8

File flags: 524288

File version (for NFS): 0

File ACL: 0

Directory ACL: 0

Fragment address: 0

Direct blocks: 127754, 4, 0, 0, 1, 9249, 0, 0, 0, 0, 0, 0

Indirect block: 0

Double indirect block: 0

Triple indirect block: 0

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11

helloWorld.txt                                    12             Deleted

为查找某i节点中的内容，使用2则说明为整个分区搜索，如果需要进入目录搜索，只须要指定目录I节点即可。这是可以看到删除的文件名和inode

恢复文件

[root@ecs-prod-wiki ~]# /usr/local/bin/extundelete  --restore-inode 12  /dev/vdb

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 160 groups loaded.

Loading journal descriptors ... 58 descriptors loaded.

此时会在执行命令的同级目录下出现RECOVERED_FILES目录，查看是否恢复。

[root@ecs-prod-wiki ~]# ll RECOVERED_FILES/

总用量 4

-rw-r--r-- 1 root root 12 3月  14 10:42 file.12

通过md5值查看文件是否一样

[root@ecs-prod-wiki ~]# md5sum RECOVERED_FILES/file.1

6f5902ac237024bdd0c176cb93063dc4  RECOVERED_FILES/file.12  ## helloWorld.txt文件的md5值请参阅 3.3.4节，其具体值为:  6f5902ac237024bdd0c176cb93063dc4  helloWorld.txt