Linux防删除，恢复删除

1，设置文件、目录不可修改和删除

## 1,文件不可改 && 不可删
# append only (a), immutable (i), no atime updates (A)
[root@cdh-node1 vagrant]# chattr +i /etc/passwd /etc/shadow
[root@cdh-node1 vagrant]# lsattr /etc/shadow /etc/passwd
----i--------e- /etc/shadow
----i--------e- /etc/passwd

[root@cdh-node1 vagrant]# useradd test1
useradd: cannot open /etc/passwd
[root@cdh-node1 vagrant]# echo 123 |passwd root --stdin 
Changing password for user root.
passwd: Authentication token manipulation error

[root@cdh-node1 vagrant]# rm -f /etc/passwd /etc/shadow
rm: cannot remove `/etc/passwd': Operation not permitted
rm: cannot remove `/etc/shadow': Operation not permitted


## 2,目录不可改 && 不可删
[root@cdh-node1 vagrant]# chattr -R +i /etc/ssh/ /root/.ssh/

[root@cdh-node1 vagrant]# ssh-keygen -t rsa -P "" -f ~/.ssh/id_rsa
Generating public/private rsa key pair.
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
open /root/.ssh/id_rsa failed: Permission denied.
Saving the key failed: /root/.ssh/id_rsa.

[root@cdh-node1 vagrant]# sed -i 2d /etc/ssh/sshd_config 
sed: couldn't open temporary file /etc/ssh/sedsPF0hP: Permission denied

2，ext3, ext4文件系统： extundelete （找回删除：可能丢失）

工具简介：http://extundelete.sourceforge.net/

# 1,从elel仓库安装
yum -y install epel-release
yum -y install extundelete

# 2,测试恢复删除
## 环境准备
[root@cdh-node1 data2]# df -hT
Filesystem     Type   Size  Used Avail Use% Mounted on
/dev/sda1      ext4    40G   29G  9.1G  76% /
tmpfs          tmpfs  2.8G  8.0K  2.8G   1% /dev/shm
cm_processes   tmpfs  2.9G  6.7M  2.9G   1% /opt/cm-5.12.2/run/cloudera-scm-agent/process
/dev/sdb1      ext4   988M  1.3M  935M   1% /data2
[root@cdh-node1 data2]# ls /data2 -R
/data2:
9.txt  d1  d2  seq.txt

/data2/d1:
a.txt

/data2/d2:
a.txt
[root@cdh-node1 data2]# rm -rf /data2/*
[root@cdh-node1 data2]# ls /data2/


## a,卸载该磁盘设备
[root@cdh-node1 data2]# cd
[root@cdh-node1 ~]# sync; umount /data2/
[root@cdh-node1 ~]# df -hT
Filesystem     Type   Size  Used Avail Use% Mounted on
/dev/sda1      ext4    40G   29G  9.1G  76% /
tmpfs          tmpfs  2.8G  8.0K  2.8G   1% /dev/shm
cm_processes   tmpfs  2.9G  6.7M  2.9G   1% /opt/cm-5.12.2/run/cloudera-scm-agent/process

### b1,恢复单个被删的文件(可能失败)
[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-file 9.txt
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 9 groups loaded.
Loading journal descriptors ... 50 descriptors loaded.
Unable to restore inode 21 (9.txt): No undeleted copies found in the journal.
Unable to restore file 9.txt
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
[root@cdh-node1 ~]# ls
RECOVERED_FILES
[root@cdh-node1 ~]# ls RECOVERED_FILES/

[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-file seq.txt
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 9 groups loaded.
Loading journal descriptors ... 50 descriptors loaded.
Successfully restored file seq.txt
[root@cdh-node1 ~]# ls RECOVERED_FILES/
d1  seq.txt
[root@cdh-node1 ~]# ls RECOVERED_FILES/seq.txt 
RECOVERED_FILES/seq.txt
[root@cdh-node1 ~]# cat RECOVERED_FILES/seq.txt
seq

### b2,恢复某个被删的目录
[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-directory d1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 9 groups loaded.
Loading journal descriptors ... 50 descriptors loaded.
Searching for recoverable inodes in directory d1 ... 
5 recoverable inodes found.
Looking through the directory structure for deleted files ... 
4 recoverable inodes still lost.
[root@cdh-node1 ~]# ls RECOVERED_FILES/
d1
[root@cdh-node1 ~]# ls RECOVERED_FILES/d1/
a.txt
[root@cdh-node1 ~]# ls RECOVERED_FILES/d1/a.txt 
RECOVERED_FILES/d1/a.txt
[root@cdh-node1 ~]# cat RECOVERED_FILES/d1/a.txt
d1.txt

### b3,恢复所有删除的数据
[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 9 groups loaded.
Loading journal descriptors ... 50 descriptors loaded.
Searching for recoverable inodes in directory / ... 
5 recoverable inodes found.
Looking through the directory structure for deleted files ... 
0 recoverable inodes still lost.
[root@cdh-node1 ~]# ls RECOVERED_FILES/
d1  d2  seq.txt  seq.txt.v1
[root@cdh-node1 ~]# ls RECOVERED_FILES/d2
a.txt
[root@cdh-node1 ~]# ls RECOVERED_FILES/d2/a.txt 
RECOVERED_FILES/d2/a.txt
[root@cdh-node1 ~]# cat RECOVERED_FILES/d2/a.txt
d2.txt

