愛華網(wǎng)1. lsof 文件剛剛被刪除，想要恢復(fù)，先嘗試lsof. #lsof |grep data.file1 # cp /proc/xxx/xxx/xx/dir/data.file1
2. 如果lsof不能看到文件，那么就需要使用恢復(fù)軟件進(jìn)行恢復(fù)。要做的第一件事是立刻卸載被誤刪除文件所在的分區(qū)，或者重新以只讀方式掛載此分區(qū)。 umount /dev/part 或 mount -oremount,ro /dev/part 刪除一個文件，就是將文件inode(inode是操作系統(tǒng)尋找文件的目錄，起到索引作用) 節(jié)點中的扇區(qū)指針清除，同時，釋放這些數(shù)據(jù)對應(yīng)的數(shù)據(jù)塊，而真實的文件還存留在磁盤分區(qū)中。但是這些被刪除的文件不一定會一直存留在磁盤中，當(dāng)這些釋放的數(shù)據(jù)塊被操作系統(tǒng)重新分配時，這些被刪除的數(shù)據(jù)就會被覆蓋。因此要立刻卸載分區(qū)。
3. ext3grep 該工具只能用于ext3文件系統(tǒng)，操作步驟不詳細(xì)介紹. 1> unmount /dev/part 2> ext3grep /dev/part --ls --inode 2 ##列出可恢復(fù)文件信息 3>ext3grep /dev/part --restore-inodeN 4>恢復(fù)到 RESTORED_FILES/ 更多命令查看 ext3grep --help
4. extundelete 該工具可以恢復(fù)ext3,ext4.http://extundelete.sourceforge.net/ 1>fuser -k /dev/part&& unmunt /dev/part 2>extundelete --inode2 /dev/part 3>extundelete--restore-inode 13 /dev/part 4>恢復(fù)到RECOVERD_FILES/
root@grid1 ~]# extundelete--helpUsage: extundelete [options] [--]device-fileOptions: --version, -[vV] Printversion and exit successfully. --help, Print this help and exitsuccessfully. --superblock Print contents of superblockin addition to the rest. If no action is specified thenthis option is implied. --journal Show content of journal. --after dtime Only process entries deletedon or after 'dtime'. --before dtime Only process entries deleted before'dtime'.Actions: --inode ino Show infoon inode 'ino'. --block blk Show infoon block 'blk'. --restore-inodeino[,ino,...] Restore the file(s) with knowninode number 'ino'. The restored files are createdin ./RECOVERED_FILES with their inode number asextension (ie, file.12345). --restore-file 'path'Will restore file 'path'. 'path' is relative toroot of the partition and does notstart with a '/' The restored file is createdin the current directory as'RECOVERED_FILES/path'. --restore-files'path' Will restore files which are listed in the file'path'. Each filename should be in thesame format as an option to --restore-file, and thereshould be one per line. --restore-directory'path' Will restore directory 'path'.'path' is relative to the root directory of the filesystem. The restored directory is created in theoutput directory as 'path'. --restore-all Attempts to restoreeverything. -j journal Reads anexternal journal from the named file. -b blocknumber Uses the backup superblock at blocknumber whenopening the file system. -B blocksize Uses blocksize as the blocksize when opening the file system. Thenumber should be the number of bytes. --log 0 Make the programsilent. --log filename Logs all messages to filename.--log D1=0,D2=filename Custom control of log messages withcomma-separatedExamples below: list of options.Dn must be one of info, warn, or--log info,error error.Omission of the '=name' results inmessages--log warn=0 with the specified level to be logged to theconsole.--log error=filename If theparameter is '=0', logging for the specified level will be turned off.If the parameter is '=filename', messages withthat level will be written to filename. -odirectory Save the recovered files tothe named directory. The restored files are createdin a directory named 'RECOVERED_FILES/' bydefault.
看上面的命令就很容易理解，各個參數(shù)的作用。
5.note 1>對于空文件，不會進(jìn)行恢復(fù) 2> 可以恢復(fù)mysql表，由于myisam是單獨3個文件，恢復(fù)出來就能使用。 3>建議innodb，設(shè)置innodb_file_per_table 為 ON，這樣也就能恢復(fù)單表數(shù)據(jù)。 4>從上面可以看出，恢復(fù)工具這能恢復(fù)分區(qū)，所以，建議為應(yīng)用軟件單獨劃區(qū)進(jìn)行安裝， 存放數(shù)據(jù)。
