实验二：恢复误删除的文件
实验步骤
- 编译安装extundelete软件包
- 模拟删除并执行恢复操作
实验过程
1.编译安装extundelete软件包
解压缩
[root@Daring /]# cd /root/Documents/
[root@Daring Documents]# ls
extundelete-0.2.4.tar.bz2 home.bak.tar.gizp
[root@Daring Documents]# tar xjf extundelete-0.2.4.tar.bz2
[root@Daring Documents]# cd extundelete-0.2.4
[root@Daring extundelete-0.2.4]# ls
acinclude.m4 autogen.sh configure depcomp LICENSE Makefile.in README
aclocal.m4 config.h.in configure.ac install-sh Makefile.am missing src
编译安装
[root@Daring extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
configure: error: Can't find ext2fs library //提示没有找到ext2fs library
[root@Daring extundelete-0.2.4]# make
make: *** No targets specified and no makefile found. Stop.
查看依赖的包并重新安装
[root@Daring extundelete-0.2.4]# rpm -qa | e2fsprogs
bash: e2fsprogs: command not found
[root@Daring extundelete-0.2.4]# rpm -qa | grep e2fsprogs
e2fsprogs-libs-1.41.12-18.el6.x86_64
e2fsprogs-1.41.12-18.el6.x86_64
[root@Daring extundelete-0.2.4]# rpm -qa | grep libcom_err
libcom_err-1.41.12-18.el6.x86_64
[root@Daring extundelete-0.2.4]# rpm -qa | grep e2fsprogs-devel
[root@Daring extundelete-0.2.4]# cd /mnt
[root@Daring mnt]# mount /dev/cdrom1 /mnt
mount: block device /dev/sr0 is write-protected, mounting read-only
[root@Daring mnt]# cd /mnt/Packages/
[root@Daring Packages]# rpm -ivh e2fsprogs-
e2fsprogs-1.41.12-18.el6.x86_64.rpm e2fsprogs-libs-1.41.12-18.el6.i686.rpm
e2fsprogs-devel-1.41.12-18.el6.i686.rpm e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
[root@Daring Packages]# rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
error: Failed dependencies:
libcom_err-devel = 1.41.12-18.el6 is needed by e2fsprogs-devel-1.41.12-18.el6.x86_64
pkgconfig(com_err) is needed by e2fsprogs-devel-1.41.12-18.el6.x86_64
[root@Daring Packages]# rpm -ivh libcom_err-devel-1.41.12-18.el6.x86_64.rpm
warning: libcom_err-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
Preparing... ########################################### [100%]
1:libcom_err-devel ########################################### [100%]
[root@Daring Packages]# cd /root/Documents/extundelete-0.2.4
[root@Daring extundelete-0.2.4]# make
make: *** No targets specified and no makefile found. Stop.
[root@Daring extundelete-0.2.4]# cd -
/mnt/Packages
[root@Daring Packages]# rpm -ivh e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
Preparing... ########################################### [100%]
package e2fsprogs-libs-1.41.12-18.el6.x86_64 is already installed
[root@Daring Packages]# rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
Preparing... ########################################### [100%]
1:e2fsprogs-devel ########################################### [100%]
[root@Daring Packages]# cd -
/root/Documents/extundelete-0.2.4
从上面的过程可以看出来，主要是缺少了两个包
- libcom_err-devel-1.41.12-18.el6.x86_64.rpm
- e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
重新编译安装
./configure
[root@Daring extundelete-0.2.4]# ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
make
[root@Daring extundelete-0.2.4]# make
make -s all-recursive
Making all in src
extundelete.cc:571: warning: unused parameter ‘flags’
[root@Daring extundelete-0.2.4]# cd /src
bash: cd: /src: No such file or directory
makeinstall
[root@Daring extundelete-0.2.4]# cd s
src/ stamp-h1
[root@Daring extundelete-0.2.4]# cd src/
[root@Daring src]# make install
g++ -g -O2 -std=c++0x -W -Wall -DPROG="\"extundelete\"" -DVERSION="\"0.2.4\"" -o
extundelete extundelete-extundelete.o extundelete-cli.o extundelete-block.o
extundelete -insertionops.o -lcom_err -lext2fs
make[1]: Entering directory `/root/Documents/extundelete-0.2.4/src'
g++ -g -O2 -std=c++0x -W -Wall -DPROG="\"extundelete\"" -DVERSION="\"0.2.4\""
-o extundelete extundelete-extundelete.o extundelete-cli.o
extundelete-block.o extundelete-insertionops.o -lcom_err -lext2fs
test -z "/usr/local/bin" || /bin/mkdir -p "/usr/local/bin"
/usr/bin/install -c extundelete '/usr/local/bin'
make[1]: Nothing to be done for `install-data-am'.
