如果你误删除了一些重要文件,记住,不要再做任何写操作了,比如创建文件,写文件什么的了. 特别是,如果删除了系统的重要部分,比如/usr,/etc,/var等什么的(本文描述的就是这种情况)...囧orz.. 在这种情况下..赶紧要关闭电脑....进入Live系统...安装extundelete并恢复文件,总体的流程如下:

使用extundelete恢复Ext3/Ext4文件

wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 
sudo apt-get install e2fsprogs 
sudo apt-get install e2fslibs-dev 
sudo apt-get install build-essential 
然后编译安装并恢复文件

安装依赖项

然而,一般都不会那么顺,中间总是会出现各种问题,下面是一些问题的解决方法,希望对你有所帮助.

第一条命令:sudo apt-get install e2fslibs-dev 
The following packages have unmet dependencies:
 e2fslibs-dev : Depends: comerr-dev but it is not going to be installed
                Depends: e2fslibs (= 1.42.9-3ubuntu1) but 1.42.9-3ubuntu1.2 is to be installed
E: Unable to correct problems, you have held broken packages.
comerr-dev和e2fslibs依赖项不满足.
先来安装指定版本的e2fslibs即可:
sudo apt-get install e2fslibs=1.42.9-3ubuntu1
接下来再安装:comerr-dev:
sudo apt-get install comerr-dev
The following packages have unmet dependencies:
 comerr-dev : Depends: libcomerr2 (= 1.42.9-3ubuntu1) but 1.42.9-3ubuntu1.2 is to be installed
也是安装指定的版本:
sudo apt-get install  libcomerr2=1.42.9-3ubuntu1
最后安装build-essential:
sudo apt-get install build-essential 
build-essential : Depends: g++ (>= 4:4.4.3) but it is not going to be installed
                   Depends: dpkg-dev (>= 1.13.5) but it is not going to be installed
此时你需要更新源列表,然后执行:
sudo apt-get update
上述命令没有任何错误时(可能需要重复执行几次apt-get update),再安装build-essential即可.

编译extundelete

首先切换为root权限,然后进行编译:

ubuntu@ubuntu:/tmp/extundelete-0.2.4$ sudo -i
root@ubuntu:~# cd /tmp/extundelete-0.2.4/
root@ubuntu:/tmp/extundelete-0.2.4# make && make install
make -s all-recursive
Making all in src
Making install in src
  /usr/bin/install -c extundelete '/usr/local/bin'

如你所见,程序安装后被放在/usr/local/bin下面,我们转到该目录下测试一下该程序:

root@ubuntu:/tmp/extundelete-0.2.4# cd /usr/local/bin
root@ubuntu:/usr/local/bin# ./extundelete -v
extundelete version 0.2.4
libext2fs version 1.42.9
Processor is little endian.

以上说明安装成功.

使用extundelete来恢复文件

使用sudo fdisk -l来查看自己自己要恢复的分区,这里假设为/dev/sda7 然后查看该分区下被删除的文件(分区根目录的节点一般为2):

root@ubuntu:/usr/local/bin# extundelete /dev/sda7 --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 448 groups loaded.
//省略一部分输出..
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
etc                                               523265         Deleted
media                                             3401217
bin                                               2616321        Deleted
boot                                              261633
dev                                               2877953
home                                              2093057
lib                                               130817         Deleted
lib64                                             1046529
mnt                                               654081
opt                                               784897
proc                                              392449
root                                              915713
run                                               1177345
sbin                                              1308161
srv                                               2354689
sys                                               1438977
tmp                                               1569793        Deleted
usr                                               1831425        Deleted
var                                               1962241        Deleted
vmlinuz                                           12
initrd.img                                        13
cdrom                                             654082
updmap.texmf.new                                  20216          Deleted
lib32                                             1700609
updmap.texlive.new                                20217          Deleted

需要注意的是显示的deleted状态并不是完全都正确的,使用下面的命令恢复:

选取恢复全部:
extundelete --restore-all /dev/sda7

恢复指定文件:
extundelete --restore-file filename /dev/sda7

恢复的文件保存在当前目录的RECOVERED_FILES文件夹下面.

使用ntfsundelete恢复ntfs文件

使用df查看你的分区:

bugnofree@ishell~$ df -hl
Filesystem      Size  Used Avail Use% Mounted on
...
/dev/sdb7       121G  100G   21G  84% /mnt/data
...

现在我要恢复/mnt/data下面的文件,那么首先卸载该NTFS分区:

 umount /dev/sdb7

查看近期删除的数据:

ntfsundelete /dev/sdb7 -t 1d

其中-t指定了天数,1d就是1天的意思.它会给出删除的文件以及Inode节点. 找到你想恢复的文件,使用下面命令恢复:

 ntfsundelete /dev/sdb7 -u -i INODE -d /path/to/save/

其中,INODE为你删除的文件的节点值(Inode),/path/to/sava为保存恢复文件的路径, 注意,它无法恢复整个文件夹,只可以单个文件逐一恢复.