爱华网1. lsof 文件刚刚被删除，想要恢复，先尝试lsof. #lsof |grep data.file1 # cp /proc/xxx/xxx/xx/dir/data.file1
2. 如果lsof不能看到文件，那么就需要使用恢复软件进行恢复。要做的第一件事是立刻卸载被误删除文件所在的分区，或者重新以只读方式挂载此分区。 umount /dev/part 或 mount -oremount,ro /dev/part 删除一个文件，就是将文件inode(inode是操作系统寻找文件的目录，起到索引作用) 节点中的扇区指针清除，同时，释放这些数据对应的数据块，而真实的文件还存留在磁盘分区中。但是这些被删除的文件不一定会一直存留在磁盘中，当这些释放的数据块被操作系统重新分配时，这些被删除的数据就会被覆盖。因此要立刻卸载分区。
3. ext3grep 该工具只能用于ext3文件系统，操作步骤不详细介绍. 1> unmount /dev/part 2> ext3grep /dev/part --ls --inode 2 ##列出可恢复文件信息 3>ext3grep /dev/part --restore-inodeN 4>恢复到 RESTORED_FILES/ 更多命令查看 ext3grep --help
4. extundelete 该工具可以恢复ext3,ext4.http://extundelete.sourceforge.net/ 1>fuser -k /dev/part&& unmunt /dev/part 2>extundelete --inode2 /dev/part 3>extundelete--restore-inode 13 /dev/part 4>恢复到RECOVERD_FILES/
root@grid1 ~]# extundelete--helpUsage: extundelete [options] [--]device-fileOptions: --version, -[vV] Printversion and exit successfully. --help, Print this help and exitsuccessfully. --superblock Print contents of superblockin addition to the rest. If no action is specified thenthis option is implied. --journal Show content of journal. --after dtime Only process entries deletedon or after 'dtime'. --before dtime Only process entries deleted before'dtime'.Actions: --inode ino Show infoon inode 'ino'. --block blk Show infoon block 'blk'. --restore-inodeino[,ino,...] Restore the file(s) with knowninode number 'ino'. The restored files are createdin ./RECOVERED_FILES with their inode number asextension (ie, file.12345). --restore-file 'path'Will restore file 'path'. 'path' is relative toroot of the partition and does notstart with a '/' The restored file is createdin the current directory as'RECOVERED_FILES/path'. --restore-files'path' Will restore files which are listed in the file'path'. Each filename should be in thesame format as an option to --restore-file, and thereshould be one per line. --restore-directory'path' Will restore directory 'path'.'path' is relative to the root directory of the filesystem. The restored directory is created in theoutput directory as 'path'. --restore-all Attempts to restoreeverything. -j journal Reads anexternal journal from the named file. -b blocknumber Uses the backup superblock at blocknumber whenopening the file system. -B blocksize Uses blocksize as the blocksize when opening the file system. Thenumber should be the number of bytes. --log 0 Make the programsilent. --log filename Logs all messages to filename.--log D1=0,D2=filename Custom control of log messages withcomma-separatedExamples below: list of options.Dn must be one of info, warn, or--log info,error error.Omission of the '=name' results inmessages--log warn=0 with the specified level to be logged to theconsole.--log error=filename If theparameter is '=0', logging for the specified level will be turned off.If the parameter is '=filename', messages withthat level will be written to filename. -odirectory Save the recovered files tothe named directory. The restored files are createdin a directory named 'RECOVERED_FILES/' bydefault.
看上面的命令就很容易理解，各个参数的作用。
5.note 1>对于空文件，不会进行恢复 2> 可以恢复mysql表，由于myisam是单独3个文件，恢复出来就能使用。 3>建议innodb，设置innodb_file_per_table 为 ON，这样也就能恢复单表数据。 4>从上面可以看出，恢复工具这能恢复分区，所以，建议为应用软件单独划区进行安装， 存放数据。
