今天发布一篇对Linux系统的Ext4文件系统格式删除文件恢复的博文,希望对有些网友和计算机爱好都有帮助，在工作环境中也是很适用。不过我建议各位最好在系统中建一个目录专用于回收站，以免出现不必要的麻烦，废话少说，我们现在开始。
1.安装软件(extundelete依赖于系统的e2fsprogs三个软件包)
[root@redhat1home]#mkdir/mnt/cdrom –创建光盘挂载目录
[root@redhat1home]#mount/dev/cdrom/mnt/cdrom –挂载光盘mount:blockdevice/dev/sr0iswrite-protected,mountingread-only[root@redhat1home]#vim/etc/yum.repos.d/base.repo–配置系统的本地源
[base]name=basebaseurl=file:///mnt/cdromenabled=1
gpgcheck=1gpgkey=file:///mnt/cdrom/RPM-GPG-KEY-REDHAT-6
[root@redhat1home]#yuminstalle2fs*–安装extundelete软件的依赖包
[root@redhat1home]#rpm-aq|grepe2fs–检查软件包是否安装
e2fsprogs-devel-1.41.12-14.el6.i686e2fsprogs-libs-1.41.12-14.el6.i686e2fsprogs-1.41.12-14.el6.i686
[root@redhat1home]#wget
http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
–下载extundelete软件包
[root@redhat1home]#tarxvfextundelete-0.2.4.tar.bz2–解压软件包
[root@redhat1home]#cdextundelete-0.2.4 –进入软件包
[root@redhat1ext3grep-0.10.2]#./configure–prefix=/usr/local/extundelete make makeinstall–安装软件
[root@redhat1ext3grep-0.10.2]#ll/usr/local/|grepext–查看软件安装成功drwxr-xr-x.3rootroot4096Dec217:24extundelete
[root@redhat1ext3grep-0.10.2]#
2.创建块设备并挂载系统
[root@redhat1home]#ddif=/dev/zeroof=123bs=1Mcount=100–在home目录下新建一个块设备123100+0recordsin100+0recordsout104857600bytes(105MB)copied,0.634943s,165MB/s
[root@redhat1home]#mkfs.ext4123 –格式化块设备
mke2fs1.41.12(17-May-2010)123isnotablockspecialdevice.Proceedanyway?(y,n)y –输入y确定Filesystemlabel=OStype:LinuxBlocksize=1024(log=0)Fragmentsize=1024(log=0)Stride=0blocks,Stripewidth=0blocks25688inodes,102400blocks5120blocks(5.00%)reservedforthesuperuserFirstdatablock=1Maximumfilesystemblocks=6737100813blockgroups8192blockspergroup,8192fragmentspergroup1976inodespergroupSuperblockbackupsstoredonblocks:8193,24577,40961,57345,73729
Writinginodetables:doneCreatingjournal(4096blocks):doneWritingsuperblocksandfilesystemaccountinginformation:done
Thisfilesystemwillbeautomaticallycheckedevery27mountsor180days,whichevercomesfirst.Usetune2fs-cor-itooverride.
[root@redhat1home]#mkdir/mnt/123 –新建块设备挂载的目录
[root@redhat1home]#mount123/mnt/123-oloop–将块设备123挂载到/mnt/123中
[root@redhat1home]#df-TH –查看目录是否挂载FilesystemTypeSizeUsedAvailUse%Mountedon/dev/mapper/VolGroup-lv_rootext420G3.8G16G20%/tmpfstmpfs262M0262M0%/dev/shm/dev/sda1ext4508M32M451M7%/bootdf:`/mnt/cdrom’:Nosuchfileordirectory/dev/sr0iso96603.2G3.2G0100%/mnt/home/123ext4102M5.8M91M7%/mnt/123–设备已挂载
3.添加和删除文件
[root@redhat1home]#cp-a/etc/passwd/etc/shadow/etc/group/mnt/123/–将文件移动到设备中
[root@redhat1~]#ll/mnt/123/ –查看是否有文件
total19-rw-r–r–.1rootroot712Dec214:39groupdrwx——.2rootroot12288Dec414:07lost+found-rw-r–r–.1rootroot1509Dec214:39passwd———-.1rootroot976Dec214:39shadow[root@redhat1home]#sync–文件同步一下
[root@redhat1home]#rm-rf/mnt/123/passwd/mnt/123/shadow–删除文件
[root@redhat1home]#sync–文件同步一下
[root@redhat1home]#umount/mnt/123–卸载设备
4.恢复刚才删除的文件
[root@redhat1bin]# cd/usr/local/extundelete/bin–进入软件目录
[root@redhat1bin]#./extundelete–ls–inode2/home/123–查看块设备/home/123的文件详细信息./extundelete:unrecognizedoption’–ls’NOTICE:Extendedattributesarenotrestored.Loadingfilesystemmetadata…13groupsloaded.Group:0Contentsofinode2:0000|ed41000000040000fec69e5258c79e52|.A………RX..R0010|58c79e52000000000000030002000000|X..R…………0020|00000000050000001001000000000000|…………….0030|00000000000000000000000000000000|…………….0040|00000000000000000000000000000000|…………….0050|00000000000000000000000000000000|…………….0060|00000000000000000000000000000000|…………….0070|00000000000000000000000000000000|…………….
InodeisAllocatedFilemode:16877Low16bitsofOwnerUid:0Sizeinbytes:1024Accesstime:1386137342Creationtime:1386137432Modificationtime:1386137432DeletionTime:0Low16bitsofGroupId:0Linkscount:3Blockscount:2Fileflags:0Fileversion(forNFS):0FileACL:0DirectoryACL:0Fragmentaddress:0Directblocks:272,0,0,0,0,0,0,0,0,0,0,0Indirectblock:0Doubleindirectblock:0Tripleindirectblock:0
Filename|Inodenumber|Deletedstatus.2..2lost+found11passwd12Deleted–Delete就是我们刚才删除的文件shadow13Deletedgroup14[root@redhat1bin]#./extundelete–restore-filepasswd/home/123–用文件名来恢复文件NOTICE:Extendedattributesarenotrestored.Loadingfilesystemmetadata…13groupsloaded.Loadingjournaldescriptors…27descriptorsloaded.Successfullyrestoredfilepasswd –恢复成功
[root@redhat1bin]#./extundelete–restore-inode13/home/123–用节点号来恢复文件NOTICE:Extendedattributesarenotrestored.Loadingfilesystemmetadata…13groupsloaded.Loadingjournaldescriptors…27descriptorsloaded.
[root@redhat1bin]#./extundelete–restore-all/home/123–恢复所有删除的文件NOTICE:Extendedattributesarenotrestored.Loadingfilesystemmetadata…13groupsloaded.Loadingjournaldescriptors…27descriptorsloaded.Searchingforrecoverableinodesindirectory/…2recoverableinodesfound.Lookingthroughthedirectorystructurefordeletedfiles…0recoverableinodesstilllost.[root@redhat1bin]#llRECOVERED_FILES/–查看所有恢复的文件total20drwxr-xr-x.2rootroot4096Dec316:21123-rw-r–r–.1rootroot976Dec414:18file.13-rw-r–r–.1rootroot1509Dec414:16passwd-rw-r–r–.1rootroot1509Dec414:20passwd.v1-rw-r–r–.1rootroot976Dec414:20shadow[root@redhat1bin]#
！！！！！！好了大功告成，也祝大家成功
注明:Linux系统中对Ext3文件系统删除后恢复:http://597011036.blog.51cto.com/6214144/1335821
明天的希望，让我们忘了今天的痛苦
