Home IT Linux Windows Database Network Programming Server Mobile  
  Home \ Linux \ CentOS 6.5 installation using a data recovery software extundelete     - Optimized to minimize the installation of CentOS 5.8 (Linux)

- Increase ssh security service under Linux (Linux)

- Forwarding module with Apache reverse proxy server (Server)

- Google open source TCP team repaired the Linux kernel TCP flaw (Linux)

- Go build the locale under Windows (Linux)

- Linux operating system Study Notes (Linux)

- Linux Getting Started tutorial: Experience Xen Virtual Machine chapter (Linux)

- 10 Best Swift Tutorial examples (Programming)

- ORA-04031 error appears in the solution run utlrp.sql (Database)

- JBPM6 Tutorial - Fast Fun JBPM table (Linux)

- How Bluetooth turned off by default in Ubuntu 14.04 (Linux)

- Packages with Snort intrusion monitoring light (Linux)

- GitLab issued Merge Request return error 500 when the two solutions log (Linux)

- Getting Started with Linux system to learn: how to check the version of SSH on Linux (Linux)

- Java, extends and implements Usage (Programming)

- Using C ++ Container Templates in Shared Memory (Programming)

- Use GLOBK batch command network adjustment (Linux)

- installation of Vim plugin YouCompleteMe under Ubuntu 15.04 (Linux)

- Java, hashcode, equals and == (Programming)

- Linux system components Detailed log (Linux)

  CentOS 6.5 installation using a data recovery software extundelete
  Add Date : 2018-11-21      
  CentOS 6.5 installation using a data recovery software extundelete

First, install

(1) First extundelete software relies e2fsprogs e2fsprogs-libs e2fsprogs-devel package

(2) Download extundelete, the official website is http://extundelete.sourceforge.net/ current stable version is extundelete-0.2.4

[Root @ local app] # tar jxvf extundelete-0.2.4.tar.bz2

[Root @ localapp] # cd extundelete-0.2.4

[Root @ localapp] # ./configure results Writing generated files to disk

[Root @ localapp] # make results extundelete.cc:571: WARNING: unused parameter 'flags'

[Root @ localapp] # make install

Results / usr / bin / install -c extundelete '/ usr / local / bin'

(3) extracting installation

(4) After the installation is complete, you can operate the data recovery

Second, the practical method

(1) command format extundelete [options 'option'] [action 'command'] device-file 'device file'

(2) parameters introduced extundelete -help


--version, - [vV] Display the software version number

--help, display help information software

--superblock display the superblock information

--journal, display the log information

--after dtime, time parameters, indicates that the file after a certain period of time or deleted directory

--before dtime, time parameters, represents a period of time before the file is deleted or directory


--inode ino, ino display node information

--block blk information display data block blk

--restore-inode ino [, ino, ...] restore command parameters, indicates that the recovery node "ino" file, the file will be automatically restored

Stored in the current directory RESTORED_FILES folder, use the node number as the extension

--restore-file 'path', the restore command eroded, it said it would resume the path specified file, and the file is restored when placed

RECOVERED_FILES directory in the current directory

--restore-files'path ', restore command parameters, it said it would resume listed in the path of all the files

--restore-all, restore command parameters, it said it will try to recover all the directories and files

-j journal indicates reading extension logs from the named file

-b blocknumber, showing backup before using super Instantly open the file system, generally used to view existing super fast

You are not currently desired files

-B Blocksize, through the development of a data block size to open the file system, generally used for viewing already know the size of the file

Three, extundelete data recovery process

After the data has been accidentally deleted, the first time to do is to uninstall deleted data resides disk or disk partition, if the system root partition data was mistakenly deleted, you need to enter the single-user system, and the root directory mount read-only mode, this is done because when asked to be deleted, the inode is just the file pointer is cleared in the sector, but also the actual files stored on disk, if the disk is mounted read-only data blocks, these deleted files can be re-allocated operating system out, after the data blocks are new data coverage, these data really lost, there is no way to restore recovery tool.

(1) to restore the environment for example ext4 file system operations through a single file extundelete, I add a disk device as / dev / sdb4

[Root @ local Desktop] # mkdir / data

[Root @ local Desktop] # mkfs.ext4 / dev / sdb4

[Root @ local Desktop] # mount / dev / sdb4 / data /

[Root @ local Desktop] # cp / etc / passwd / data /

[Root @ local data] # cp -r /root/app/extundelete-0.2.4 / data /

[Root @ local data] # md5sum passwd

90a8c0bb0bea88d6ce2ab252bd55ecfc passwd

[Root @ local data] # rm -rf / data / *

(2) Uninstall disk partition

[Root @ local data] # cd

[Root @ local ~] # umount / data /

(3) under investigation by extundelete command / dev / sdb4 partition recoverable data General "root" directory inode value

2, a partition is mounted to a directory when, inode the "root" directory is 2

[Root @ local ~] # extundelete / dev / sdb4 --inode 2


File name | Inode number | Deleted status

. 2

.. 2

lost + found 11 Deleted

passwd 12 Deleted

extundelete-0.2.4 131073 Deleted

(4) to restore a single file, a single file restore parameter is --restore-file to note here is the argument behind

Specifies the path to recover files, this path is a relative path to the file. Relative paths are relative to the original terms of the storage path

If the storage path is / data / passwd, then pass parameters written directly behind me, if the original path is / data /

extundelete-0.2.4 / config.h then after the parameter write extundelete-0.2.4 / config.h can.

