恢复工具extun.docx

extundelete是基于Linux的一个数据恢复工具，它通过分析文件系统的日志，解析出所有文件的inode信息，从而可以恢复Linux下主流的ext3,ext4文件系统下被误删除的文件。1. 安装1.1 安装e2fsprogs，e2fsprogs-libs，e2fsprogs-devel1） 挂载CentOS安装光盘#mount -o loop /home/share/CentOS-6.5-x86_64-bin-DVD1.iso /media/CentOS_6.5_Final/2） 配置本地yum库:local.repo#cd /etc/yum.repo.d/#lltotal 20-rw-r-r-. 1 root root 1926 Nov 27 2013 CentOS-Base.repo-rw-r-r-. 1 root root 638 Nov 27 2013 CentOS-Debuginfo.repo-rw-r-r-. 1 root root 630 Nov 27 2013 CentOS-Media.repo-rw-r-r-. 1 root root 3664 Nov 27 2013 CentOS-Vault.repo-rw-r-r-. 1 root root 93 Sep 22 20:30 local.repo#more local.repoCentOSLocalname=Local CentOSbaseurl=file:/media/CentOS_6.5_Final/gpgcheck=0enabled=13） 使用yum命令安装#yum install e2fsprogs e2fsprogs-libs e2fsprogs-develLoaded plugins: fastestmirror, refresh-packagekit, securityLoading mirror speeds from cached hostfileSetting up Install ProcessPackage e2fsprogs-1.41.12-18.el6.x86_64 already installed and latest versionNo package e2faprogs-libs available.Resolving Dependencies- Running transaction check- Package e2fsprogs-devel.x86_64 0:1.41.12-18.el6 will be installed- Processing Dependency: libcom_err-devel = 1.41.12-18.el6 for package: e2fsprogs-devel-1.41.12-18.el6.x86_64- Processing Dependency: pkgconfig(com_err) for package: e2fsprogs-devel-1.41.12-18.el6.x86_64- Running transaction check- Package libcom_err-devel.x86_64 0:1.41.12-18.el6 will be installed- Finished Dependency ResolutionDependencies Resolved= Package Arch Version Repository Size=Installing: e2fsprogs-devel x86_64 1.41.12-18.el6 CentOSLocal 160 kInstalling for dependencies: libcom_err-devel x86_64 1.41.12-18.el6 CentOSLocal 32 kTransaction Summary=Install 2 Package(s)Total download size: 192 kInstalled size: 563 kIs this ok y/N: yDownloading Packages:-Total 1.6 MB/s | 192 kB 00:00 Running rpm_check_debugRunning Transaction TestTransaction Test SucceededRunning Transaction Installing : libcom_err-devel-1.41.12-18.el6.x86_64 1/2 Installing : e2fsprogs-devel-1.41.12-18.el6.x86_64 2/2 Verifying : libcom_err-devel-1.41.12-18.el6.x86_64 1/2 Verifying : e2fsprogs-devel-1.41.12-18.el6.x86_64 2/2 Installed: e2fsprogs-devel.x86_64 0:1.41.12-18.el6 Dependency Installed: libcom_err-devel.x86_64 0:1.41.12-18.el6 Complete!1.2 安装extundelete工具1） 上传extundelet源代码tar包到操作系统中：使用ftp方式2） 解压上传的tar包# tar -jxvf extundelete-0.2.4.tar.bz2 -C /home/extundelete-0.2.4/extundelete-0.2.4/acinclude.m4extundelete-0.2.4/missingextundelete-0.2.4/autogen.shextundelete-0.2.4/aclocal.m4extundelete-0.2.4/configureextundelete-0.2.4/LICENSEextundelete-0.2.4/READMEextundelete-0.2.4/install-shextundelete-0.2.4/config.h.inextundelete-0.2.4/src/extundelete-0.2.4/src/extundelete.ccextundelete-0.2.4/src/block.hextundelete-0.2.4/src/kernel-jbd.hextundelete-0.2.4/src/insertionops.ccextundelete-0.2.4/src/block.cextundelete-0.2.4/src/cli.ccextundelete-0.2.4/src/extundelete-priv.hextundelete-0.2.4/src/extundelete.hextundelete-0.2.4/src/jfs_compat.hextundelete-0.2.4/src/Makefile.inextundelete-0.2.4/src/Makefile.amextundelete-0.2.4/configure.acextundelete-0.2.4/depcompextundelete-0.2.4/Makefile.inextundelete-0.2.4/Makefile.am3） 在线安装gcc c+编译器# yum install gcc gcc-c+ gcc-g77Loaded plugins: fastestmirror, refresh-packagekit, securityLoading mirror speeds from cached hostfile * base: * extras: * updates: CentOSLocal | 4.0 kB 00:00 . base | 3.7 kB 00:00 extras | 3.4 kB 00:00 updates | 3.4 kB 00:00 updates/primary_db | 2.0 MB 00:00 Setting up Install ProcessPackage gcc-4.4.7-17.el6.x86_64 already installed and latest versionNo package gcc-g77 available.Resolving Dependencies- Running transaction check- Package gcc-c+.x86_64 0:4.4.7-17.el6 will be installed- Processing Dependency: libstdc+-devel = 4.4.7-17.el6 for package: gcc-c+-4.4.7-17.el6.x86_64- Processing