红帽RHCE9.0课程介绍红帽RHCA云技术课程介绍linux不像windows有个回收站使用rm -rf *基本上文件是找不回来的。那么问题来了对于linux下误删的文件我们是否真的无法通过软件进行恢复呢?答案当然是否定的对于误删的文件我们还是能通过软件恢复过来的。对于误删文件还原可以分为两种情况:一种是删除以后在进程存在删除信息一种是删除以后进程都找不到只有借助于工具还原。接下来以例子分别解说下两种不同的误删还原方式误删除文件进程还在的情况:这种一般是有活动的进程存在持续标准输入或输出到时文件被删除后进程PID依旧存在。这也是有些服务器删除一些文件但是磁盘不释放的原因。打开一个终端对一个测试文件做cat追加操作[rootdocking ~]# echo This is DeleteFile test. deletefile.txt[rootdocking ~]# lsdeletefile.txt[rootdocking ~]# cat deletefile.txtAdd SomeLine into deletefile for fun.打开另外一个终端查看这个文件可以清楚看到内容[rootdocking ~]# lsdeletefile.txt[rootdocking ~]# cat deletefile.txtThis is DeleteFile test.Add SomeLine into deletefile for fun.此时删除文件rm -f deletefile.txt[rootdocking ~]# rm -f deletefile.txt[rootdocking ~]# ls命令查看这个目录文件已经不存在了那么现在我们将其恢复出来。lsof查看删除的文件进程是否还存在。如没有安装请自行yum install lsof或者apt-get install lsof1.类似这种情况我们可以先lsof查看删除的文件 是否还在[rootdocking ~]# lsof | grep deletefilecat 21796 root 1w REG 253,1 63 138860 /root/deletefile.txt (deleted)2.恢复cp /proc/pid/fd/1 /指定目录/文件名进入 进程目录一般是进入/proc/pid/fd/,针对当前情况[rootdocking ~]# cd /proc/21796/fd[rootdocking fd]# ll总用量 0lrwx------ 1 root root 641月 1822:210 - /dev/pts/0l-wx------ 1 root root 641月 1822:211 - /root/deletefile.txt (deleted)lrwx------ 1 root root 641月 1822:212 - /dev/pts/0恢复操作[rootdocking fd]# cp 1 ~/deletefile.txt.backup[rootdocking fd]# cat ~/deletefile.txt.backupThis is DeleteFile test.Add SomeLine into deletefile forfun.3.恢复完成。误删除的文件进程已经不存在借助于工具还原准备一些文件目录准备一份挂载的盘mkdir backuptestcd backuptestmkdir deletetestmkdir deletetest/innerfolderecho Delete a folder test. deletetest/innerfolder/deletefile.txtecho tcpdump:x:172:72::/:/sbin/nologin tmppasswd最后准备的目录结构如下taroballstaroballs-PC:/media/taroballs/taroballs/backuptest$ cd ..taroballstaroballs-PC:/media/taroballs/taroballs$ tree backuptest/backuptest/├── deletetest│ └── innerfolder│ └── deletefile.txt└── tmppasswd2 directories, 2 files现在开始删除该目录rm -rf backuptest/taroballstaroballs-PC:/media/taroballs/taroballs$ rm -rf backuptest/taroballstaroballs-PC:/media/taroballs/taroballs$ ls -l总用量 0这种情况一般是没有守护进行或者后台进程对其持续输入所以删除就真的删除了。lsof也看不到故需要采用工具进行恢复。现在开始进行误删除文件的恢复。我们采用的工具是extundelete第三方工具。恢复步骤以及注意事项如下停止对当前分区做任何操作防止inode被覆盖。inode被覆盖基本就告别恢复了。夸张一点讲比如停止所在分区的服务卸载目录所在的设备有必要的情况下都可以断网。通过dd命令对 当前分区进行备份防止第三方软件恢复失败导致数据丢失。适合数据非常重要的情况这里是例子所以就没有备份如备份可以考虑如下方式dd if/path/filename of/dev/vdc1通过umount命令对当前设备分区卸载。或者fuser 命令umount /dev/vdb1如果提示设备busy可以用fuser命令强制卸载fuser -m -v -i -k ./下载第三方工具extundelete安装搜索误删除的文件进行还原extundelete工具安装extundelete下载地址http://extundelete.sourceforge.net/wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2解压该文件tar jxvf extundelete-0.2.4.tar.bz2若报这种错误[rootdocking ~]# tar jxvf extundelete-0.2.4.tar.bz2tar (child): bzip2无法 exec: 没有那个文件或目录tar (child): Error isnot recoverable: exiting nowtar: Child returned status 2tar: Error isnot recoverable: exiting now则使用yum -y install bzip2进行解决[rootdocking ~]# tar jxvf extundelete-0.2.4.tar.bz2extundelete-0.2.4/extundelete-0.2.4/acinclude.m4extundelete-0.2.4/missingextundelete-0.2.4/autogen.shextundelete-0.2.4/aclocal.m4extundelete-0.2.4/configureextundelete-0.2.4/LICENSEextundelete-0.2.4/README...................................................cd extundelete-0.2.4./configure若这步骤报错[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4configure: error: in /root/extundelete-0.2.4:configure: error: C compiler cannot create executablesSee config.log for more details则使用yum -y install gcc-c解决.