extundelete 命令详解

| 选择喜欢的代码风格  

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

extundelete 命令安装:


-bash/zsh: extundelete command not found

# Windows (WSL2)
sudo apt-get update sudo apt-get install extundelete

# Debian
apt-get install extundelete

# Ubuntu
apt-get install extundelete

# Arch Linux
pacman -S extundelete

# Kali Linux
apt-get install extundelete

# Fedora
dnf install extundelete

# Raspbian
apt-get install extundelete

# Dockerfile
dockerfile.run/extundelete

extundelete 命令补充说明:


extundelete 是一个实用程序,可以从 ext3ext4 分区恢复已删除的文件。 ext3ext4 文件系统是 Mint、Mageia 或 Ubuntu 等 Linux 发行版中最常见的默认文件系统。

extundelete 使用存储在分区日志中的信息来尝试恢复已从分区中删除的文件。 无法保证任何特定文件都能够被删除,因此请务必尝试拥有良好的备份系统,或者至少在恢复文件后放置一个。

extundelete 命令语法:


extundelete [options] device-file...

extundelete 命令选项:


--version
  Prints the version number of extundelete.

--help
  Print a brief usage summary for extundelete.

Partition name
  Name of the partition that has deleted files, such as /dev/sda3.
  Could also be the file name of a copy of the partition, such as that made with dd.

--superblock
  Prints information about the filesystem from the superblock.

--journal --superblock
  Prints information about the journal from the journal's superblock.

--inode #
  Prints the information from the inode number of the filesystem given, such as "--inode 2".

--block #
  Prints the contents of the block, called as "--block 9652".

--restore-file path/to/deleted/file
  Attempts to restore the file which was deleted at the given filename, called as "--restore-file dirname/filename".

--restore-inode #
  Used to restore inodes by number, called as "--restore-inode 2569".
  Also accepts a list of inodes separated by only commas, such as "--restore-inode 2569,5692,6925".

--restore-files filename
  Restores a list of files. First, construct a list of files in the same style as would be
  used in the --restore-file option, and save it to the file "filename".

  Then, this option may be used to attempt to restore those files with a single call to extundelete.
  This form also reduces redundancy from multiple calls parsing the journal multiple times.

--restore-all
  Restores all files possible to undelete to their names before deletion, when possible. Other files are restored to a filename like "file.NNNN".

--restore-directory path/of/directory
  Restores all files possible to link to specified directory to their names before deletion, when possible.

-j journal_dev
  Specifies the device that is the external journal of the file system.

-b block_number
  Specifies the block number of the backup superblock to be used when opening the file system.

-B block_size
  Specifies the block size of the partition to be used when opening the file system.

--before date
  Only restore files deleted before the date specified, which should be in the form of the number of seconds since the UNIX epoch. Use a shell command like
  $ date -d "Aug 1 9:02" +%s
  to convert a human-readable date to the proper format. The conversion from the number of seconds to a readable format may be found by using either of the following:
  $ date -d@1234567890
  $ perl -le "print scalar localtime 1234567890"

--after date
  Only restore files deleted after the date specified, which should be in the form of the number of seconds since the UNIX epoch.
  See the notes for the --before option for more information.

extundelete 命令实例:


恢复设备 X 上分区 N 内所有已删除的文件:

sudo extundelete /dev/sdXN --restore-all

从相对于 root 的路径恢复文件(路径不要以 / 开头):

extundelete /dev/sdXN --restore-file path/to/file

从相对于 root 的路径恢复目录(路径不要以 / 开头):

extundelete /dev/sdXN --restore-directory path/to/directory

extundelete 恢复2020年1月1日之后删除的所有文件(Unix 时间戳,点这里换算时间戳):

extundelete /dev/sdXN --restore-all --after 1577840400

extundelete 命令扩展阅读:




extundelete 命令评论