extundelete
主要是针对ext4
Linux下执行 rm 并不会真正删除，而是将inode节点中的扇区删除，同时释放数据块。在数据块被系统重新分配前，这部分数据还是可以找回来的。
网上说在删除文件后要立即unmount这个分区，这样做其实是为了让外界不再写入，我们也可以设置为readonly模式代替。当然，如果为了不影响其它应用的运行，也可以不做unmount。在系统未将删除文件的 inode分配出去则可以完全恢复
好的，现在就该神器extundelete上场了。以CentOS6.5为例
依赖
yum -y install e2fsprogs e2fsprogs-libs e2fsprogs-devel
安装
wget http://jaist.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar jxvf extundelete-0.2.4.tar.bz2 cd extundelte-0.2.4 ./configure make; make install
2)执行删除操作（要是/根分区之外的分区，并且只能是文件删除后的恢复，目录删除不能恢复）
[root@slave-node ~]# df -T
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sda3 ext4 151189708 2370020 141139688 2% /
tmpfs tmpfs 32960412 0 32960412 0% /dev/shm
/dev/sda1 ext4 198337 26798 161299 15% /boot
/dev/sda2 ext4 806346400 201304 765185096 1% /home
[root@slave-node ~]# cd /home/
[root@slave-node home]# echo "123456"> test1
[root@slave-node home]# echo "hahahahha" > wangshibo
[root@slave-node home]# ls
lost+found test1 wangshibo zabbix
删除文件
[root@slave-node home]# rm -rf test1 wangshibo
[root@slave-node home]# ls
lost+found zabbix
3）数据删除后的恢复操作
首先恢复前，卸载需要恢复文件的分区
[root@slave-node ~]# umount /home/ //如果卸载失败，就用命令"fuser -k /home"结束使用此分区的进程树
[root@slave-node ~]# df -T
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sda3 ext4 151189708 2370024 141139684 2% /
tmpfs tmpfs 32960412 0 32960412 0% /dev/shm
/dev/sda1 ext4 198337 26798 161299 15% /boot
使用extundelete查看分区上存在的文件,如下：
--inode 为查找某i节点中的内容，使用2则说明为搜索，如果需要进入目录搜索，只须要指定目录I节点即可
[root@slave-node ~]# extundelete --inode 2 /dev/sda2
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 6250 groups loaded.
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 84 10 49 58 82 10 49 58 | .A........IX..IX
0010 | 82 10 49 58 00 00 00 00 00 00 04 00 08 00 00 00 | ..IX............
0020 | 00 00 00 00 07 00 00 00 21 24 00 00 00 00 00 00 | ........!$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 00 00 00 00 00 00 00 00 11 10 00 00 00 00 00 00 | ................
0090 | 00 00 00 00 00 00 00 00 62 0e 49 58 62 0e 49 58 | ........b.IXb.IX
00a0 | 62 0e 49 58 00 00 00 00 00 00 00 00 00 00 00 00 | b.IX............
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
Group: 0
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1481183364
Creation time: 1481183362
Modification time: 1481183362
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 4
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
Directory block 9249:
. 2
.. 2
lost+found 11
haha 12 Deleted
zabbix 17432577
test1 12 Deleted
wangshibo 13 Deleted
如上可以看出，被删除的两个文件test1和wangshibo已经被找到，状态为已经删除。
接下来就将它们恢复出来：
[root@slave-node ~]# extundelete --restore-inode 12 /dev/sda2
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 6250 groups loaded.
Loading journal descriptors ... 46 descriptors loaded.
Restored inode 12 to file RECOVERED_FILES/file.12
[root@slave-node ~]# extundelete --restore-inode 13 /dev/sda2
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 6250 groups loaded.
Loading journal descriptors ... 46 descriptors loaded.
Restored inode 13 to file RECOVERED_FILES/file.13
[root@slave-node ~]# ls RECOVERED_FILES/
file.12 file.13
[root@slave-node ~]# mount /dev/sda2 /home/ //重新挂载home分区
[root@slave-node ~]# mv RECOVERED_FILES/file.12 /home/test1
[root@slave-node ~]# mv RECOVERED_FILES/file.13 /home/wangshibo
再次查看home分区，发现删除的文件已经恢复回来了,很强大！！！
[root@slave-node ~]# cd /home/
[root@slave-node home]# ls
lost+found test1 wangshibo zabbix
[root@slave-node home]# cat test1
123456
[root@slave-node home]# cat wangshibo
hahahahha