3，xfs 文件系统：xfsdump,xfsrestore （增量备份：数据一致)

yum -y install xfsdump  #base仓库中有

[root@iris2 /]# du -hs /data2/
2.7G	/data2/
[root@iris2 /]# awk '{print FILENAME,NF,$0}' *.txt
a2.txt 1 1234
a.txt 1 123

# 1,备份xfs文件目录(第一次：全量备份)
[root@iris2 /]# xfsdump -f dump_data2_full /data2 -L fulldump -M sdb2 
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and control
xfsdump: level 0 dump of iris2:/data2
xfsdump: dump date: Wed Apr 29 10:50:02 2020
xfsdump: session id: b2038b69-0728-4f3c-9d5c-d1d280e6a16a
xfsdump: session label: "fulldump"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: skipping (no pruning necessary)
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 2855133824 bytes
xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 2850312592 bytes
xfsdump: dump size (non-dir files) : 2847706232 bytes
xfsdump: dump complete: 5 seconds elapsed
xfsdump: Dump Summary:
xfsdump:   stream 0 /dump_data2_full OK (success)
xfsdump: Dump Status: SUCCESS

# 2,备份xfs文件目录(第二次：增量备份,level=1)
[root@iris2 /]# cp a.txt /data2
[root@iris2 /]# xfsdump -f dump_data2_l1 /data2 -L l1_dump -M sdb2 -l 1
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and control
xfsdump: level 1 incremental dump of iris2:/data2 based on level 0 dump begun Wed Apr 29 10:50:02 2020
xfsdump: dump date: Wed Apr 29 10:50:51 2020
xfsdump: session id: 9762554a-1ae4-4fba-88f3-6b4d2a9eb980
xfsdump: session label: "l1_dump"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: pruning unneeded subtrees
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 25216 bytes
xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 22232 bytes
xfsdump: dump size (non-dir files) : 544 bytes
xfsdump: dump complete: 0 seconds elapsed
xfsdump: Dump Summary:
xfsdump:   stream 0 /dump_data2_l1 OK (success)
xfsdump: Dump Status: SUCCESS


# 3,备份xfs文件目录(第三次：增量备份,level=2)
[root@iris2 /]# cp a2.txt /data2
[root@iris2 /]# xfsdump -f dump_data2_l2 /data2 -L l2_dump -M sdb2 -l 2
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and control
xfsdump: level 2 incremental dump of iris2:/data2 based on level 1 dump begun Wed Apr 29 10:50:51 2020
xfsdump: dump date: Wed Apr 29 10:51:17 2020
xfsdump: session id: bfed98bc-fc24-4b57-b5d2-c2d7f55fda55
xfsdump: session label: "l2_dump"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: pruning unneeded subtrees
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 25216 bytes
xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 22264 bytes
xfsdump: dump size (non-dir files) : 544 bytes
xfsdump: dump complete: 0 seconds elapsed
xfsdump: Dump Summary:
xfsdump:   stream 0 /dump_data2_l2 OK (success)
xfsdump: Dump Status: SUCCESS

# 4,查看备份文件的大小
[root@iris2 /]# ll -h dump_data2_*
-rw-r--r--. 1 root root 2.7G Apr 29 10:50 dump_data2_full
-rw-r--r--. 1 root root  22K Apr 29 10:50 dump_data2_l1
-rw-r--r--. 1 root root  22K Apr 29 10:51 dump_data2_l2

# 5，删除原来的数据，测试恢复
[root@iris2 /]# rm -rf /opt/*
[root@iris2 /]# ls /opt/*
ls: cannot access /opt/*: No such file or directory
[root@iris2 /]# ls /opt/
[root@iris2 /]# 
[root@iris2 /]# xfsrestore -f dump_data2_full /data2/
xfsrestore: using file dump (drive_simple) strategy
xfsrestore: version 3.1.7 (dump format 3.0) - type ^C for status and control
xfsrestore: searching media for dump
xfsrestore: examining media file 0
xfsrestore: dump description: 
xfsrestore: hostname: iris2
xfsrestore: mount point: /data2
xfsrestore: volume: /dev/sdb2
xfsrestore: session time: Wed Apr 29 10:50:02 2020
xfsrestore: level: 0
xfsrestore: session label: "fulldump"
xfsrestore: media label: "sdb2"
xfsrestore: file system id: 535a1e95-5f9a-4208-b675-969996840f45
xfsrestore: session id: b2038b69-0728-4f3c-9d5c-d1d280e6a16a
xfsrestore: media id: aaadc3f5-7e8b-4ecf-8299-20f812579be7
xfsrestore: using online session inventory
xfsrestore: searching media for directory dump
xfsrestore: reading directories
xfsrestore: 299 directories and 3841 entries processed
xfsrestore: directory post-processing
xfsrestore: restoring non-directory files
lxfsrestore: restore complete: 4 seconds elapsed
xfsrestore: Restore Summary:
xfsrestore:   stream 0 /dump_data2_full OK (success)
xfsrestore: Restore Status: SUCCESS
[root@iris2 /]# ls /data2
a.txt  a2.txt  iris
[root@iris2 /]# cat /data2/a2.txt 
1234