```
[root@localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 26G 1.1G 25G 4% /
devtmpfs 908M 0 908M 0% /dev
tmpfs 914M 0 914M 0% /dev/shm
tmpfs 914M 8.6M 905M 1% /run
tmpfs 914M 0 914M 0% /sys/fs/cgroup
/dev/sda1 497M 91M 407M 19% /boot
tmpfs 183M 0 183M 0% /run/user/0
/dev/sdb 9.8G 37M 9.2G 1% /mnt
[root@localhost mnt]# cp /etc/passwd passwd
[root@localhost mnt]# ls -l
total 20
drwx------. 2 root root 16384 Aug 3 11:31 lost+found
-rw-r--r--. 1 root root 1015 Aug 3 11:34 passwd
[root@localhost mnt]# rm -rf passwd
```
- 确保误删除的文件内容被覆盖
# 方法：
- 卸载需要恢复文件的分区，或以只读形式挂载
```
[root@localhost mnt]# cd
[root@localhost ~]# umount /mnt/
[root@localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 26G 1.1G 25G 4% /
devtmpfs 908M 0 908M 0% /dev
tmpfs 914M 0 914M 0% /dev/shm
tmpfs 914M 8.6M 905M 1% /run
tmpfs 914M 0 914M 0% /sys/fs/cgroup
/dev/sda1 497M 91M 407M 19% /boot
tmpfs 183M 0 183M 0% /run/user/0
```
# 安装extundelete
```
[root@localhost ~]# cd /usr/local/src/
[root@localhost src]# ls
[root@localhost src]# wget http://pkgs.fedoraproject.org/repo/pkgs/extundelete/extundelete-0.2.4.tar.bz2/77e626ad31433680c0a222069295d2ca/extundelete-0.2.4.tar.bz2
--2018-08-03 11:44:11-- http://pkgs.fedoraproject.org/repo/pkgs/extundelete/extundelete-0.2.4.tar.bz2/77e626ad31433680c0a222069295d2ca/extundelete-0.2.4.tar.bz2
Resolving pkgs.fedoraproject.org (pkgs.fedoraproject.org)... 209.132.181.4
Connecting to pkgs.fedoraproject.org (pkgs.fedoraproject.org)|209.132.181.4|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://src.fedoraproject.org/repo/pkgs/extundelete/extundelete-0.2.4.tar.bz2/77e626ad31433680c0a222069295d2ca/extundelete-0.2.4.tar.bz2 [following]
--2018-08-03 11:44:12-- https://src.fedoraproject.org/repo/pkgs/extundelete/extundelete-0.2.4.tar.bz2/77e626ad31433680c0a222069295d2ca/extundelete-0.2.4.tar.bz2
Resolving src.fedoraproject.org (src.fedoraproject.org)... 209.132.181.15, 209.132.181.16
Connecting to src.fedoraproject.org (src.fedoraproject.org)|209.132.181.15|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 108472 (106K) [application/x-bzip2]
Saving to: ‘extundelete-0.2.4.tar.bz2’
100%[================================================================================>] 108,472 152KB/s in 0.7s
2018-08-03 11:44:13 (152 KB/s) - ‘extundelete-0.2.4.tar.bz2’ saved [108472/108472]
[root@localhost src]# ls
extundelete-0.2.4.tar.bz2
[root@localhost src]# tar jxvf extundelete-0.2.4.tar.bz2
extundelete-0.2.4/
extundelete-0.2.4/acinclude.m4
extundelete-0.2.4/missing
extundelete-0.2.4/autogen.sh
extundelete-0.2.4/aclocal.m4
extundelete-0.2.4/configure
extundelete-0.2.4/LICENSE
extundelete-0.2.4/README
extundelete-0.2.4/install-sh
extundelete-0.2.4/config.h.in
extundelete-0.2.4/src/
extundelete-0.2.4/src/extundelete.cc
extundelete-0.2.4/src/block.h
extundelete-0.2.4/src/kernel-jbd.h
extundelete-0.2.4/src/insertionops.cc
extundelete-0.2.4/src/block.c
extundelete-0.2.4/src/cli.cc
extundelete-0.2.4/src/extundelete-priv.h
extundelete-0.2.4/src/extundelete.h
