本人环境配置
ubuntu: 17.04问题描述
误删了某个文件, 并清空了回收站 , 或者 rm 命令删除文件.
解决方法
因为文件系统为ext4, 所以需要安装 extundelete, $ sudo apt-get install extundelete
查看挂载的分区, 误删文件所在分区挂载在 /dev/sda2
$ df -h 2 ↵
文件系统 容量 已用 可用 已用% 挂载点
udev 3.9G 0 3.9G 0% /dev
/dev/sda2 212G 115G 87G 58% /
tmpfs 3.9G 22M 3.9G 1% /dev/shm
tmpfs 5.0M 4.0K 5.0M 1% /run/lock
...恢复指定目录的文件.
$ sudo extundelete /dev/sda2 --restore-directory /path/to/itaken.github.io
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 1722 groups loaded.
Loading journal descriptors ... 30645 descriptors loaded.
Searching for recoverable inodes in directory /path/to/itaken.github.io ...
287 recoverable inodes found.
Looking through the directory structure for deleted files ...
287 recoverable inodes still lost.
No files were undeleted.发现在用户目录下的RECOVERED_FILES 没有任何恢复的文件. 尝试 恢复全部的文件:
$ sudo extundelete /dev/sda2 --restore-all在 用户目录RECOVERED_FILES下可以看到恢复的文件:
找不到需要恢复的文件, 则可以尝试使用 grep, 查找碎片文件内容
$ cd RECOVERED_FILES
$ grep -rHn "keyword" > tmp.txt
