前往小程序，Get更优阅读体验！
立即前往
文档建议反馈控制台
首页
学习
活动
专区
工具
TVP
最新优惠活动
文章/答案/技术大牛
发布
首页
学习
活动
专区
工具
TVP最新优惠活动
返回腾讯云官网
社区首页 >专栏 >centos误删文件如何恢复文件数据

centos误删文件如何恢复文件数据

作者头像
Java廖志伟
发布于 2022-09-29 14:18:23
4.1K0
发布于 2022-09-29 14:18:23
举报
文章被收录于专栏：高级开发进阶

@TOC

前言

提示：这里主要介绍centos误删文件如何恢复文件数据的情况，视频以xfs为例，博文会讲解xfs和ext4分区类型。

提示：以下是本篇文章正文内容，下面案例可供参考

一、查看分区类型

我们创建的centos对应的每个分区都有不同类型，可以通过以下命令进行查看，不同的分区类型恢复的命令也不相同，本文以xfs分区为例，作为演示，附带视频讲解。

代码语言：javascript
复制
df -T

xfs分区

ext4分区

二、使用centos7软件恢复工具extundelete作为文件恢复

1.安装extundelete

下载依赖包：

代码语言：javascript
复制
yum install e2fsprogs-devel e2fsprogs e2fsprogs-libs

2.上传extundelete安装包到自定义目录下面

百度网盘链接：https://pan.baidu.com/s/1UNS3TJxmnSuDWeI1sgarLQ 提取码：d9sb

这里我是去到/usr/local目录下面创建了一个software的目录，将安装包通过WinSCP上传上去了

3.解压安装包

在/usr/local/software目录下解压安装包

代码语言：javascript
复制
tar -jxvf extundelete-0.2.4.tar.bz2

4.进到解压后的安装包目录下面执行命令

代码语言：javascript
复制
yum -y install gcc
yum -y install gcc-c++
cd extundelete-0.2.4
./configure
make
make install
which extundelete

5.创建data目录和deletefile文件

代码语言：javascript
复制
cd /
mkdir /data
cd /data
touch deletefile

6.（xfs分区的）

备份命令

代码语言：javascript
复制
xfsdump -f /tmp/dump_data /data

 -> dump_data
 -> media0

出现这个xfsdump: Dump Status: SUCCESS说明备份成功了

6.（ext4分区的）

查看删除目录

代码语言：javascript
复制
/usr/local/bin/extundelete --inode 2 /dev/sda2

NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 285 groups loaded.
Group: 0
Contents of inode 2:
0000 | 6d 41 00 00 00 10 00 00 e2 b2 6a 61 66 b2 6a 61 | mA........jaf.ja
0010 | 66 b2 6a 61 00 00 00 00 00 00 13 00 08 00 00 00 | f.ja............
0020 | 00 00 08 00 22 00 00 00 0a f3 01 00 04 00 00 00 | ...."...........
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 26 24 00 00 | ............&$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 d0 7f eb 7d d0 7f eb 7d 00 53 f7 34 | .......}...}.S.4
0090 | a2 be 68 61 00 00 00 00 00 00 00 00 00 00 02 ea | ..ha............
00a0 | 07 06 44 00 00 00 00 00 1c 00 00 00 00 00 00 00 | ..D.............
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux.........
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 73 79 73 74 65 6d 5f 75 3a 6f 62 6a | ....system_u:obj
00f0 | 65 63 74 5f 72 3a 72 6f 6f 74 5f 74 3a 73 30 00 | ect_r:root_t:s0.

Inode is Allocated
File mode: 16749
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1634382562
Creation time: 1634382438
Modification time: 1634382438
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 19
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9254, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
boot                                              2097153
dev                                               1179649
proc                                              1835009
run                                               1966081
sys                                               131073
etc                                               1310721
root                                              1441793
tmp                                               262145
var                                               393217
data                                              1048577
usr                                               1572865
bin                                               17
sbin                                              16
lib                                               13
lib64                                             15
home                                              524289
media                                             1703937
mnt                                               655361
opt                                               786433
srv                                               917505

可以找到data 1048577

代码语言：javascript
复制
/usr/local/bin/extundelete --inode 1048577 /dev/sda2

NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 285 groups loaded.
Group: 128
Contents of inode 1048577:
0000 | ed 41 00 00 00 10 00 00 98 b3 6a 61 88 b3 6a 61 | .A........ja..ja
0010 | 88 b3 6a 61 00 00 00 00 00 00 03 00 08 00 00 00 | ..ja............
0020 | 00 00 08 00 06 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 20 20 40 00 | ............  @.
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 1c 85 44 00 00 00 00 00 00 00 00 | .......D........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 00 08 6b d0 00 08 6b d0 14 06 2c a7 | ......k...k...,.
0090 | 66 b2 6a 61 d0 76 ae 7d 00 00 00 00 00 00 02 ea | f.ja.v.}........
00a0 | 07 06 3c 00 00 00 00 00 23 00 00 00 00 00 00 00 | ..<.....#.......
00b0 | 73 65 6c 69 6e 75 78 00 00 00 00 00 00 00 00 00 | selinux.........
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 75 6e 63 6f | ............unco
00e0 | 6e 66 69 6e 65 64 5f 75 3a 6f 62 6a 65 63 74 5f | nfined_u:object_
00f0 | 72 3a 64 65 66 61 75 6c 74 5f 74 3a 73 30 00 00 | r:default_t:s0..

Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1634382744
Creation time: 1634382728
Modification time: 1634382728
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 1149574144
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 4202528, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 1048577
..                                                2
deletefile                                        1048578        Deleted
delete                                            1048579        Deleted
RECOVERED_FILES                                   1048580

可以看到deletefile和delete这二个被我误删除文件的inode值列出来了

7.模拟误删文件

模拟删除/data目录内的所有内容

代码语言：javascript
复制
rm -rf /data/*

8.（xfs分区的）

恢复文件命令

代码语言：javascript
复制
xfsrestore -f /tmp/dump_data /data

8.（ext4分区的）

恢复data目录的命令：

代码语言：javascript
复制
/usr/local/bin/extundelete /dev/sda2 --restore-directory /data

如果出现以下情况：

代码语言：javascript
复制
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
//此处的信息是因为我在根目录下做实验，无法进行卸载导致的，这儿的大概意思是说 如果你要进行这个操作的话，最好吧分区卸载掉再进行恢复，否则如果不卸载的话，如果有写操作会吧原来的inode覆盖掉，如果你已经卸载了分区，还报这个错的话用fuser -k /PATH，之后再umount /PATH，请用这样的话会导致无法恢复，或者恢复不成功，笔者鉴于是测试服务器，并且是实验操作所以选Y，生产环境建议不要这么做。 
y
Loading filesystem metadata ... 285 groups loaded.
Loading journal descriptors ... 25781 descriptors loaded.
Failed to restore file 1048579
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name                                       | Inode number | Deleted status
/usr/local/bin/extundelete: Operation not permitted while restoring directory.
/usr/local/bin/extundelete: Operation not permitted when trying to examine filesystem

一般使用恢复所有删除的文件

代码语言：javascript
复制
sudo /usr/local/bin/extundelete /dev/sda2 --restore-all

9.查看恢复文件

代码语言：javascript
复制
cd /data
ls

10.视频讲解演示流程(以xfs为例)

B站地址：https://www.bilibili.com/video/BV1nq4y1d7KB?spm_id_from=333.999.0.0

总结

提示：文章主要讲解centos误删文件怎么恢复（xfs类型的分区），起因是本人在测试环境误删了docker镜像文件，导致所有运行的镜像文件都没了，项目无法运行，所以才做了这期博文和视频，作为记录，分享给大家。

参考博文： https://blog.csdn.net/weixin_43622131/article/details/98511279 https://blog.csdn.net/wjciayf/article/details/39316913

本文参与 腾讯云自媒体同步曝光计划，分享自作者个人站点/博客。
原始发表：2021-11-12，如有侵权请联系 cloudcommunity@tencent.com 删除
node.js
https
网络安全
centos
linux

本文分享自 作者个人站点/博客 前往查看

如有侵权，请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ，欢迎热爱写作的你一起参与！

node.js
https
网络安全
centos
linux
评论
登录后参与评论
0 条评论
热度
最新
登录 后参与评论
推荐阅读
LV.
文章
0
获赞
0
目录
  • 前言
  • 一、查看分区类型
  • 二、使用centos7软件恢复工具extundelete作为文件恢复
    • 1.安装extundelete
      • 2.上传extundelete安装包到自定义目录下面
        • 3.解压安装包
          • 4.进到解压后的安装包目录下面执行命令
            • 5.创建data目录和deletefile文件
              • 6.（xfs分区的）
                • 6.（ext4分区的）
                  • 7.模拟误删文件
                    • 8.（xfs分区的）
                      • 8.（ext4分区的）
                        • 9.查看恢复文件
                          • 10.视频讲解演示流程(以xfs为例)
                          • 总结
                          相关产品与服务
                          测试服务
                          测试服务 WeTest 包括标准兼容测试、专家兼容测试、手游安全测试、远程调试等多款产品，服务于海量腾讯精品游戏，涵盖兼容测试、压力测试、性能测试、安全测试、远程调试等多个方向，立体化安全防护体系，保卫您的信息安全。
                          产品介绍产品文档
                          11.11 上云拼团GO
                          领券

                          腾讯云开发者

                          扫码关注腾讯云开发者

                          扫码关注腾讯云开发者

                          领取腾讯云代金券

                          热门产品

                          热门推荐

                          更多推荐

                          Copyright © 2013 - 2024 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

                          深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

                          腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

                          问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档

                          Copyright © 2013 - 2024 Tencent Cloud.

                          All Rights Reserved. 腾讯云 版权所有

                          登录 后参与评论