make[1]: Leaving directory `/root/Documents/extundelete-0.2.4/src'
[root@Daring src]# extundelete //tab可以补齐，说明编译安装已经成功
2.模拟删除并执行恢复操作
删除testinode当中的test
[root@Daring testinode]# ls
a_10001 a_10004 a_10007 a_10010 a_10013 a_10016 a_10019 a_10022 a_10025 lost+found
a_10002 a_10005 a_10008 a_10011 a_10014 a_10017 a_10020 a_10023 a_10026 test
a_10003 a_10006 a_10009 a_10012 a_10015 a_10018 a_10021 a_10024 a_10027
[root@Daring testinode]# cat test
123123
[root@Daring testinode]# rm -rf test
[root@Daring testinode]# ls
a_10001 a_10004 a_10007 a_10010 a_10013 a_10016 a_10019 a_10022 a_10025 lost+found
a_10002 a_10005 a_10008 a_10011 a_10014 a_10017 a_10020 a_10023 a_10026
a_10003 a_10006 a_10009 a_10012 a_10015 a_10018 a_10021 a_10024 a_10027
恢复
[root@Daring testinode]# extundelete /dev/sde4 --restore-file test
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 5 groups loaded.
Loading journal descriptors ... 3507 descriptors loaded.
Successfully restored file test
[root@Daring testinode]# ls
a_10001 a_10004 a_10007 a_10010 a_10013 a_10016 a_10019 a_10022 a_10025 lost+found
a_10002 a_10005 a_10008 a_10011 a_10014 a_10017 a_10020 a_10023 a_10026 RECOVERED_FILES
a_10003 a_10006 a_10009 a_10012 a_10015 a_10018 a_10021 a_10024 a_10027
[root@Daring testinode]# cd RECOVERED_FILES/
[root@Daring RECOVERED_FILES]# ls
test
[root@Daring RECOVERED_FILES]# cat test
123123
[root@Daring RECOVERED_FILES]#
卸载后恢复
[root@Daring ~]# umount /dev/sde4
[root@Daring ~]# cd /root/Documents/
[root@Daring Documents]# extundelete /dev/sde4 --restore-file create.sh
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 5 groups loaded.
Loading journal descriptors ... 3509 descriptors loaded.
Successfully restored file create.sh
[root@Daring Documents]# mount | grep "/dev/sde4"
[root@Daring Documents]# cd
查看恢复结果
[root@Daring Documents]# ls
extundelete-0.2.4 extundelete-0.2.4.tar.bz2 home.bak.tar.gizp RECOVERED_FILES
[root@Daring Documents]# cd RECOVERED_FILES/
[root@Daring RECOVERED_FILES]# ls
create.sh
[root@Daring RECOVERED_FILES]# cat create.sh
#!/bin/bash
for n in $(seq 1 10000)
do
rm -rf a_$n
done
[root@Daring RECOVERED_FILES]#
没有实现的恢复
[root@Daring RECOVERED_FILES]# rm -rf a*
[root@Daring RECOVERED_FILES]# ls
test
[root@Daring RECOVERED_FILES]# cd
[root@Daring ~]# umount /dev/sde4
[root@Daring ~]# cd /root/Documents/
[root@Daring Documents]# extundelete /dev/sde4 --restore-file a_10001
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 5 groups loaded.
Loading journal descriptors ... 3509 descriptors loaded.
Unable to restore inode 10014 (a_10001): No undeleted copies found in the journal.
Unable to restore file a_10001
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
[root@Daring Documents]# cd /testinode/