linux数据恢复软件extunelete安装及实战讲解

一、安装数据恢复软件extundelete

1、安装必要依赖包e2fsprogse2fsprogs-libs

[root@localhost~]# yum -y install e2fsprogs e2fsprogs-libs

2、下载extundelete,地址https://sourceforge.net/projects/extundelete/files/latest/download

3、安装报错解决

[root@localhost~]# tar jxvf extundelete-0.2.4.tar.bz2

[root@localhost~]# cd extundelete-0.2.4/

[root@localhostextundelete-0.2.4]# ./configure

Configuringextundelete 0.2.4

configure:error: Can't find ext2fs library

configure时报错，未找到ext2fslibrary，安装e2fsprogs-libs-devel即可

[root@localhostextundelete-0.2.4]# yum install e2fsprogs-libs-devel

……

Installed:

e2fsprogs-devel.x86_640:1.41.12-22.el6

Complete!

4、重新编译安装extundelete

[root@localhostextundelete-0.2.4]# ./configure

Configuringextundelete 0.2.4

Writinggenerated files to disk

[root@localhostextundelete-0.2.4]# make

make-s all-recursive

Makingall in src

extundelete.cc:571:警告：未使用的参数‘flags’

[root@localhostextundelete-0.2.4]# make install

Makinginstall in src

/usr/bin/install-c extundelete '/usr/local/bin'

[root@localhostextundelete-0.2.4]#

二、extundelete用法详解：

[root@localhost/]# extundelete --help

Usage:extundelete [options] [--] device-file

Options:

--version,-[vV] 显示软件版本号Printversion and exit successfully.

--help, 显示软件帮助信息Printthis help and exit successfully.

--superblock 显示超级块信息Printcontents of superblock in addition to the rest.Ifno action is specified then this option is implied.

--journal 显示日志信息Showcontent of journal.

--afterdtime 时间参数，表示在某段时间之后被删除的数据Onlyprocess entries deleted on or after 'dtime'.

--beforedtime 时间参数，表示在某段时间之前被删除的数据Onlyprocess entries deleted before 'dtime'.

Actions动作有:

--inodeino 显示节点'ino'信息Showinfo on inode 'ino'.

--blockblk 显示数据块'blk'信息Showinfo on block 'blk'.

--restore-inodeino[,ino,...] 恢复命令参数，表示恢复节点“ino”的文件，恢复的文件会自动放在当前

目录下的RECOVERED_FILES文件夹中，使用节点编号作为扩展名

Restorethe file(s) with known inode number 'ino'.Therestored files are created in ./RECOVERED_FILESwiththeir inode number as extension (ie, file.12345).

--restore-file 'path'恢复命令参数，表示恢复指定路径的文件，恢复的文件会自动放在当前

目录下的RECOVERED_FILES文件夹中，使用节点编号作为扩展名

Will restore file 'path'. 'path' is relative to root of the partition and does not start with a '/'

Therestored file is created in the current directoryas 'RECOVERED_FILES/path'.

--restore-files 'path'恢复命令参数，表示恢复在路径中已列出的所有文件

Willrestore files which are listed in the file 'path'.Eachfilename should be in the same format as an option to--restore-file, and there should be one per line.

--restore-directory 'path'恢复命令参数，表示将尝试恢复指定路径下的目录

Willrestore directory 'path'. 'path' is relative to the root directory of the file system. The restored

directoryis created in the output directory as 'path'.

--restore-all 表示将尝试恢复所有目录和文件 Attemptsto restore everything.

-jjournal 表示从已经命名的文件中读取扩展日志 Readsan external journal from the named file.

-bblocknumber表示使用之前备份的超级块来打开文件系统，一般用于查看现有超级块是不是当前索要文件

Usesthe backup superblock at blocknumber when opening the file system.

-Bblocksize通过指定数据块大小来打开文件系统，一般用于查看已经知道大小的文件Usesblocksize as the block size when opening the filesystem. The number should be the number of bytes.

--log0 Make the program silent.

--logfilename Logs all messages to filename.

--logD1=0,D2=filename Custom control of log messages withcomma-separated

Examplesbelow: list of options. Dn must be one of info, warn, or

--loginfo,error error. Omission of the '=name' results in messages

--logwarn=0 with the specified level to be logged to the console.

