extundelete: An ext3 and ext4 file undeletion utility

http://extundelete.sourceforge.net

자신 혹은 타인의 실수로 인해 중요한 정보가 삭제된 기억이 있을것입니다.

이럴때 지푸라기잡는 심정으로, 복구업체를 방문하기는 하나, 비싼 금액을 보고 깜짝놀랬던 기억이 있는 분이 계실텐데요.( 참고로 필자는 하드웨어엔지니어시절 RAID를 잘못 만지어 식겁했던적이....다행히...최악의 상황을 면했지....;;)

아무튼 그건 그렇다치고, 생활속의 사용자실수로 생기는 일들이 여러있지만, 그 한가운데가 디렉토리삭제 아님 파일삭제일것입니다. (rm -rf /<directorry) or rm -f .* 등)

여러 오픈소스툴들이 있지만 제가 사용해본것중 하나를 포스팅하고자 합니다

물론 저보다 유익한 정보를 아시는 분이 많겠지만요;;

여느 오픈소스툴들이 그렇치만 설치 및 사용법은 간단합니다.

1. e2fsprogs 설치

# yum install  e2fsprogs-devel  e2fsprogs e2fsprogs-libs

Dependencies Resolved
===========================================================================
Package             Arch      Version            Repository               Size
================================================================================
Installing:
e2fsprogs-devel     x86_64    1.41.12-11.el6     rhel-x86_64-server-6    158 k
Updating:
e2fsprogs           x86_64    1.41.12-11.el6     rhel-x86_64-server-6    550 k
e2fsprogs-libs      x86_64    1.41.12-11.el6     rhel-x86_64-server-6    119 k
Updating for dependencies:
libcom_err          x86_64    1.41.12-11.el6     rhel-x86_64-server-6     36 k
libcom_err-devel    x86_64    1.41.12-11.el6     rhel-x86_64-server-6     31 k
libss               x86_64    1.41.12-11.el6     rhel-x86_64-server-6     40 k
Transaction Summary
================================================================================
Install       1 Package(s)
Upgrade       5 Package(s)
Total download size: 934 k
Is this ok [y/N]: y
Downloading Packages:
(1/6): e2fsprogs-1.41.12-11.el6.x86_64.rpm                                               | 550 kB     00:14   
(2/6): e2fsprogs-devel-1.41.12-11.el6.x86_64.rpm                                         | 158 kB     00:01   
(3/6): e2fsprogs-libs-1.41.12-11.el6.x86_64.rpm                                          | 119 kB     00:01   
(4/6): libcom_err-1.41.12-11.el6.x86_64.rpm                                              |  36 kB     00:00   
(5/6): libcom_err-devel-1.41.12-11.el6.x86_64.rpm                                        |  31 kB     00:01   
(6/6): libss-1.41.12-11.el6.x86_64.rpm                                                   |  40 kB     00:00   
----------------------------------------------------------------------------------------------------------------
Total                                                                            16 kB/s | 934 kB     00:59   
 Updating   : libcom_err-1.41.12-11.el6.x86_64                                                            1/11
 Updating   : e2fsprogs-libs-1.41.12-11.el6.x86_64                                                        2/11
 Updating   : libcom_err-devel-1.41.12-11.el6.x86_64                                                      3/11
 Updating   : libss-1.41.12-11.el6.x86_64                                                                 4/11
 Updating   : e2fsprogs-1.41.12-11.el6.x86_64                                                             5/11
 Installing : e2fsprogs-devel-1.41.12-11.el6.x86_64                                                       6/11
 Cleanup    : libcom_err-devel-1.41.12-7.el6.x86_64                                                       7/11
 Cleanup    : e2fsprogs-1.41.12-7.el6.x86_64                                                              8/11
 Cleanup    : e2fsprogs-libs-1.41.12-7.el6.x86_64                                                         9/11
 Cleanup    : libss-1.41.12-7.el6.x86_64                                                                 10/11
 Cleanup    : libcom_err-1.41.12-7.el6.x86_64                                                            11/11
duration: 562(ms)
Installed products updated.
Installed:
 e2fsprogs-devel.x86_64 0:1.41.12-11.el6                                                                    
Updated:
 e2fsprogs.x86_64 0:1.41.12-11.el6                    e2fsprogs-libs.x86_64 0:1.41.12-11.el6                 
Dependency Updated:
 libcom_err.x86_64 0:1.41.12-11.el6  libcom_err-devel.x86_64 0:1.41.12-11.el6  libss.x86_64 0:1.41.12-11.el6
Complete!


