一：环境搭建
1.下载http://extundelete.sourceforge.net/
2.安装e2fsprogs和e2fsprogs-libs
yum install e2fsprogs e2fsprogs-libs -y
3.上传文件至linux主机
put C:/Users/CPIC/Desktop/extundelete-0.2.4.tar.bz2
4.安装软件
tar jxvf extundelete-0.2.4.tar.bz2cd /root/extundelete-0.2.4./configuremake & make install
报错：（1）configure: error: in `/root/Desktop/extundelete-0.2.4': configure: error: C++ compiler cannot create executables 解决：yum install gcc* -y （2）Configuring extundelete 0.2.4 configure: error: Can't find ext2fs library解决：yum install e2fsprogs* -y
二：实验
mkdir /shiyan #创建挂载目录fdisk /dev/sdb #划分为一个主分区 n-p-1-wmount /dev/sdb1 /shiyan #挂载cp -a /etc/passwd /shiyan/ #复制文件cd /shiyanrm -rf passwd #删除文件umount /shiyan #卸载文件系统[root@node1 /]# extundelete /dev/sdb1 --inode 2 #查看inode信息，重要！！NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Group: 0Contents of inode 2:0000 | ed 41 00 00 00 10 00 00 7c 8f ed 59 77 8f ed 59 | .A......|..Yw..Y0010 | 77 8f ed 59 00 00 00 00 00 00 02 00 08 00 00 00 | w..Y............0020 | 00 00 00 00 03 00 00 00 49 00 00 00 00 00 00 00 | ........I.......0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................0080 | 1c 00 00 00 00 19 23 02 00 19 23 02 dc ff 9c b1 | ......#...#.....0090 | 33 8f ed 59 00 00 00 00 00 00 00 00 00 00 00 00 | 3..Y............00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................Inode is AllocatedFile mode: 16877Low 16 bits of Owner Uid: 0Size in bytes: 4096Access time: 1508740988Creation time: 1508740983Modification time: 1508740983Deletion Time: 0Low 16 bits of Group Id: 0Links count: 2Blocks count: 8File flags: 0File version (for NFS): 0File ACL: 0Directory ACL: 0Fragment address: 0Direct blocks: 73, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0Indirect block: 0Double indirect block: 0Triple indirect block: 0File name | Inode number | Deleted status. 2.. 2lost+found 11 Deletedpasswd 12 Deleted
恢复单个文件：extundelete /dev/sdb1 --restore-file 原来文件存储的相对路径
原来文件的存储路径为/data/passwd ,那么参数后面直接指定passwd；如果原来的文件路径为/data/test/passwd,那么参数后面test/passwd.
恢复单个目录：extundelete /dev/sdb1 --restore-directory /aaa
原来存储目录路径为： /data/aaa
恢复所有删除的数据：extundelete /dev/sdb1 --restore-all
最后在当前目录下的RECOVERED_FILES目录中找到误删的文件。
注意：删除的第一时间要卸载文件系统。
本文出自 “独上高楼,望尽天涯路” 博客，请务必保留此出处http://nxyboy.blog.51cto.com/10511646/1975244