Dependency: libstdc+ = 4.4.7-17.el6 for package: gcc-c+-4.4.7-17.el6.x86_64- Running transaction check- Package libstdc+.x86_64 0:4.4.7-4.el6 will be updated- Package libstdc+.x86_64 0:4.4.7-17.el6 will be an update- Package libstdc+-devel.x86_64 0:4.4.7-17.el6 will be installed- Finished Dependency ResolutionDependencies Resolved= Package Arch Version Repository Size=Installing: gcc-c+ x86_64 4.4.7-17.el6 base 4.7 MInstalling for dependencies: libstdc+-devel x86_64 4.4.7-17.el6 base 1.6 MUpdating for dependencies: libstdc+ x86_64 4.4.7-17.el6 base 295 kTransaction Summary=Install 2 Package(s)Upgrade 1 Package(s)Total download size: 6.6 MIs this ok y/N: yDownloading Packages:(1/3): gcc-c+-4.4.7-17.el6.x86_64.rpm | 4.7 MB 00:01 (2/3): libstdc+-4.4.7-17.el6.x86_64.rpm | 295 kB 00:00 (3/3): libstdc+-devel-4.4.7-17.el6.x86_64.rpm | 1.6 MB 00:00 -Total 3.0 MB/s | 6.6 MB 00:02 Running rpm_check_debugRunning Transaction TestTransaction Test SucceededRunning Transaction Updating : libstdc+-4.4.7-17.el6.x86_64 1/4 Installing : libstdc+-devel-4.4.7-17.el6.x86_64 2/4 Installing : gcc-c+-4.4.7-17.el6.x86_64 3/4 Cleanup : libstdc+-4.4.7-4.el6.x86_64 4/4 Verifying : gcc-c+-4.4.7-17.el6.x86_64 1/4 Verifying : libstdc+-4.4.7-17.el6.x86_64 2/4 Verifying : libstdc+-devel-4.4.7-17.el6.x86_64 3/4 Verifying : libstdc+-4.4.7-4.el6.x86_64 4/4 Installed: gcc-c+.x86_64 0:4.4.7-17.el6 Dependency Installed: libstdc+-devel.x86_64 0:4.4.7-17.el6 Dependency Updated: libstdc+.x86_64 0:4.4.7-17.el6 Complete!4） Extundelete编译安装rootticom # cd /home/rootticom home# lscode extundelete-0.2.4 op share tool zhaoyujie zyjrootticom home# cd extundelete-0.2.4/rootticom extundelete-0.2.4# lsacinclude.m4 autogen.sh config.log configure.ac install-sh Makefile.am missing srcaclocal.m4 config.h.in configure depcomp LICENSE Makefile.in READMErootticom extundelete-0.2.4# ./configure Configuring extundelete 0.2.4Writing generated files to diskrootticom extundelete-0.2.4# makemake -s all-recursiveMaking all in srcextundelete.cc:571: warning: unused parameter flagsrootticom extundelete-0.2.4# make installMaking install in src /usr/bin/install -c extundelete /usr/local/binrootticom extundelete-0.2.4# which extundelete/usr/local/bin/extundeleterootticom extundelete-0.2.4# extundelete -helpUsage: extundelete options - device-fileOptions: -version, -vV Print version and exit successfully. -help, Print this help and exit successfully. -superblock Print contents of superblock in addition to the rest. If no action is specified then this option is implied. -journal Show content of journal. -after dtime Only process entries deleted on or after dtime. -before dtime Only process entries deleted before dtime.Actions: -inode ino Show info on inode ino. -block blk Show info on block blk. -restore-inode ino,ino,. Restore the file(s) with known inode number ino. The restored files are created in ./RECOVERED_FILES with their inode number as extension (ie, file.12345). -restore-file path Will restore file path. path is relative to root of the partition and does not start with a / The restored file is created in the current directory as RECOVERED_FILES/path. -restore-files path Will restore files which are listed in the file path. Each filename should be in the same format as an option to -restore-file, and there should be one per line. -restore-directory path Will restore directory path. path is relative to the root directory of the file system. The restored directory is created in the output directory as path. -restore-all Attempts to restore everything. -j journal Reads an external journal from the named file. -b blocknumber Uses the backup superblock at blocknumber when opening the file system. -B blocksize Uses blocksize as the block size when opening the file system. The number should be the number of bytes. -log 0 Make the program silent. -log filename Logs all messages to filename.