若执行上一步仍然报错[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4configure: error: Cant find ext2fs library则使用yum -y install e2fsprogs e2fsprogs-devel来解决。#Ubuntu的解决办法为sudo apt-get install e2fslibs-dev e2fslibs-dev不出意外的话到这里应该configure能够顺利完成.[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4Writing generated files to disk[rootdocking extundelete-0.2.4]#最后make然后 make install[rootdocking extundelete-0.2.4]# makemake -s all-recursiveMaking all in srcextundelete.cc: 在函数‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’中:extundelete.cc:1272:29: 警告在 {} 内将‘search_flags’从‘int’转换为较窄的类型‘ext2_ino_t {aka unsigned int}’ [-Wnarrowing]buf, match_name2, priv, 0};^[rootdocking extundelete-0.2.4]# make installMaking install in src/usr/bin/install -c extundelete /usr/local/binextundelete安装完成.扫描误删除的文件使用df -lh查看挂载taroballstaroballs-PC:~$ df -lh文件系统 容量 已用 可用 已用% 挂载点udev 1.9G 01.9G 0% /devtmpfs 387M 1.8M 385M 1% /run/dev/sda2 92G 61G 26G 71% /tmpfs 1.9G 49M 1.9G 3% /dev/shmtmpfs 5.0M 4.0K 5.0M 1% /run/locktmpfs 1.9G 01.9G 0% /sys/fs/cgroup/dev/sda3 104G 56G 44G 57% /hometmpfs 387M 40K 387M 1% /run/user/1000/dev/sda4 70G 20G 47G 30% /media/taroballs/d8423f8c-d687-4c03-a7c8-06a7fb57f96d/dev/sdb1 6.8G 4.1G 2.8G 60% /media/taroballs/taroballs/dev/sr0 4.0G 4.0G 0100% /media/taroballs/2018-01-16-12-36-00-00taroballstaroballs-PC:~$ cd /media/taroballs/taroballs/taroballstaroballs-PC:/media/taroballs/taroballs$可以看到我们的目录/media/taroballs/taroballs挂载到/dev/sdb1 这个文件系统中.umount我们的挂载盘比如taroballstaroballs-PC:~$ df -lh | grep /dev/sdb1/dev/sdb1 6.8G 4.1G 2.8G 60% /media/taroballs/taroballsumount这个目录taroballstaroballs-PC:~$ umount /media/taroballs/taroballstaroballstaroballs-PC:~$ df -lh | grep /dev/sdb1taroballstaroballs-PC:~$记得删除一定要后umount哦不然二次写入谁也帮不了你呢。通过inode节点恢复taroballstaroballs-PC:~$ mkdir recovertesttaroballstaroballs-PC:~$ cd recovertest/taroballstaroballs-PC:~/recovertest$执行恢复extundelete /dev/sdb1 --inode 2taroballstaroballs-PC:/media/taroballs/taroballs$ sudo extundelete /dev/sdb1 --inode 2NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Group: 0Contents of inode 2:..省略N行File name | Inode number | Deleted status. 2.. 2deletetest 12 Deletedtmppasswd 14 Deleted通过扫描发现了我们删除的文件夹现在执行恢复操作。1恢复单一文件tmppasswdtaroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-file passwdNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Successfully restored file tmppasswd恢复文件是放到了当前目录RECOVERED_FILES。