linux系统rm误删文件恢复 ext4

系统：oracle linux OEL6.5  x64

分区格式：ext4

起因：今天手贱在自己服务器上误操作将/home/ORACLE目录给删除了，结果导致服务全面崩溃
遂谷歌了一把发现了神器 extundelete(如果是ext3文件系统请使用ext3grep,本人未做测试)，这玩意可比瘟得死下面的各种恢复工具强大多了(至少本人是这么认为的)。

关于extundelete这个工具的说明使用,官方网站extundelete.sourceforge.net是这样说的,extundelete是一种实用的工具,可以从ext3或ext4分区恢复被删除的文件,不能保证恢复所有的文件,所以最好能做好备份.它的最新版本是0.2.4 

为什么要用extundelete?

官方这样描述,如果您已经在ext4的文件系统中删除了文件,选extundelete是一个不错的选择,它能够恢复已删除文件的文件名及内容.如果是在ext3的文件系统中删除了文件,extundelete和ext3grep比较仍然有一些优点,extundelete分析日志文件后,能够立即恢复一个文件,ext3grep分析整个硬盘才开始恢复硬盘中的文件,ext3grep方法是是有效的从一个小分区恢复多个文件,所以相比而言,如果需要从一个大的分区中恢复文件,extundelete要快些.

注意:在安装extundelete之前,要确定已经安装了e2fsprogs和e2fslibs(确定e2fsprogs的版本在1.41或者更高版本,可通过运行命令dumpe2fs来查看版本).

一、下载及安装软件
extundelete 主页： http://extundelete.sourceforge.net/
下载地址： http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2   (需 跨墙）
ubuntu用户可直接安装: apt-get install extundelete

# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 
# tar -jxvf extundelete-0.2.4.tar.bz2 
# cd extundelete-0.2.4 
# ./configure --prefix=/usr/local/extundelete 
# make && make install

extundelete  --help  查看有哪些选项  --restore-file 指定恢复文件, --restore-all 恢复全部等等,恢复完成后,恢复的文件就在当前目录下生成的RECOVERED_FILES的目录里.

实测：rm -rf    /home/oracle

[root@rac1 extundelete-0.2.4]# df -Th
Filesystem                   Type   Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root ext4    50G   19G   29G  40% /
tmpfs                        tmpfs  998M   80K  998M   1% /dev/shm
/dev/sda1                    ext4   477M   55M  397M  13% /boot
/dev/mapper/VolGroup-lv_home ext4    28G   44M   26G   1% /home

二、数据恢复
    1.卸载需要恢复文件的分区
[root@rac1 extundelete-0.2.4]# fuser -k ?home           <-- 结束使用某分区的进程树
[root@rac1 extundelete-0.2.4]# umount /home                 <-- 卸载分区

2.使用extundelete查看分区上存在的文件

[root@rac1 extundelete-0.2.4]# extundelete --inode 2 /dev/mapper/VolGroup-lv_home      
 # --inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 221 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 74 85 fe 53 72 85 fe 53 | .A......t..Sr..S
0010 | 72 85 fe 53 00 00 00 00 00 00 03 00 08 00 00 00 | r..S............
0020 | 00 00 08 00 02 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 11 24 00 00 | .............$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 cc 8f 32 d4 cc 8f 32 d4 1c 8c d6 9d | ......2...2.....
0090 | d1 21 ea 53 00 00 00 00 00 00 00 00 00 00 02 ea | .!.S............
00a0 | 07 06 3c 00 00 00 00 00 21 00 00 00 00 00 00 00 | ..<.....!.......
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux.........
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 73 79 73 74 | ............syst
00e0 | 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f 72 3a 68 6f | em_u:object_r:ho
00f0 | 6d 65 5f 72 6f 6f 74 5f 74 3a 73 30 00 00 00 00 | me_root_t:s0....

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1409189236
Creation time: 1409189234
Modification time: 1409189234
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9233, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
oracle                                            523265         Deleted

被删除的oracle文件夹已经被找到，状态为已经删除，接下来就将它们恢复出来。

[root@rac1 Desktop]# extundelete --restore-all  /dev/mapper/VolGroup-lv_home  # --restore-all是全部恢复 ，默认全将恢复出来的文件放在当前路径 RECOVERED_FILES/ 目录下，文件名为 file.I节点号
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 221 groups loaded.
Loading journal descriptors ... 3108 descriptors loaded.
Searching for recoverable inodes in directory / ... 
3576 recoverable inodes found.
Looking through the directory structure for deleted files ... 
0 recoverable inodes still lost.

[root@rac1 Desktop]# ls RECOVERED_FILES/
lost+found  oracle
[root@rac1 Desktop]# mount /home
[root@rac1 Desktop]# df -Th
Filesystem                   Type   Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root ext4    50G   21G   26G  45% /
tmpfs                        tmpfs  998M   80K  998M   1% /dev/shm
/dev/sda1                    ext4   477M   55M  397M  13% /boot
/dev/mapper/VolGroup-lv_home ext4    28G   44M   26G   1% /home
[root@rac1 Desktop]# mv RECOVERED_FILES/oracle /home

[root@rac1 Desktop]# df -Th
Filesystem                   Type   Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root ext4    50G   19G   29G  40% /
tmpfs                        tmpfs  998M   80K  998M   1% /dev/shm
/dev/sda1                    ext4   477M   55M  397M  13% /boot
/dev/mapper/VolGroup-lv_home ext4    28G  2.6G   24G  10% /home

至此2.6G的数据恢复完毕。

恢复之后，权限不一致的，别忘了授权。

[root@rac1 ~]# chmod -R 777   /home/oracle 

验证数据是否可用：

[root@rac1 home]# su oracle
[oracle@rac1 home]$ db11g

SQL*Plus: Release 11.2.0.3.0 Production on Thu Aug 28 14:09:49 2014


Copyright (c) 1982, 2011, Oracle.  All rights reserved.


Connected to an idle instance.


SQL> 搞定！