今天发布一篇对Linux系统的Ext4文件系统格式删除文件恢复的博文,希望对有些网友和计算机爱好都有帮助，在工作环境中也是很适用。不过我建议各位最好在系统中建一个目录专用于回收站，以免出现不必要的麻烦，废话少说，我们现在开始。
1.安装软件(extundelete依赖于系统的e2fsprogs三个软件包)
[root@redhat1 home]# mkdir /mnt/cdrom --创建光盘挂载目录
[root@redhat1 home]# mount /dev/cdrom /mnt/cdrom --挂载光盘
mount: block device /dev/sr0 is write-protected, mounting read-only
[root@redhat1 home]# vim /etc/yum.repos.d/base.repo --配置系统的本地源
[base]
name=base
baseurl=file:///mnt/cdrom
enabled=1
gpgcheck=1
gpgkey=file:///mnt/cdrom/RPM-GPG-KEY-REDHAT-6
[root@redhat1 home]# yum install e2fs* --安装extundelete软件的依赖包
[root@redhat1 home]# rpm -aq |grep e2fs --检查软件包是否安装
e2fsprogs-devel-1.41.12-14.el6.i686
e2fsprogs-libs-1.41.12-14.el6.i686
e2fsprogs-1.41.12-14.el6.i686
[root@redhat1 home]#wget
http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
--下载extundelete软件包
[root@redhat1 home]# tar xvf extundelete-0.2.4.tar.bz2 --解压软件包
[root@redhat1 home]# cd extundelete-0.2.4 --进入软件包
[root@redhat1 ext3grep-0.10.2]# ./configure --prefix=/usr/local/extundelete && make && make install --安装软件
[root@redhat1 ext3grep-0.10.2]# ll /usr/local/ |grep ext --查看软件安装成功
drwxr-xr-x. 3 root root 4096 Dec 2 17:24 extundelete
[root@redhat1 ext3grep-0.10.2]#
2.创建块设备并挂载系统
[root@redhat1 home]# dd if=/dev/zero of=123 bs=1M count=100 --在home目录下新建一个块设备123
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.634943 s, 165 MB/s
[root@redhat1 home]# mkfs.ext4 123 --格式化块设备
mke2fs 1.41.12 (17-May-2010)
123 is not a block special device.
Proceed anyway? (y,n) y --输入y确定
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
25688 inodes, 102400 blocks
5120 blocks (5.00%) reserved for the super user
First data block=1
Maximum filesystem blocks=67371008
13 block groups
8192 blocks per group, 8192 fragments per group
1976 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 27 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
[root@redhat1 home]#mkdir /mnt/123 --新建块设备挂载的目录
[root@redhat1 home]# mount 123 /mnt/123 -o loop --将块设备123挂载到/mnt/123中
[root@redhat1 home]# df -TH --查看目录是否挂载
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
ext4 20G 3.8G 16G 20% /
tmpfs tmpfs 262M 0 262M 0% /dev/shm
/dev/sda1 ext4 508M 32M 451M 7% /boot
df: `/mnt/cdrom': No such file or directory
/dev/sr0 iso9660 3.2G 3.2G 0 100% /mnt
/home/123 ext4 102M 5.8M 91M 7% /mnt/123 --设备已挂载
3.添加和删除文件
[root@redhat1 home]# cp -a /etc/passwd /etc/shadow /etc/group /mnt/123/ --将文件移动到设备中
[root@redhat1 ~]# ll /mnt/123/ --查看是否有文件
total 19
-rw-r--r--. 1 root root 712 Dec 2 14:39 group
drwx------. 2 root root 12288 Dec 4 14:07 lost+found
-rw-r--r--. 1 root root 1509 Dec 2 14:39 passwd
----------. 1 root root 976 Dec 2 14:39 shadow
[root@redhat1 home]# sync --文件同步一下
[root@redhat1 home]# rm -rf /mnt/123/passwd /mnt/123/shadow --删除文件
[root@redhat1 home]# sync --文件同步一下
[root@redhat1 home]# umount /mnt/123 --卸载设备
4.恢复刚才删除的文件
[root@redhat1 bin]# cd /usr/local/extundelete/bin --进入软件目录
[root@redhat1 bin]# ./extundelete --ls --inode 2 /home/123 --查看块设备/home/123的文件详细信息
./extundelete: unrecognized option '--ls'
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 04 00 00 fe c6 9e 52 58 c7 9e 52 | .A.........RX..R
0010 | 58 c7 9e 52 00 00 00 00 00 00 03 00 02 00 00 00 | X..R............
0020 | 00 00 00 00 05 00 00 00 10 01 00 00 00 00 00 00 | ................
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 1024
Access time: 1386137342
Creation time: 1386137432
Modification time: 1386137432
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 3
Blocks count: 2
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 272, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11
passwd 12 Deleted --Delete就是我们刚才删除的文件
shadow 13 Deleted
group 14
[root@redhat1 bin]# ./extundelete --restore-file passwd /home/123 --用文件名来恢复文件
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 27 descriptors loaded.
Successfully restored file passwd --恢复成功
[root@redhat1 bin]# ./extundelete --restore-inode 13 /home/123 --用节点号来恢复文件
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 27 descriptors loaded.
[root@redhat1 bin]# ./extundelete --restore-all /home/123 --恢复所有删除的文件
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 13 groups loaded.
Loading journal descriptors ... 27 descriptors loaded.
Searching for recoverable inodes in directory / ...
2 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.
[root@redhat1 bin]# ll RECOVERED_FILES/ --查看所有恢复的文件
total 20
drwxr-xr-x. 2 root root 4096 Dec 3 16:21 123
-rw-r--r--. 1 root root 976 Dec 4 14:18 file.13
-rw-r--r--. 1 root root 1509 Dec 4 14:16 passwd
-rw-r--r--. 1 root root 1509 Dec 4 14:20 passwd.v1
-rw-r--r--. 1 root root 976 Dec 4 14:20 shadow
[root@redhat1 bin]#
！！！！！！好了大功告成，也祝大家成功
注明:Linux系统中对Ext3文件系统删除后恢复:http://597011036.blog.51cto.com/6214144/1335821