Linux 数据恢复工具extundelete

安装

wget https://jaist.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

tar jxvf extundelete-0.2.4.tar.bz2

cd extundelete-0.2.4/

./configure

[[email protected] extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: in `/usr/local/src/extundelete-0.2.4‘:
configure: error: C++ compiler cannot create executables

yum install gcc-c++.x86_64

[[email protected] extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can‘t find ext2fs library

[[email protected] extundelete-0.2.4]# yum -y install e2fsprogs-devel

[[email protected] extundelete-0.2.4]# ./configure

[[email protected] extundelete-0.2.4]# make

[[email protected] extundelete-0.2.4]# make install
extundelete用法
[[email protected] ~]# extundelete --help
Usage: extundelete [options] [--] device-file
Options:
--version, -[vV]       Print version and exit successfully.
--help,                Print this help and exit successfully.
--superblock           Print contents of superblock in addition to the rest.
                         If no action is specified then this option is implied.
--journal              Show content of journal.
--after dtime          Only process entries deleted on or after ‘dtime‘.
--before dtime         Only process entries deleted before ‘dtime‘.
Actions:
--inode ino            Show info on inode ‘ino‘.
--block blk            Show info on block ‘blk‘.
--restore-inode ino[,ino,...]
                         Restore the file(s) with known inode number ‘ino‘.
                         The restored files are created in ./RECOVERED_FILES
                         with their inode number as extension (ie, file.12345).
--restore-file ‘path‘ Will restore file ‘path‘. ‘path‘ is relative to root
                         of the partition and does not start with a ‘/‘
                         The restored file is created in the current
                         directory as ‘RECOVERED_FILES/path‘.
--restore-files ‘path‘ Will restore files which are listed in the file ‘path‘.
                         Each filename should be in the same format as an option
                         to --restore-file, and there should be one per line.
--restore-directory ‘path‘
                         Will restore directory ‘path‘. ‘path‘ is relative to the
                         root directory of the file system. The restored
                         directory is created in the output directory as ‘path‘.
--restore-all          Attempts to restore everything.
-j journal             Reads an external journal from the named file.
-b blocknumber         Uses the backup superblock at blocknumber when opening
                         the file system.
-B blocksize           Uses blocksize as the block size when opening the file
                         system. The number should be the number of bytes.
--log 0                Make the program silent.
--log filename         Logs all messages to filename.
--log D1=0,D2=filename   Custom control of log messages with comma-separated
   Examples below:       list of options. Dn must be one of info, warn, or
   --log info,error      error. Omission of the ‘=name‘ results in messages
   --log warn=0          with the specified level to be logged to the console.
   --log error=filename If the parameter is ‘=0‘, logging for the specified
                         level will be turned off. If the parameter is
                         ‘=filename‘, messages with that level will be written
                         to filename.
   -o directory          Save the recovered files to the named directory.
                         The restored files are created in a directory
                         named ‘RECOVERED_FILES/‘ by default.
通过extundelete恢复单个文件
1.模拟数据误删除环境

以ext4文件系统为例

[[email protected] ~]# mkdir /data

[[email protected] ~]# mkfs.ext4 /dev/sdc1

[[email protected] ~]# mount /dev/sdc1 /data/

[[email protected] ~]# cp /etc/passwd /data
[[email protected] ~]# mkdir /data/test

[[email protected] ~]# echo "extundelete test" > /data/test/mytest.txt

[[email protected] data]# md5sum passwd
f1a0dd6601afdab09a66ab7741c74f66 passwd
[[email protected] data]# md5sum test/mytest.txt
eb42e4b3f953ce00e78e11bf50652a80 test/mytest.txt
[[email protected] data]# rm -rf /data/*

2.卸载磁盘分区

[[email protected] data]# cd /mnt/
[[email protected] mnt]# umount /data

3.查询可恢复的数据信息

通过extundelete命令可以查询/dev/sdc1分区可恢复的数据信息

[[email protected] /]# extundelete /dev/sdc1 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 38 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 94 aa 75 58 54 aa 75 58 | .A........uXT.uX
0010 | 54 aa 75 58 00 00 00 00 00 00 02 00 08 00 00 00 | T.uX............
0020 | 00 00 08 00 05 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 d5 21 00 00 | .............!..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 c8 15 0b 0d c8 15 0b 0d dc 36 bf 4b | .............6.K
0090 | b2 a8 75 58 00 00 00 00 00 00 00 00 00 00 00 00 | ..uX............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1484106388
Creation time: 1484106324
Modification time: 1484106324
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 8661, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11             Deleted
passwd                                            12             Deleted
test                                              128513         Deleted