查看恢复的文件taroballstaroballs-PC:~/recovertest$ cat tmppasswdtcpdump:x:172:72::/:/sbin/nologin2恢复目录deletetestextundelete /dev/sdb1 --restore-directory deletetestNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Searching for recoverable inodes in directory deletetest ...5 recoverable inodes found.Looking through the directory structure for deleted files ...3恢复所有taroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-allNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Searching for recoverable inodes in directory / ...5 recoverable inodes found.Looking through the directory structure for deleted files ...0 recoverable inodes still lost.taroballstaroballs-PC:~/recovertest$ treebackuptest/├── deletetest│ └── innerfolder│ └── deletefile.txt└── tmppasswd2 directories, 2 files4恢复指定inodetaroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-inode 14NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.taroballstaroballs-PC:~/recovertest$ cat file.14tcpdump:x:172:72::/:/sbin/nologin注意恢复inode的时候恢复 出来的文件名和之前不一样需要单独进行改名。最后附上extundelete的用法:$ extundelete --helpUsage: extundelete [options] [--] device-fileOptions:--version, -[vV] Print version and exit successfully.--help, Print this help and exit successfully.--superblock Print contents of superblock in addition to the rest.If no action is specified then this option is implied.--journal Show content of journal.--after dtime Only process entries deleted on or after dtime.--before dtime Only process entries deleted before dtime.Actions:--inode ino Show info on inode ino.--block blk Show info on block blk.--restore-inode ino[,ino,...]Restore the file(s) with known inode numberino.The restored files are created in ./RECOVERED_FILESwith their inode numberas extension (ie, file.12345).--restore-file path Will restore file path. path is relative to rootof the partitionand does notstartwith a /The restored fileis created in the currentdirectoryasRECOVERED_FILES/path.--restore-files path Will restore files which are listed in the file path.Each filename should be in the same formatas an optionto--restore-file, and there should be one per line.--restore-directory pathWill restoredirectorypath. pathisrelativeto theroot directoryof the file system. The restoreddirectoryis created in the outputdirectoryaspath.--restore-all Attempts to restore everything.-j journal Reads an external journal from the named file.-b blocknumber Uses the backup superblock at blocknumber when openingthe file system.-B blocksize Uses blocksizeas the blocksizewhen opening the filesystem. The number should be the numberof bytes.--log 0 Make the program silent.--log filename Logs all messages to filename.--log D10,D2filename Custom control of log messages with comma-separatedExamples below: listof options. Dn must be one of info, warn, or--log info,error error. Omission of the name results in messages--log warn0 with the specified level to be logged to the console.--log errorfilename If the parameter is 0, logging for the specifiedlevel will be turned off. If the parameter isfilename, messages with that level will be writtento filename.-o directory Save the recovered files to the named directory.The restored files are created in a directorynamed RECOVERED_FILES/by default.好课推荐红帽认证-RHCE \ RHCA红帽认证是全球公认的 Linux 权威认证也是国内企业招聘 Linux 运维、云计算、容器、大数据工程师时最常标注的 “优先条件”甚至很多企业将 RHCE/RHCA 作为入职的基础技能要求。认准红帽官方授权微思-红帽官方授权合作伙伴— Linux文章推荐 —【资料领取】200个Linux常用命令手册《鸟哥Linux私房菜》全新完整中文版PDFRHCE 证书价值解析薪资水平与热门招聘企业分析linux运维必备100道常见面试题超强linux学习笔记值得一看(附PDF下载)红红帽认证、麒麟认证与 K8S 该如何选择5 种 Linux 安装包管理工具中文手册抓紧看