extundelete-0.2.4/src/jfs_compat.h
extundelete-0.2.4/src/Makefile.in
extundelete-0.2.4/src/Makefile.am
extundelete-0.2.4/configure.ac
extundelete-0.2.4/depcomp
extundelete-0.2.4/Makefile.in
extundelete-0.2.4/Makefile.am
```
```
[root@localhost extundelete-0.2.4]# ls
acinclude.m4 autogen.sh configure depcomp LICENSE Makefile.in README
aclocal.m4 config.h.in configure.ac install-sh Makefile.am missing src
[root@localhost extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[root@localhost extundelete-0.2.4]# make -j 2
make -s all-recursive
Making all in src
extundelete.cc: In function ‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’:
extundelete.cc:1272:29: warning: narrowing conversion of ‘search_flags’ from ‘int’ to ‘ext2_ino_t {aka unsigned int}’ inside { } [-Wnarrowing]
buf, match_name2, priv, 0};
^
[root@localhost extundelete-0.2.4]# make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'
```
```
[root@localhost extundelete-0.2.4]# cd /mnt/
[root@localhost mnt]# ls
```
```
[root@localhost mnt]# extundelete /dev/sdb --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 80 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 eb ce 63 5b 7e ce 63 5b | .A........c[~.c[
0010 | 7e ce 63 5b 00 00 00 00 00 00 03 00 08 00 00 00 | ~.c[............
0020 | 00 00 08 00 02 00 00 00 0a f3 01 00 04 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 23 24 00 00 | ............#$..
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 1c ba 88 51 1c ba 88 51 00 5b af 34 | .......Q...Q.[.4
0090 | 85 cc 63 5b 00 00 00 00 00 00 00 00 00 00 00 00 | ..c[............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1533267691
Creation time: 1533267582
Modification time: 1533267582
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 8
File flags: 524288
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 9251, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11
passwd 12 Deleted
```
> 根据指定inode或者文件类型进行恢复
```
[root@localhost mnt]# extundelete /dev/sdb --restore-all
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 80 groups loaded.
Loading journal descriptors ... 174 descriptors loaded.
*** Error in `extundelete': double free or corruption (!prev): 0x000000000210afc0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81499)[0x7fcbfba9b499]
extundelete[0x40ce9b]
extundelete[0x40ffb6]
extundelete[0x404684]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fcbfba3c445]
extundelete[0x404bbf]
======= Memory map: ========
00400000-0041c000 r-xp 00000000 08:03 100685901 /usr/local/bin/extundelete
0061c000-0061d000 r--p 0001c000 08:03 100685901 /usr/local/bin/extundelete
0061d000-0061e000 rw-p 0001d000 08:03 100685901 /usr/local/bin/extundelete
0061e000-0061f000 rw-p 00000000 00:00 0
020ec000-0212e000 rw-p 00000000 00:00 0 [heap]
7fcbf4000000-7fcbf4021000 rw-p 00000000 00:00 0
7fcbf4021000-7fcbf8000000 ---p 00000000 00:00 0
7fcbfb7fe000-7fcbfb815000 r-xp 00000000 08:03 68260903 /usr/lib64/libpthread-2.17.so