根据上面输出，标记为Deleted状态的是已经删除的文件或目录，同时，还可以看到每个已删除文件inode值，接下来就可以恢复文件了

4.恢复单个文件

执行如下命令开始恢复文件

extundelete /dev/sdc1 --restore-file passwd

时间： 2024-12-20 02:21:23

Linux 数据恢复工具extundelete的相关文章

11款最棒的Linux数据恢复工具发布啦！

如果你使用的是Linux操作系统,那么你一定想知道一旦硬盘崩溃的话又该如何保存和恢复数据.其实,现在有很多Linux数据恢复工具可以让我们摆脱数据安全的困扰.我已经为各位准备好了一些最好的Linux数据恢复工具,欢迎大家品鉴. 1.KnoppixKnoppix是从损坏的机器中恢复数据的最佳工具之一.它有一个可引导的CD版本,友好的用户界面.它可以让你轻松安装驱动器,然后复制数据. Knoppix自身携带了一整套的Linux命令. 官方网站:http://www.knopper.net/knopp

这些Linux数据恢复工具，你用过哪几个

不论你运用的是台式电脑仍是笔记本,需求重视的要点之一都是怎么保护好你的名贵数据.由于总会有各种突发状况使你的系统溃散,然后你要做的就是恢复数据.不论你怎么想,要是我失去了一切的数据却无法恢复的话,我会分分钟肢解了这台破电脑.不过幸亏的是,如今商场上有不少的数据恢复工具,能协助咱们从体系的硬盘上恢复数据. 如果你使用的是Linux操作系统,那么你一定想知道一旦硬盘崩溃的话又该如何保存和恢复数据.其实,现在有很多Linux数据恢复工具可以让我们摆脱数据安全的困扰.我已经为各位准备好了一些最好的Lin

数据恢复工具--extundelete的安装与使用

1.extundelete的恢复原理 extundelete恢复文件时并不依赖特定文件格式,首先extundelete会通过文件系统的inode信息,来获得当前文件系统下所有文件的信息,包括存在的和已经删除的文件,这些信息包括文件名和inode.然后利用inode信息结合日志去查询该inode所在的block位置,包括直接块,间接块等信息.最后利用dd命令将这些信息备份出来,从而恢复数据文件. 2.extundelete的安装环境:redhat6.5 extundelete官方地址:https

Linux系统通过extundelete恢复已删除的数据

我们都知道windows系统有个回收站,凡是被删除的文件都可以通过回收站来恢复数据,即便是按住shift键永久删除了,也有很多数据恢复软件可供使用.那么Linux下如果数据被删除了,又该如何恢复呢,Linux系统可没有回收站,只能通过数据恢复软件来解决了.Linux系统有很多开源的数据恢复工具,例如:debugfs.R-Linux.ext3grep.extundelete等,那么我要给大家介绍的是extundelete,这款工具是用来恢复ext格式(ext3.ext4等)的文件系统被误删除的数据

Ext分区文件恢复工具extundelete

Ext分区文件恢复工具extundelete Ext是延伸文件系统(Extended system)的缩写.它是为Linux内核开发的第一个文件系统.它有多个版本.现在常见的是Ext3和Ext4.由于该文件系统使用日志记录数据的修改,所以恢复被删除的数据也较为容易.Kali Linux提供一款专用工具extundelete,用来实现Ext3/4文件系统中删除文件的恢复. 在使用的时候,用户首先使用该工具查看超级块和日志块,以及特定节点和块的信息.然后,可以指定要恢复的文件以及文件夹.在恢复的时

实用推荐：12款Linux系统恢复工具

12款Linux系统恢复工具电脑死机,系统崩溃,总会给电脑使用者带来一定的损失.你是否不小心删除你的纪念图片?安装新系统时候,擦除了分区表?无法读取旧CD里面的数据?别急嘛-我们将会给您推荐一些免费的系统急救工具,使你从无奈中解脱出来. AD: 电脑死机,硬盘崩溃,花巨大的money搞个急救保护器……这都是计算机的阴暗面. 时间一直这样走着,走着,不定哪天背点儿.对于电脑损坏造成的损失,着急抓狂毫无意义.相反,使用恰当的工具反而会最小化损失. 你是否不小心删除你的纪念图片?安装新系统时候,擦除

配置Linux数据转发(给其他接口转发一个接口的internet网络)

配置Linux数据转发 [主机]第一步开启转发net.ipv4.ip_forward = 1echo "1" > /proc/sys/net/ipv4/ip_forward 第二步打开iptables的NAT功能:sudo /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 其中eth0位可上网的接口注意:主机下接的客户端需要配置与eth0同样的DNS才行.

Linux数据包路由原理、Iptables/netfilter入门学习

相关学习资料 https://www.frozentux.net/iptables-tutorial/cn/iptables-tutorial-cn-1.1.19.html http://zh.wikipedia.org/wiki/Netfilter http://www.netfilter.org/projects/iptables/ http://linux.vbird.org/linux_server/0250simple_firewall.php http://linux.vbird.o

Linux 数据可视化工具

Linux 数据可视化工具 Linux 上用来实现数据的图形可视化的应用程序有很多,从简单的 2-D 绘图到 3-D 制图,再到科学图形编程和图形模拟.幸运的是,这方面的工具有很多开放源码实现,包括 gnuplot.GNU Octave.Scilab.MayaVi.Maxima 等.每个工具都有自己的优缺点,并且都是针对不同的应用程序而设计的.对这些开放源码图形可视化工具进行一下探索,有助于我们更好地决定哪个工具最适合我们的应用程序. 内容 Gnuplot GNU Octave Scilab M