Linux 没有回收站？误删文件这样恢复
红帽RHCE9.0课程介绍红帽RHCA云技术课程介绍linux不像windows有个回收站使用rm -rf *基本上文件是找不回来的。那么问题来了对于linux下误删的文件我们是否真的无法通过软件进行恢复呢?答案当然是否定的对于误删的文件我们还是能通过软件恢复过来的。对于误删文件还原可以分为两种情况:一种是删除以后在进程存在删除信息一种是删除以后进程都找不到只有借助于工具还原。接下来以例子分别解说下两种不同的误删还原方式误删除文件进程还在的情况:这种一般是有活动的进程存在持续标准输入或输出到时文件被删除后进程PID依旧存在。这也是有些服务器删除一些文件但是磁盘不释放的原因。打开一个终端对一个测试文件做cat追加操作[rootdocking ~]# echo This is DeleteFile test. deletefile.txt[rootdocking ~]# lsdeletefile.txt[rootdocking ~]# cat deletefile.txtAdd SomeLine into deletefile for fun.打开另外一个终端查看这个文件可以清楚看到内容[rootdocking ~]# lsdeletefile.txt[rootdocking ~]# cat deletefile.txtThis is DeleteFile test.Add SomeLine into deletefile for fun.此时删除文件rm -f deletefile.txt[rootdocking ~]# rm -f deletefile.txt[rootdocking ~]# ls命令查看这个目录文件已经不存在了那么现在我们将其恢复出来。lsof查看删除的文件进程是否还存在。如没有安装请自行yum install lsof或者apt-get install lsof1.类似这种情况我们可以先lsof查看删除的文件 是否还在[rootdocking ~]# lsof | grep deletefilecat 21796 root 1w REG 253,1 63 138860 /root/deletefile.txt (deleted)2.恢复cp /proc/pid/fd/1 /指定目录/文件名进入 进程目录一般是进入/proc/pid/fd/,针对当前情况[rootdocking ~]# cd /proc/21796/fd[rootdocking fd]# ll总用量 0lrwx------ 1 root root 641月 1822:210 - /dev/pts/0l-wx------ 1 root root 641月 1822:211 - /root/deletefile.txt (deleted)lrwx------ 1 root root 641月 1822:212 - /dev/pts/0恢复操作[rootdocking fd]# cp 1 ~/deletefile.txt.backup[rootdocking fd]# cat ~/deletefile.txt.backupThis is DeleteFile test.Add SomeLine into deletefile forfun.3.恢复完成。误删除的文件进程已经不存在借助于工具还原准备一些文件目录准备一份挂载的盘mkdir backuptestcd backuptestmkdir deletetestmkdir deletetest/innerfolderecho Delete a folder test. deletetest/innerfolder/deletefile.txtecho tcpdump:x:172:72::/:/sbin/nologin tmppasswd最后准备的目录结构如下taroballstaroballs-PC:/media/taroballs/taroballs/backuptest$ cd ..taroballstaroballs-PC:/media/taroballs/taroballs$ tree backuptest/backuptest/├── deletetest│ └── innerfolder│ └── deletefile.txt└── tmppasswd2 directories, 2 files现在开始删除该目录rm -rf backuptest/taroballstaroballs-PC:/media/taroballs/taroballs$ rm -rf backuptest/taroballstaroballs-PC:/media/taroballs/taroballs$ ls -l总用量 0这种情况一般是没有守护进行或者后台进程对其持续输入所以删除就真的删除了。lsof也看不到故需要采用工具进行恢复。现在开始进行误删除文件的恢复。我们采用的工具是extundelete第三方工具。恢复步骤以及注意事项如下停止对当前分区做任何操作防止inode被覆盖。inode被覆盖基本就告别恢复了。夸张一点讲比如停止所在分区的服务卸载目录所在的设备有必要的情况下都可以断网。通过dd命令对 当前分区进行备份防止第三方软件恢复失败导致数据丢失。适合数据非常重要的情况这里是例子所以就没有备份如备份可以考虑如下方式dd if/path/filename of/dev/vdc1通过umount命令对当前设备分区卸载。