linux实现数据恢复 extundelete
extundelete，可以实现对ext3 ext4等基于Linux分区的数据修复
试验环境
centos-5.5
实验软件
e2fsprogs e2fsprogs-devel
extundelete-0.2.0.tar.bz2
软件安装
yum -y install e2fsprogs e2fsprogs-devel
tar jxf extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0
./configure
make
make install
使用方法
extundelete /dev/sdb7 --restore-all 恢复分区
extundelete /dev/sdb7 --restore-file /file1.txt 恢复某一个文件
测试
fdisk -l
Disk /dev/sdb: 21.4 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 1460 11727418+ 83 Linux
/dev/sdb2 1461 2610 9237375 5 Extended
mkdir file
mount /dev/sdb1 file
cd file
touch aa.txt bb.txt cc.txt
rm -rf file/*
umount /dev/sdb1
extundelete /dev/sdb1 --restore-all 测试恢复分区
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 90 groups loaded.
Loading journal descriptors ... 19 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ...
1 recoverable inodes found.
Looking through the directory structure for deleted files ...
Failed to restore inode 11 to file RECOVERED_FILES/lost+found:Inode does not correspond to a regular file.
0 recoverable inodes still lost.
Disk /dev/sdb: 21.4 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 1 1460 11727418+ 83 Linux
/dev/sdb2 1461 2610 9237375 5 Extended
extundelete /dev/sdb1 --restore-file /aa.txt 测试恢复文件
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
Loading filesystem metadata ... 90 groups loaded.
Loading journal descriptors ... 19 descriptors loaded.
Unable to restore inode 48961 (aa.txt): No undeleted copies found in the journa
经测试，次软件的恢复能力对分区有效，对文件效果不大