--logerror=filename If the parameter is '=0', logging for the specifiedlevelwill be turned off. If the parameter is'=filename',messages with that level will be writtentofilename.

-o directory Save the recovered files to the named directory.Therestored files are created in a directory named'RECOVERED_FILES/' by default

三、创建分区，模拟数据误删除环境

1、创建分区，模拟数据误删除环境

[root@localhosttmp]# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 * 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 * 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

[root@localhosttmp]# fdisk /dev/sda

WARNING:DOS-compatible mode is deprecated. It's strongly recommended to

switchoff the mode (command 'c') and change display units to

sectors(command 'u').

Command(m for help): n

Firstcylinder (4106-4178, default 4106):

Usingdefault value 4106

Lastcylinder, +cylinders or +size{K,M,G} (4106-4178, default 4178): +100M

Command(m for help): W

Thepartition table has been altered!

Callingioctl() to re-read partition table.

WARNING:Re-reading the partition table failed with error 16:设备或资源忙.

Thekernel still uses the old table. The new table will be used at

thenext reboot or after you run partprobe(8) or kpartx(8)

Syncingdisks.

[root@localhosttmp]# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 * 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 * 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

/dev/sda6 4106 4119 109964 83 Linux

2、格式化磁盘分区

[root@localhost~]# mount /dev/sda6 /data

mount:you must specify the filesystem type

显示分区未格式化

[root@localhost~]# mkfs -t ext3 -c /dev/sda6

mke2fs1.41.12 (17-May-2010)

mkfs.ext3:inode_size (128) * inodes_count (0) too big for a

filesystemwith 0 blocks, specify higher inode_ratio (-i)

orlower inode count (-N).

3、格式化扩展分区报错解决

格式磁盘时发现如下错误，原因是扩展分区无法格式化，

解决方法是在扩展分区上创建主分区（p）或逻辑分区（l）

[root@localhost~]# fdisk /dev/sda6

Devicecontains neither a valid DOS partition table, nor Sun, SGI or OSFdisklabel

Buildinga new DOS disklabel with disk identifier 0xcbd45cde.

Changeswill remain in memory only, until you decide to write them.

Afterthat, of course, the previous content won't be recoverable.

Warning:invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

WARNING:DOS-compatible mode is deprecated. It's strongly recommended to

switchoff the mode (command 'c') and change display units to

sectors(command 'u').

Command(m for help): p

Disk/dev/sda6: 112 MB, 112603136 bytes

255heads, 63 sectors/track, 13 cylinders

Units= cylinders of 16065 * 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0xcbd45cde

DeviceBoot Start End Blocks Id System

Command(m for help):n

Commandaction

e extended

p primary partition (1-4)

Partitionnumber (1-4): 1

Firstcylinder (1-13, default 1):

Usingdefault value 1

Lastcylinder, +cylinders or +size{K,M,G} (1-13, default 13): 13M

Command(m for help): P

Disk/dev/sda6: 112 MB, 112603136 bytes

255heads, 63 sectors/track, 13 cylinders

Units= cylinders of 16065 * 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0xcbd45cde

DeviceBoot Start End Blocks Id System

/dev/sda6p1 1 13 104391 83 Linux

Command(m for help): W

Thepartition table has been altered!

Callingioctl() to re-read partition table.

WARNING:Re-reading the partition table failed with error 22:无效的参数.

Thekernel still uses the old table. The new table will be used at

thenext reboot or after you run partprobe(8) or kpartx(8)

Syncingdisks.

此处要重启使生效，也可以使用partprobe命令

[root@localhost~]# partprobe

Warning:WARNING: the kernel failed to re-read the partition table on /dev/sda(设备或资源忙). As a result, it may not reflect all of your changes until afterreboot.

Warning:无法以读写方式打开/dev/sr0(只读文件系统)。/dev/sr0已按照只读方式打开。

Error:无效的分区表-/dev/sr0出现递归分区。

[root@localhost~]# fdisk -l

Disk/dev/sda: 34.4 GB, 34359738368 bytes

255heads, 63 sectors/track, 4177 cylinders

Units= cylinders of 16065 * 512 = 8225280 bytes

Sectorsize (logical/physical): 512 bytes / 512 bytes

I/Osize (minimum/optimal): 512 bytes / 512 bytes

Diskidentifier: 0x0003d455

DeviceBoot Start End Blocks Id System

/dev/sda1 * 1 128 1024000 83 Linux

Partition1 does not end on cylinder boundary.