或者fuser 命令umount /dev/vdb1如果提示设备busy可以用fuser命令强制卸载fuser -m -v -i -k ./下载第三方工具extundelete安装搜索误删除的文件进行还原extundelete工具安装extundelete下载地址http://extundelete.sourceforge.net/wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2解压该文件tar jxvf extundelete-0.2.4.tar.bz2若报这种错误[rootdocking ~]# tar jxvf extundelete-0.2.4.tar.bz2tar (child): bzip2无法 exec: 没有那个文件或目录tar (child): Error isnot recoverable: exiting nowtar: Child returned status 2tar: Error isnot recoverable: exiting now则使用yum -y install bzip2进行解决[rootdocking ~]# tar jxvf extundelete-0.2.4.tar.bz2extundelete-0.2.4/extundelete-0.2.4/acinclude.m4extundelete-0.2.4/missingextundelete-0.2.4/autogen.shextundelete-0.2.4/aclocal.m4extundelete-0.2.4/configureextundelete-0.2.4/LICENSEextundelete-0.2.4/README...................................................cd extundelete-0.2.4./configure若这步骤报错[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4configure: error: in /root/extundelete-0.2.4:configure: error: C compiler cannot create executablesSee config.log for more details则使用yum -y install gcc-c解决.若执行上一步仍然报错[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4configure: error: Cant find ext2fs library则使用yum -y install e2fsprogs e2fsprogs-devel来解决。#Ubuntu的解决办法为sudo apt-get install e2fslibs-dev e2fslibs-dev不出意外的话到这里应该configure能够顺利完成.[rootdocking extundelete-0.2.4]# ./configureConfiguring extundelete 0.2.4Writing generated files to disk[rootdocking extundelete-0.2.4]#最后make然后 make install[rootdocking extundelete-0.2.4]# makemake -s all-recursiveMaking all in srcextundelete.cc: 在函数‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’中:extundelete.cc:1272:29: 警告在 {} 内将‘search_flags’从‘int’转换为较窄的类型‘ext2_ino_t {aka unsigned int}’ [-Wnarrowing]buf, match_name2, priv, 0};^[rootdocking extundelete-0.2.4]# make installMaking install in src/usr/bin/install -c extundelete /usr/local/binextundelete安装完成.扫描误删除的文件使用df -lh查看挂载taroballstaroballs-PC:~$ df -lh文件系统 容量 已用 可用 已用% 挂载点udev 1.9G 01.9G 0% /devtmpfs 387M 1.8M 385M 1% /run/dev/sda2 92G 61G 26G 71% /tmpfs 1.9G 49M 1.9G 3% /dev/shmtmpfs 5.0M 4.0K 5.0M 1% /run/locktmpfs 1.9G 01.9G 0% /sys/fs/cgroup/dev/sda3 104G 56G 44G 57% /hometmpfs 387M 40K 387M 1% /run/user/1000/dev/sda4 70G 20G 47G 30% /media/taroballs/d8423f8c-d687-4c03-a7c8-06a7fb57f96d/dev/sdb1 6.8G 4.1G 2.8G 60% /media/taroballs/taroballs/dev/sr0 4.0G 4.0G 0100% /media/taroballs/2018-01-16-12-36-00-00taroballstaroballs-PC:~$ cd /media/taroballs/taroballs/taroballstaroballs-PC:/media/taroballs/taroballs$可以看到我们的目录/media/taroballs/taroballs挂载到/dev/sdb1 这个文件系统中.umount我们的挂载盘比如taroballstaroballs-PC:~$ df -lh | grep /dev/sdb1/dev/sdb1 6.8G 4.1G 2.8G 60% /media/taroballs/taroballsumount这个目录taroballstaroballs-PC:~$ umount /media/taroballs/taroballstaroballstaroballs-PC:~$ df -lh | grep /dev/sdb1taroballstaroballs-PC:~$记得删除一定要后umount哦不然二次写入谁也帮不了你呢。通过inode节点恢复taroballstaroballs-PC:~$ mkdir recovertesttaroballstaroballs-PC:~$ cd recovertest/taroballstaroballs-PC:~/recovertest$执行恢复extundelete /dev/sdb1 --inode 2taroballstaroballs-PC:/media/taroballs/taroballs$ sudo extundelete /dev/sdb1 --inode 2NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Group: 0Contents of inode 2:..省略N行File name | Inode number | Deleted status. 2.. 2deletetest 12 Deletedtmppasswd 14 Deleted通过扫描发现了我们删除的文件夹现在执行恢复操作。1恢复单一文件tmppasswdtaroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-file passwdNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Successfully restored file tmppasswd恢复文件是放到了当前目录RECOVERED_FILES。