[Root @ local ~] # extundelete / dev / sdb4 --restore-file passwd

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 40 groups loaded.

Loading journal descriptors ... 52 descriptors loaded.

Successfully restored file passwd

[Root @ local ~] # cd RECOVERED_FILES /

[Root @ local RECOVERED_FILES] # ls


[Root @ local RECOVERED_FILES] # md5sum passwd

90a8c0bb0bea88d6ce2ab252bd55ecfc passwd

By extundelete restore a single directory

(1) to restore the data directory specified by the parameter -restore-directory option, you want to restore the data / data / extundelete- 0.2.4 under

[Root @ local extundelete-0.2.4] # extundelete / dev / sdb4 --restore-directory extundelete-0.2.4

[Root @ local extundelete-0.2.4] # cd RECOVERED_FILES /

[Root @ local RECOVERED_FILES] # ls


[Root @ local RECOVERED_FILES] # du -sh extundelete-0.2.4 /

4.8M extundelete-0.2.4 /

You can see the directory extundelete-0.2.4 has been restored

Restore all mistakenly deleted data extundelete

(1) when the data needs to be restored more, a recovery is a very tedious, this time by --restore-all to restore all files or folders

[Root @ local ~] # cd /

[Root @ local /] # ls

app cgroup etc lib64 misc opt sbin sys var

bin data home lost + found mnt proc selinux tmp

boot dev lib media net root srv usr

[Root @ local /] # extundelete / dev / sdb4 --restore-all

[Root @ local /] # ls

app cgroup etc lib64 misc opt root srv usr

bin data home lost + found mnt proc sbin sys var

boot dev lib media net RECOVERED_FILES selinux tmp

[Root @ local /] # cd RECOVERED_FILES /

[Root @ local RECOVERED_FILES] # ls

extundelete-0.2.4 passwd

[Root @ local RECOVERED_FILES] # du -sh extundelete-0.2.4 /

4.8M extundelete-0.2.4 /

Data recovery for a period of time by extundelete

(1) When the amount of data to be deleted is very large, a lot of data is not available, then we have a short time to restore data,

extundelete provides --after, - before parameters.

First, assuming a / data partition you just created a extundelete-0.2.4.tar.bz2, and then delete this file, then unloading

Upload / data partition, began to recover data within one hour of operation as follows:

[Root @ local data] # cp /root/extundelete-0.2.4.tar.bz2 / data /

[Root @ local data] # ls


[Root @ local data] # date +% s


[Root @ local data] # rm -rf extundelete-0.2.4.tar.bz2

[Root @ local data] # cd

[Root @ local ~] # umount / data

[Root @ local ~] # date +% s


[Root @ local ~] # cd / data /

[Root @ local data] # ls

[Root @ local data] # extundelete --after 1447819621 --restore-all / dev / sdb4

[Root @ local data] # ls

[Root @ local data] # cd RECOVERED_FILES /

[Root @ local RECOVERED_FILES] # ls


Note: You can see just deleted files have been restored this operation requires attention --after after the parameter with the total number of seconds of starting time "1970-01-01 00:00:00 UTC" by date +% s command 1 hour ago recover data after the current time will be converted into the total number of seconds you need to use 60 * 60 = 1447823221 subtract the resulting number 3600
- Linux centralized log server rsyslog (Server)
- How to use Android Studio to play more package names APK (Programming)
- Do not find ifconfig eth0 and IP address under CentOS6.5 (Linux)
- Redis-2.8.17 installation and configuration process some errors (Linux)
- Introduction and use of the Raspberry Pi (Linux)
- Traffic monitor Linux Python Version (Programming)
- GDB remote connections RX Probe online debug program (Programming)
- Kali Linux 2.0 U disk installation errors Your installation cd-rom could not be mounted (Linux)
- How to configure SNMPv3 on Ubuntu, CentOS and Cisco systems (Linux)
- Fatal NI connect error 12170 error in Alert Log (Database)
- Linux Security (Linux)
- Spring-depth understanding of the various annotations (Programming)
- Linux remote wake the computer original code [C] (Linux)
- The signature can not be verified under Debian (Linux)
- Use XtraBackup be physical standby database MySQL (Database)
- ASM Disk Space Check (Database)
- Use the vi text editor and copy and paste Linux tips (Linux)
- Java data structures - the linear form of the single-chain applications (Programming)
- Ansible installation configuration and simple to use (Server)
- Ubuntu arm-none-eabi-gcc compiler treated with STM32F10x (Linux)
  CopyRight 2002-2016 newfreesoft.com, All Rights Reserved.