/dev/sda2 128 2040 15360000 83 Linux

/dev/sda3 2040 3825 14336000 83 Linux

/dev/sda4 3825 4178 2833408 5 Extended

/dev/sda5 3825 4106 2252800 82 Linux swap / Solaris

/dev/sda6 4106 4119 109964 83 Linux

[root@localhost~]# mkdir /data

再次格式化，显示格式化成功。

[root@localhost~]# mkfs.ext3 /dev/sda6

mke2fs1.41.12 (17-May-2010)

文件系统标签=

操作系统:Linux

块大小=1024(log=0)

分块大小=1024(log=0)

Stride=0blocks, Stripe width=0 blocks

27552inodes, 109964 blocks

5498blocks (5.00%) reserved for the super user

第一个数据块=1

Maximumfilesystem blocks=67371008

14block groups

8192blocks per group, 8192 fragments per group

1968inodes per group

Superblockbackups stored on blocks:

8193,24577, 40961, 57345, 73729

正在写入inode表:完成

Creatingjournal (4096 blocks):完成

Writingsuperblocks and filesystem accounting information:完成

Thisfilesystem will be automatically checked every 24 mounts or

180days, whichever comes first. Use tune2fs -c or -i to override.

4、挂载磁盘分区

[root@localhost~]# mount /dev/sda6 /data

[root@localhost~]# df -hT

Filesystem Type Size Used Avail Use% Mounted on

/dev/sda2 ext4 15G 8.4G 5.9G 59% /

/dev/sda1 ext4 969M 54M 865M 6% /boot

/dev/sda3 ext4 14G 525M 13G 5% /home

/dev/sr0 iso9660 1.8G 1.8G 0 100% /mnt/iso

share vboxsf 222G 93G 129G 42% /mnt/share

/dev/sda6 ext3 104M 5.6M 94M 6% /data

四、实战：使用extundelete恢复数据

[root@localhost~]# cd /data

[root@localhostdata]# ll

总用量12

drwx------2 root root 12288 3月2409:55 lost+found

前提：模拟在磁盘上添加数据并删除

[root@localhostdata]# cp /etc/passwd /data

[root@localhostdata]# cp /bin/ls /data

[root@localhostdata]# mkdir /data/test

[root@localhostdata]# echo "extundelete test" > /data/test/mytest.txt

[root@localhostdata]# cd /data

[root@localhostdata]# ll

总用量131

drwx------2 root root 12288 3月2409:55 lost+found

-rwxr-xr-x1 root root 117048 3月2410:02 ls

-rw-r--r--1 root root 2044 3月2410:01 passwd

drwxr-xr-x2 root root 1024 3月2410:03 test

[root@localhostdata]# md5sum passwd

265e460e2065cdacdbb70e6af3fbcd57 passwd

[root@localhostdata]# md5sum test/mytest.txt

eb42e4b3f953ce00e78e11bf50652a80 test/mytest.txt

[root@localhostdata]# mkdir /data/lianxi/

[root@localhostdata]# echo "lianxi"> /data/lianxi/lianxi.txt

[root@localhostdata]# ll

总用量132

drwxr-xr-x2 root root 1024 3月2410:06 lianxi

drwx------2 root root 12288 3月2409:55 lost+found

-rwxr-xr-x1 root root 117048 3月2410:02 ls

-rw-r--r--1 root root 2044 3月2410:01 passwd

drwxr-xr-x2 root root 1024 3月2410:03 test

模拟误删磁盘数据

[root@localhostdata]# rm -rf /data/*

[root@localhostdata]# cd ~

以下演示恢复数据

将数据误删后，首先应该卸载该磁盘分区

[root@localhost~]# cd /mnt

[root@localhostmnt]# umount /data

1、使用--inode参数查看可以恢复的数据信息

[root@localhostmnt]# extundelete /dev/sda6 --inode 2

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Group:0

.......

