linux_文件删除的恢复（rm -rf *）
文件删除，需要进行恢复。
1. lsof
文件刚刚被删除，想要恢复，先尝试lsof.
#lsof |grep data.file1
# cp /proc/xxx/xxx/xx /dir/data.file1
2.
如果lsof不能看到文件，那么就需要使用恢复软件进行恢复。
要做的第一件事是立刻卸载被误删除文件所在的分区，或者重新以只读方式挂载此分区。
umount /dev/part 或 mount -o remount,ro /dev/part
删除一个文件，就是将文件inode(inode 是操作系统寻找文件的目录，起到索引作用)
节点中的扇区指针清除，同时，释放这些数据对应的数据块，
而真实的文件还存留在磁盘分区中。但是这些被删除的文件不一定会一直存留在磁盘中，当这些
释放的数据块被操作系统重新分配时，这些被删除的数据就会被覆盖。因此要立刻卸载分区。
3. ext3grep
该工具只能用于ext3文件系统，操作步骤不详细介绍.
1> unmount /dev/part
2> ext3grep /dev/part --ls --inode 2 ##列出可恢复文件信息
3>ext3grep /dev/part --restore-inode N
4>恢复到 RESTORED_FILES/
更多命令查看 ext3grep --help
4. extundelete
该工具可以恢复ext3,ext4. http://extundelete.sourceforge.net/
1>fuser -k /dev/part && unmunt /dev/part
2>extundelete --inode 2 /dev/part
3>extundelete --restore-inode 13 /dev/part
4>恢复到 RECOVERD_FILES/
root@grid1 ~]# extundelete --help
Usage: extundelete [options] [--] device-file
Options:
--version, -[vV] Print version and exit successfully.
--help, Print this help and exit successfully.
--superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
--journal Show content of journal.
--after dtime Only process entries deleted on or after 'dtime'.
--before dtime Only process entries deleted before 'dtime'.
Actions:
--inode ino Show info on inode 'ino'.
--block blk Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/'
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-directory 'path'
Will restore directory 'path'. 'path' is relative to the
root directory of the file system. The restored
directory is created in the output directory as 'path'.
--restore-all Attempts to restore everything.
-j journal Reads an external journal from the named file.
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize Uses blocksize as the block size when opening the file
system. The number should be the number of bytes.
--log 0 Make the program silent.
--log filename Logs all messages to filename.
--log D1=0,D2=filename Custom control of log messages with comma-separated
Examples below: list of options. Dn must be one of info, warn, or
--log info,error error. Omission of the '=name' results in messages
--log warn=0 with the specified level to be logged to the console.
--log error=filename If the parameter is '=0', logging for the specified
level will be turned off. If the parameter is
'=filename', messages with that level will be written
to filename.
-o directory Save the recovered files to the named directory.
The restored files are created in a directory
named 'RECOVERED_FILES/' by default.
看上面的命令就很容易理解，各个参数的作用。
5.note
1> 对于空文件，不会进行恢复
2> 可以恢复mysql表， 由于myisam是单独3个文件，恢复出来就能使用。
3> 建议innodb，设置innodb_file_per_table 为 ON，这样也就能恢复单表数据。
4> 从上面可以看出，恢复工具这能恢复分区，所以，建议为应用软件单独划区进行安装，
存放数据。