7fcbfb815000-7fcbfba14000 ---p 00017000 08:03 68260903 /usr/lib64/libpthread-2.17.so
7fcbfba14000-7fcbfba15000 r--p 00016000 08:03 68260903 /usr/lib64/libpthread-2.17.so
7fcbfba15000-7fcbfba16000 rw-p 00017000 08:03 68260903 /usr/lib64/libpthread-2.17.so
7fcbfba16000-7fcbfba1a000 rw-p 00000000 00:00 0
7fcbfba1a000-7fcbfbbdd000 r-xp 00000000 08:03 67163136 /usr/lib64/libc-2.17.so
7fcbfbbdd000-7fcbfbddc000 ---p 001c3000 08:03 67163136 /usr/lib64/libc-2.17.so
7fcbfbddc000-7fcbfbde0000 r--p 001c2000 08:03 67163136 /usr/lib64/libc-2.17.so
7fcbfbde0000-7fcbfbde2000 rw-p 001c6000 08:03 67163136 /usr/lib64/libc-2.17.so
7fcbfbde2000-7fcbfbde7000 rw-p 00000000 00:00 0
7fcbfbde7000-7fcbfbdfc000 r-xp 00000000 08:03 67720242 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fcbfbdfc000-7fcbfbffb000 ---p 00015000 08:03 67720242 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fcbfbffb000-7fcbfbffc000 r--p 00014000 08:03 67720242 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fcbfbffc000-7fcbfbffd000 rw-p 00015000 08:03 67720242 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fcbfbffd000-7fcbfc0fe000 r-xp 00000000 08:03 67733119 /usr/lib64/libm-2.17.so
7fcbfc0fe000-7fcbfc2fd000 ---p 00101000 08:03 67733119 /usr/lib64/libm-2.17.so
7fcbfc2fd000-7fcbfc2fe000 r--p 00100000 08:03 67733119 /usr/lib64/libm-2.17.so
7fcbfc2fe000-7fcbfc2ff000 rw-p 00101000 08:03 67733119 /usr/lib64/libm-2.17.so
7fcbfc2ff000-7fcbfc3e8000 r-xp 00000000 08:03 67258580 /usr/lib64/libstdc++.so.6.0.19
7fcbfc3e8000-7fcbfc5e7000 ---p 000e9000 08:03 67258580 /usr/lib64/libstdc++.so.6.0.19
7fcbfc5e7000-7fcbfc5ef000 r--p 000e8000 08:03 67258580 /usr/lib64/libstdc++.so.6.0.19
7fcbfc5ef000-7fcbfc5f1000 rw-p 000f0000 08:03 67258580 /usr/lib64/libstdc++.so.6.0.19
7fcbfc5f1000-7fcbfc606000 rw-p 00000000 00:00 0
7fcbfc606000-7fcbfc648000 r-xp 00000000 08:03 67263425 /usr/lib64/libext2fs.so.2.4
7fcbfc648000-7fcbfc848000 ---p 00042000 08:03 67263425 /usr/lib64/libext2fs.so.2.4
7fcbfc848000-7fcbfc849000 r--p 00042000 08:03 67263425 /usr/lib64/libext2fs.so.2.4
7fcbfc849000-7fcbfc84b000 rw-p 00043000 08:03 67263425 /usr/lib64/libext2fs.so.2.4
7fcbfc84b000-7fcbfc84e000 r-xp 00000000 08:03 67909932 /usr/lib64/libcom_err.so.2.1
7fcbfc84e000-7fcbfca4d000 ---p 00003000 08:03 67909932 /usr/lib64/libcom_err.so.2.1
7fcbfca4d000-7fcbfca4e000 r--p 00002000 08:03 67909932 /usr/lib64/libcom_err.so.2.1
7fcbfca4e000-7fcbfca4f000 rw-p 00003000 08:03 67909932 /usr/lib64/libcom_err.so.2.1
7fcbfca4f000-7fcbfca71000 r-xp 00000000 08:03 67163128 /usr/lib64/ld-2.17.so
7fcbfcbd1000-7fcbfcc69000 rw-p 00000000 00:00 0
7fcbfcc6d000-7fcbfcc70000 rw-p 00000000 00:00 0
7fcbfcc70000-7fcbfcc71000 r--p 00021000 08:03 67163128 /usr/lib64/ld-2.17.so
7fcbfcc71000-7fcbfcc72000 rw-p 00022000 08:03 67163128 /usr/lib64/ld-2.17.so
7fcbfcc72000-7fcbfcc73000 rw-p 00000000 00:00 0
7fff13bb3000-7fff13bd4000 rw-p 00000000 00:00 0 [stack]
7fff13bfe000-7fff13c00000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted
```
粤公网安备:44010402001679号