Directblocks: 507, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0

Indirectblock: 0

Doubleindirect block: 0

Tripleindirect block: 0

Filename | Inode number | Deletedstatus

. 2

.. 2

lost+found 11 Deleted

passwd 12 Deleted

ls 13 Deleted

test 17713 Deleted

lianxi 19681 Deleted

[root@localhostmnt]# cd /

2、使用--restore-file恢复单个文件，注意，后面所接路径为相对路径，

即原项为/data/test/mytest,则只需指定为/test/mytesj即可

[root@localhost/]# extundelete /dev/sda6 --restore-file passwd

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Loadingjournal descriptors ... 69 descriptors loaded.

Successfullyrestored file passwd

[root@localhost/]# cd /RECOVERED_FILES/

[root@localhostRECOVERED_FILES]# ls

passwd

使用md5sum校验，检查恢复的数据是否与原数据相同，结果一致

[root@localhostRECOVERED_FILES]# md5sum passwd

265e460e2065cdacdbb70e6af3fbcd57 passwd

3、使用--restore-directory恢复单个目录

[root@localhostRECOVERED_FILES]# extundelete /dev/sda6 --restore-directory /lianxi

NOTICE:Extended attributes are not restored.

Loadingfilesystem metadata ... 14 groups loaded.

Loadingjournal descriptors ... 69 descriptors loaded.

Searchingfor recoverable inodes in directory /lianxi ...

7recoverable inodes found.

Lookingthrough the directory structure for deleted files ...

6recoverable inodes still lost.

[root@localhostRECOVERED_FILES]# ls

passwd RECOVERED_FILES

[root@localhostRECOVERED_FILES]# cd RECOVERED_FILES/

[root@localhostRECOVERED_FILES]# ls

lianxi

4、使用--restore-all恢复所有误删除的数据

[root@localhostRECOVERED_FILES]# cd /mnt</span%

linux数据恢复软件extunelete安装及实战讲解相关推荐

linux下软件的安装[转]
linux下软件的安装先来看看Linux软件扩展名.软件后缀为.rpm最初是Red Hat Linux提供的一种包封装格式,现在许多Linux发行版本都使用:后缀为.deb是Debain Linux ...
Linux下软件的安装与卸载
在Windows下安装软件时,只需运行软件的安装程序(setup.install等)或者用zip等解压缩软件解开即可安装,运行反安装程序(uninstall.unware."卸载" ...
Linux各种软件的安装
Linux各种软件的安装(Ubuntu18.04为例) 1.google浏览器的安装 2.anaconda的安装 3.markdown文档的安装 4.NVIDA,CUDA等的安装 5.WPS的安装 6 ...
达思Linux数据恢复ext破解版,达思Linux数据恢复软件
D-Recovery For Linux是一款专门针对EXT2/EXT3/EXT4文件系统的数据恢复工具. 1.扫描丢失的EXT2/EXT3/EXT4分区,找到以后展开分区数据并可以导出数据. 2.E ...
Linux中软件的安装，vim编辑器
文章目录 Linux中软件的安装,vim编辑器 Linux中软件的安装 vim编辑器在线安装vim编辑器 vim的使用 vim的命令 Linux中软件的安装,vim编辑器 Linux中软件的安装 L ...
Linux常用软件和安装方法,Linux软件安装与卸载常用方法（转）
Linux下软件安装方法总结: 一.rpm包安装方式步骤: 1.找到相应的软件包,比如soft.version.rpm,下载到本机某个目录: 2.打开一个终端,su -成root用户: 3.cd so ...
Linux 笔记 - 第九章 Linux 中软件的安装
博客地址:http://www.moonxy.com 一.前言在 Linux 系统中,应用程序的软件包主要分为两种: 1)第一种是二进制的可执行软件包,也就是解开包后就可以直接运行.在 Window ...
linux系统硬盘数据恢复软件下载,R-Linux|R-Linux(linux数据恢复软件)下载 v5.1中文免费版 - 121下载站...
R-Linux是一款界面简洁实用的linux分区数据恢复工具,这款工具需要运行于windows平台,然后选择linux的相关分区就可以扫描恢复了,支持Ext2.Ext3.Ext4 FS文等文件系统,可 ...
Linux下软件的安装与卸载(命令行模式)
国内较快开源软件镜象站点,包括Debian.Ubuntu.Fedora.Gentoo.Centos.FreeBSD.Eclipse等开源软件的镜象 http://mirrors.163.com,htt ...

linux数据恢复软件extunelete安装及实战讲解

linux数据恢复软件extunelete安装及实战讲解相关推荐

最新文章

热门文章