2. extundelete 다운로드
http://sourceforge.net/projects/extundelete/

# wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

Resolving gnutoolbox.com... 208.43.81.58
Connecting to gnutoolbox.com|208.43.81.58|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 563200 (550K) [application/x-tar]
Saving to: “extundelete-0.2.4.tar”
100%[======================================================================>] 563,200      111K/s   in 5.0s 
2012-03-06 13:13:24 (111 KB/s) - “extundelete-0.2.0.tar” saved [563200/563200]

# ls
anaconda-ks.cfg  extundelete-0.2.0.tar  install.log  install.log.syslog

# tar xvf extundelete-0.2.4.tar
# cd extundelete-0.2.4
# ls
acinclude.m4  autogen.sh  config.h.in  configure.ac  install-sh  Makefile.am  missing  src
aclocal.m4    compile     configure    depcomp       LICENSE     Makefile.in  README

3. Configure and make

# ./configure
Configuring extundelete 0.2.0
Writing generated files to disk

# make && make install
make -s all-recursive
Making all in src
Making install in src
 /usr/bin/install -c 'extundelete' '/usr/local/bin/extundelete'

4. 별도의 /dev/sdb1 이라는 디바이스에 파티션을 생성하고 마운트합니다.

# mount /dev/sdb1 /backup
# mkdir -p /backup/delete/


# man man > test1.txt
# man man > test2.txt
# man man > test3.txt
# du -hs *
16K    test1.txt
16K    test2.txt
16K    test3.txt

5. 생성한 파일을 포함하여, 디렉토리를 삭제하도록 합니다.

# rm -rf /backup/gnutool-delete

6. /dev/sdb1(backup) read만 가능하도록 remount변환하도록 하고 extundelete명령어를 통해 복구를 시도합니다.

# mount -o remount,ro /backup


# extundelete /dev/sdb1  --restore-all
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 63 groups loaded.
Loading journal descriptors ... 91 descriptors loaded.
Searching for recoverable inodes in directory / ...
4 recoverable inodes found.
Looking through the directory structure for deleted files ...
Failed to restore inode 32513 to file RECOVERED_FILES/delete:Inode does not correspond to a regular file.
Restored inode 32514 to file RECOVERED_FILES/delete/test1.txt
Restored inode 32515 to file RECOVERED_FILES/delete/test2.txt
Restored inode 32516 to file RECOVERED_FILESdelete/test3.txt
0 recoverable inodes still lost.

7. 복구된 파일이 정상적으로 보이는지 확인합니다.

# du -hs RECOVERED_FILES/delete/
52K    RECOVERED_FILES/delete/

8. 복구된 파일을 rsync or mv 명령어를 통해 다른 디렉토리를 옮기도록 합니다.


# rsync -av  RECOVERED_FILES/delete /backup/
sending incremental file list
delete/
delete/test1.txt
delete/test2.txt
delete/test3.txt
sent 106931 bytes  received 73 bytes  214008.00 bytes/sec
total size is 106704  speedup is 1.00

# cd /backup/delete/

# ls

# du -hs /backup/delete/*
16K    RECOVERED_FILES/delete/test1.txt
16K    RECOVERED_FILES/delete/test2.txt
16K    RECOVERED_FILES/delete/test3.txt