1、准备测试数据

[root@xuexi ~]# mkdir /mk

[root@xuexi ~]# mount /dev/sdb1 /mk

[root@xuexi ~]# cp /etc/passwd /mk/rm

[root@xuexi ~]# cp /etc/hosts /mk

[root@xuexi ~]# mkdir -p /mk/a/b/c

[root@xuexi ~]# cp /mk/1.txt /mk/a/b

2、删除数据

[root@xuexi mk]# ls /mk

1.txt  a  hosts  lost+found  rm

[root@xuexi mk]# rm -rf /mk/*

[root@xuexi mk]# ls /mk      

[root@xuexi mk]# umount /mk

3、安装extundelete

[root@xuexi ~]# yum -y install e2fsprogs e2fsprogs-libs  #安装依懒包

[root@xuexi ~]#wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

[root@xuexi test]# tar jxvf extundelete-0.2.4.tar.bz2

[root@xuexi test]# cd extundelete-0.2.4

[root@xuexi extundelete-0.2.4]# ./configure 

[root@xuexi extundelete-0.2.4]# make

[root@xuexi extundelete-0.2.4]# make install

[root@xuexi extundelete-0.2.4]#echo $?

0

4、恢复数据

（1）通过inode号恢复

[root@xuexi ~]# extundelete /dev/sdb1 --inode 2    #为级别

File name                                       | Inode number | Deleted status

.                                                 2

..                                                2

lost+found                                        11             Deleted

rm                                                12             Deleted

hosts                                             13             Deleted

a                                                 7377           Deleted

1.txt                                             15             Deleted

[root@xuexi ~]# cd /tmp/

[root@xuexi tmp]# extundelete /dev/sdb1 --restore-inode 13  #为inode号

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 9 groups loaded.

Loading journal descriptors ... 73 descriptors loaded.

[root@xuexi tmp]# ls

RECOVERED_FILES

[root@xuexi tmp]# cd RECOVERED_FILES/

[root@xuexi RECOVERED_FILES]# cat file.13    #数据恢复成功

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

（2）通过文件名恢复

[root@xuexi mnt]# extundelete /dev/sdb1 --restore-file 1.txt

[root@xuexi mnt]# ls RECOVERED_FILES/

1.txt

[root@xuexi mnt]# cat RECOVERED_FILES/1.txt         #为文件名

112233

2366

899

（3）恢复目录,如a目录

[root@xuexi mnt]# extundelete /dev/sdb1 --restore-directory a  #a为目录名

[root@xuexi mnt]# ls RECOVERED_FILES/

1.txt  a

（4）恢复所有

[root@xuexi mnt]# extundelete /dev/sdb1 --restore-all

注：不能恢复空文件或空目录