extundelete基于linux的开源数据恢复软件，
xtundelete能够利用inode信息结合日志去查询该inode所在的block位置，以次来查找和恢复所需的数据，该工具最给力的一点就是支持ext3/ext4双格式分区恢复，基于整个磁盘的恢复功能较为强大
实验环境
centos-5.5
实验软件
e2fsprogs e2fsprogs-devel
extundelete-0.2.0.tar.bz2
软件安装
yum -y install e2fsprogs e2fsprogs-devel
tar jxf extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0 && ./configure && make && make install
软件使用
extundelete /dev/sdb7 --restore-all 恢复分区
extundelete /dev/sdb7 --restore-file /file1.txt 恢复某一个文件
测试
fdisk -l
Disk /dev/sdb: 21.4 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 1460 11727418+ 83 Linux
/dev/sdb2 1461 2610 9237375 5 Extended
mkdir file
mount /dev/sdb1 file
cd file
touch aa.txt bb.txt cc.txt
rm -rf file/*
umount /dev/sdb1
extundelete /dev/sdb1 --restore-all 测试恢复分区
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 90 groups loaded.
Loading journal descriptors ... 19 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ...
1 recoverable inodes found.
Looking through the directory structure for deleted files ...
Failed to restore inode 11 to file RECOVERED_FILES/lost+found:Inode does not correspond to a regular file.
0 recoverable inodes still lost.
Disk /dev/sdb: 21.4 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 1460 11727418+ 83 Linux
/dev/sdb2 1461 2610 9237375 5 Extended
extundelete /dev/sdb1 --restore-file /aa.txt 测试恢复文件
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
Loading filesystem metadata ... 90 groups loaded.
Loading journal descriptors ... 19 descriptors loaded.
Unable to restore inode 48961 (aa.txt): No undeleted copies found in the journa