-log D1=0,D2=filename Custom control of log messages with comma-separated Examples below: list of options. Dn must be one of info, warn, or -log info,error error. Omission of the =name results in messages -log warn=0 with the specified level to be logged to the console. -log error=filename If the parameter is =0, logging for the specified level will be turned off. If the parameter is =filename, messages with that level will be written to filename. -o directory Save the recovered files to the named directory. The restored files are created in a directory named RECOVERED_FILES/ by default.2. 使用在数据被误删除后，第一时间要做的就是卸载被删除数据所在的分区，如果是根分区的数据遭到误删，就需要将系统进入单用户模式，并且将根分区以只读模式挂 载。这样做的原因很简单，因为将文件删除后，仅仅是将文件的inode节点中的扇区指针清零，实际文件还储存在磁盘上，如果磁盘继续以读写模式挂载，这些 已删除的文件的数据块就可能被操作系统重新分配出去，在这些数据库被新的数据覆盖后，这些数据就真的丢失了，恢复工具也无力回天。所以！以只读模式挂载磁 盘可以尽量降低数据库中数据被覆盖的风险，以提高恢复数据成功的比例。模拟文件删除恢复操作：1） 创建一个新的分区并挂载到一个目录下rootpromote # fdisk -lDisk /dev/sda: 21.5 GB, 21474836480 bytes255 heads, 63 sectors/track, 2610 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0x000a477a Device Boot Start End Blocks Id System/dev/sda1 * 1 39 307200 83 LinuxPartition 1 does not end on cylinder boundary./dev/sda2 39 2358 18631680 83 Linux/dev/sda3 2358 2611 2031616 82 Linux swap / SolarisDisk /dev/sdb: 5368 MB, 5368709120 bytes255 heads, 63 sectors/track, 652 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0x00000000rootpromote # fdisk /dev/sdbDevice contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabelBuilding a new DOS disklabel with disk identifier 0xfb50026f.Changes will remain in memory only, until you decide to write them.After that, of course, the previous content wont be recoverable.Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)WARNING: DOS-compatible mode is deprecated. Its strongly recommended to switch off the mode (command c) and change display units to sectors (command u).Command (m for help): pDisk /dev/sdb: 5368 MB, 5368709120 bytes255 heads, 63 sectors/track, 652 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0xfb50026f Device Boot Start End Blocks Id SystemCommand (m for help): nCommand action e extended p primary partition (1-4)pPartition number (1-4): 1First cylinder (1-652, default 1): Using default value 1Last cylinder, +cylinders or +sizeK,M,G (1-652, default 652): +50MCommand (m for help): wThe partition table has been altered!Calling ioctl() to re-read partition table.Syncing disks.rootpromote # fdisk -lDisk /dev/sda: 21.5 GB, 21474836480 bytes255 heads, 63 sectors/track, 2610 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0x000a477a Device Boot Start End Blocks Id System/dev/sda1 * 1 39 307200 83 LinuxPartition 1 does not end on cylinder boundary./dev/sda2 39 2358 18631680 83 Linux/dev/sda3 2358 2611 2031616 82 Linux swap / SolarisDisk /dev/sdb: 5368 MB, 5368709120 bytes255 heads, 63 sectors/track, 652 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisk identifier: 0xfb50026f Device Boot Start End Blocks Id System/dev/sdb1 1 7 56196 83 Linuxrootpromote # mkfs.ext4 /dev/sdb1mke2fs 1.41.12 (17-May-2010)Filesystem label=OS type: LinuxBlock size=1024 (log=0)Fragment size=1024 (log=0)Stride=0 blocks, Stripe width=0 blocks14056 inodes, 56196 blocks2809 blocks (5.00%) reserved for the super userFirst data block=1Maximum filesystem blocks=576716807 block groups8192 blocks per group, 8192 fragments per group2008 inodes per groupSuperblock backups stored on blocks: 8193, 24577, 40961Writing inode tables: done Creating journal (4096 blocks): doneWriting superblocks and filesystem accounting information: doneThis filesystem will be automatically checked every 32 mounts or180 da