誤刪除系列二：恢復已經刪除文件

背景：基於對恢復的好奇心，因此寫一系列相關的博客，在linux沒有回收站這一說法，經過rm -rf file的操做，如何恢復

如下的討論分爲兩種狀況：

• 刪除後進程還能找到狀況
• 刪除後進程找不到，須要藉助外部工具來實現

進程還在的狀況：

通常是有活動的進程存在持續標準輸入或輸出，到時文件被刪除後，進程PID依然在，這也是某些服務器刪除一些文件可是磁盤不釋放的緣由。

1.打開一個終端：
[root@node1-centos7u6 ~]# echo "delete test" > testfile
[root@node1-centos7u6 ~]# ls
testfile
[root@node1-centos7u6 ~]# cat >> testfile 
add testing words 

2.打開另外一個終端：
[root@node1-centos7u6 ~]# cat testfile 
delete test
add testing words

3.進行刪除操做：
[root@node1-centos7u6 ~]# rm -rf testfile

4.使用lsof查看刪除文件進程是否還存在(yum install lsof)
[root@node1-centos7u6 ~]# lsof |grep testfile
cat       108850             root    1w      REG              253,0        30   34125635 /root/testfile (deleted)  <----

5.恢復操做
[root@node1-centos7u6 ~]# cd /proc/108850/fd
[root@node1-centos7u6 fd]# ll
total 0
lrwx------. 1 root root 64 Mar 30 13:04 0 -> /dev/pts/1
l-wx------. 1 root root 64 Mar 30 13:04 1 -> /root/testfile (deleted)
lrwx------. 1 root root 64 Mar 30 13:04 2 -> /dev/pts/1
[root@node1-centos7u6 fd]# cp 1 ~/testfile-restore
[root@node1-centos7u6 fd]# cat ~/testfile-restore
delete test
add testing words

進程不在的狀況：須要藉助工具實現

1.準備一個掛載盤和一些文件目錄

[root@node1-centos7u6 ~]# lsblk 
NAME            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda               8:0    0   20G  0 disk 
├─sda1            8:1    0    1G  0 part /boot
└─sda2            8:2    0   19G  0 part 
  ├─centos-root 253:0    0   17G  0 lvm  /
  └─centos-swap 253:1    0    2G  0 lvm  [SWAP]
sdb               8:16   0    1G  0 disk 
└─sdb1            8:17   0 1023M  0 part   <----
sr0              11:0    1  4.3G  0 rom  
[root@node1-centos7u6 ~]# mkfs.ext4 /dev/sdb1
[root@node1-centos7u6 ~]# mount /dev/sdb1 /mnt/


[root@node1-centos7u6 ~]# cd /mnt/
mkdir backup
cd backup
mkdir delete
mkdir delete/inner
echo "Delete test." > delete/inner/deletefile 
echo "reid:x:112:172::/:/sbin/nologin" > reidpasswd

目錄結構：
[root@node1-centos7u6 mnt]# tree backup/
backup/
├── delete
│   └── inner
│       └── deletefile
└── reidpasswd

2.刪除目錄

[root@node1-centos7u6 mnt]# rm -rf backup/
[root@node1-centos7u6 mnt]# ll
total 16
drwx------. 2 root root 16384 Mar 30 13:29 lost+found

3.引用第三方恢復工具extundelete

• 中止對當前分區作任何操做，防止inode被覆蓋。inode被覆蓋基本就告別恢復了。
• 誇張一點講，好比中止所在分區的服務，卸載目錄所在的設備，有必要的狀況下均可以斷網。
• 經過dd命令對 當前分區進行備份，防止第三方軟件恢復失敗致使數據丟失。
• 適合數據很是重要的狀況，這裏是例子，因此就沒有備份，如備份能夠考慮以下方式：dd if=/path/filename of=/dev/vdc1
• 經過umount命令，對當前設備分區卸載。或者fuser 命令umount /dev/vdb1
• 若是提示設備busy，能夠用fuser命令強制卸載：fuser -m -v -i -k ./
• 下載第三方工具extundelete安裝，搜索誤刪除的文件進行還原

a.安裝extundelete工具：

[root@node1-centos7u6 ~]# wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

解壓：
[root@node1-centos7u6 ~]# tar xf extundelete-0.2.4.tar.bz2

編譯：
[root@node1-centos7u6 ~]# cd extundelete-0.2.4
[root@node1-centos7u6 extundelete-0.2.4]# ./configure 
centos configure: error: Can't find ext2fs library
解決辦法：yum -y install  e2fsprogs.x86_64 e2fsprogs-devel.x86_64 e2fsprogs-libs.x86_64
順利完成：
Configuring extundelete 0.2.4
Writing generated files to disk

安裝：
[root@node1-centos7u6 extundelete-0.2.4]# make
make -s all-recursive
Making all in src
extundelete.cc: In function ‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’:
extundelete.cc:1272:29: warning: narrowing conversion of ‘search_flags’ from ‘int’ to ‘ext2_ino_t {aka unsigned int}’ inside { } [-Wnarrowing]
    buf, match_name2, priv, 0};      警告能夠忽略
                             ^
[root@node1-centos7u6 extundelete-0.2.4]# make install

b.掃描刪除文件

[root@node1-centos7u6 ~]# df -lh
Filesystem               Size  Used Avail Use% Mounted on
/dev/mapper/centos-root   17G  2.0G   16G  12% /
devtmpfs                 979M     0  979M   0% /dev
tmpfs                    991M   53M  938M   6% /dev/shm
tmpfs                    991M  9.6M  981M   1% /run
tmpfs                    991M     0  991M   0% /sys/fs/cgroup
/dev/sda1               1014M  163M  852M  17% /boot
tmpfs                    199M     0  199M   0% /run/user/0
/dev/sdb1                991M  2.6M  922M   1% /test  <----

c.卸載掛載盤

[root@node1-centos7u6 ~]# umount /test/

***Note****必定要umount,防止二次寫入，不然沒法恢復

d.恢復單一文件

[root@node1-centos7u6 ~]# mkdir test-recover
[root@node1-centos7u6 ~]# cd test-recover
[root@node1-centos7u6 test-recover]# extundelete /dev/sdb1  --restore-file reidpasswd
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 8 groups loaded.
Loading journal descriptors ... 185 descriptors loaded.
Successfully restored file reidpasswd
[root@node1-centos7u6 test-recover]# cat RECOVERED_FILES/reidpasswd 
reid:x:112:172::/:/sbin/nologin

e.恢復目錄

[root@node1-centos7u6 test-recover]# extundelete /dev/sdb1  --restore-directory backup
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 8 groups loaded.
Loading journal descriptors ... 185 descriptors loaded.
Searching for recoverable inodes in directory backup ... 
5 recoverable inodes found.
Looking through the directory structure for deleted files ... 
1 recoverable inodes still lost.
[root@node1-centos7u6 test-recover]# ll RECOVERED_FILES/
total 4
drwxr-xr-x. 3 root root 38 Mar 30 14:21 backup
-rw-r--r--. 1 root root 32 Mar 30 14:19 reidpasswd
[root@node1-centos7u6 test-recover]# ll RECOVERED_FILES/backup/
total 4
drwxr-xr-x. 3 root root 19 Mar 30 14:21 delete
-rw-r--r--. 1 root root 32 Mar 30 14:21 reidpasswd