Nov
13
1.问题
因误操作,把磁盘中部分的文件删除了,需要进行恢复。
※ 注意:
在进行恢复前,不要对需要恢复的分区进行写入的操作。
如果分区在单独的磁盘上,应该把该磁盘卸载后,进行修复。(非 mount 状态)
如果分区与根分区在同一个磁盘上,那么,可以把分区挂载为 ro 只读状态;
如果需要修复的就是根分区所在的分区,那么,只能把机器关闭后,把磁盘挂载到其他的机器上进行修复。
◎ 修复的原理:
通过遍历文件系统的 journal ,找到对应的 inode 位置,然后组成正常的文件。
所以,若使用 mkfs.ext4 等格式化的磁盘,superblock 全部被刷写,则是无法修复的。
2.解决
通过 extundelete 工具可以进行尝试修复。
安装需要编译,编译前应安装 e2fsprogs-devel 软件包以及 gcc 等编译工具。
解压后,执行./configure 和 make install
然后对指定的分区进行扫描即可:
若能找到误删除的文件,所有恢复的文件默认会放在当前目录的 RECOVERED_FILES 目录中,需要注意可用磁盘的大小。
若能准确知道需要进行恢复文件的删除时间,可以考虑加入 --after 参数:
恢复时,还可以指定 inode、文件路径、目录等参数:
对应 superblock 部分损坏的情况,可以另外指定 backup superblock 位置进行修复:
3.参考文档
undelete a just deleted file on ext4 with extundelete
http://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete
undelete 官网
http://extundelete.sourceforge.net/
undelete 源码:
extundelete-0.2.4.tar.bz2
因误操作,把磁盘中部分的文件删除了,需要进行恢复。
※ 注意:
在进行恢复前,不要对需要恢复的分区进行写入的操作。
如果分区在单独的磁盘上,应该把该磁盘卸载后,进行修复。(非 mount 状态)
如果分区与根分区在同一个磁盘上,那么,可以把分区挂载为 ro 只读状态;
mount -o remount,ro /dev/sdX1
如果需要修复的就是根分区所在的分区,那么,只能把机器关闭后,把磁盘挂载到其他的机器上进行修复。
◎ 修复的原理:
通过遍历文件系统的 journal ,找到对应的 inode 位置,然后组成正常的文件。
所以,若使用 mkfs.ext4 等格式化的磁盘,superblock 全部被刷写,则是无法修复的。
2.解决
通过 extundelete 工具可以进行尝试修复。
安装需要编译,编译前应安装 e2fsprogs-devel 软件包以及 gcc 等编译工具。
解压后,执行./configure 和 make install
然后对指定的分区进行扫描即可:
[root@demo ~]# extundelete --restore-all /dev/vdc1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Loading journal descriptors ... 25677 descriptors loaded.
Searching for recoverable inodes in directory / ...
57192 recoverable inodes found.
Looking through the directory structure for deleted files ...
1 recoverable inodes still lost.
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Loading journal descriptors ... 25677 descriptors loaded.
Searching for recoverable inodes in directory / ...
57192 recoverable inodes found.
Looking through the directory structure for deleted files ...
1 recoverable inodes still lost.
若能找到误删除的文件,所有恢复的文件默认会放在当前目录的 RECOVERED_FILES 目录中,需要注意可用磁盘的大小。
若能准确知道需要进行恢复文件的删除时间,可以考虑加入 --after 参数:
# extundelete --restore-all --after $(($(date +%s) - 7200)) /dev/sdX1
恢复时,还可以指定 inode、文件路径、目录等参数:
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/'
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-directory 'path'
Will restore directory 'path'. 'path' is relative to the
root directory of the file system. The restored
directory is created in the output directory as 'path'.
--restore-all Attempts to restore everything.
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/'
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-directory 'path'
Will restore directory 'path'. 'path' is relative to the
root directory of the file system. The restored
directory is created in the output directory as 'path'.
--restore-all Attempts to restore everything.
对应 superblock 部分损坏的情况,可以另外指定 backup superblock 位置进行修复:
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
the file system.
3.参考文档
undelete a just deleted file on ext4 with extundelete
http://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete
undelete 官网
http://extundelete.sourceforge.net/
undelete 源码:
extundelete-0.2.4.tar.bz2
alexwwf
2016/12/19 08:48
好文章,可以指望这个东东去做数据恢复,收钱了
分页: 1/1 1