查看恢复的文件taroballstaroballs-PC:~/recovertest$ cat tmppasswdtcpdump:x:172:72::/:/sbin/nologin2恢复目录deletetestextundelete /dev/sdb1 --restore-directory deletetestNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Searching for recoverable inodes in directory deletetest ...5 recoverable inodes found.Looking through the directory structure for deleted files ...3恢复所有taroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-allNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.Searching for recoverable inodes in directory / ...5 recoverable inodes found.Looking through the directory structure for deleted files ...0 recoverable inodes still lost.taroballstaroballs-PC:~/recovertest$ treebackuptest/├── deletetest│ └── innerfolder│ └── deletefile.txt└── tmppasswd2 directories, 2 files4恢复指定inodetaroballstaroballs-PC:~/recovertest$ extundelete /dev/sdb1 --restore-inode 14NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 8 groups loaded.Loading journal descriptors ... 46 descriptors loaded.taroballstaroballs-PC:~/recovertest$ cat file.14tcpdump:x:172:72::/:/sbin/nologin注意恢复inode的时候恢复 出来的文件名和之前不一样需要单独进行改名。最后附上extundelete的用法:$ extundelete --helpUsage: extundelete [options] [--] device-fileOptions:--version, -[vV] Print version and exit successfully.--help, Print this help and exit successfully.--superblock Print contents of superblock in addition to the rest.If no action is specified then this option is implied.--journal Show content of journal.--after dtime Only process entries deleted on or after dtime.--before dtime Only process entries deleted before dtime.Actions:--inode ino Show info on inode ino.--block blk Show info on block blk.--restore-inode ino[,ino,...]Restore the file(s) with known inode numberino.The restored files are created in ./RECOVERED_FILESwith their inode numberas extension (ie, file.12345).--restore-file path Will restore file path. path is relative to rootof the partitionand does notstartwith a /The restored fileis created in the currentdirectoryasRECOVERED_FILES/path.--restore-files path Will restore files which are listed in the file path.Each filename should be in the same formatas an optionto--restore-file, and there should be one per line.--restore-directory pathWill restoredirectorypath. pathisrelativeto theroot directoryof the file system. The restoreddirectoryis created in the outputdirectoryaspath.--restore-all Attempts to restore everything.-j journal Reads an external journal from the named file.-b blocknumber Uses the backup superblock at blocknumber when openingthe file system.-B blocksize Uses blocksizeas the blocksizewhen opening the filesystem. The number should be the numberof bytes.--log 0 Make the program silent.--log filename Logs all messages to filename.--log D10,D2filename Custom control of log messages with comma-separatedExamples below: listof options. Dn must be one of info, warn, or--log info,error error. Omission of the name results in messages--log warn0 with the specified level to be logged to the console.--log errorfilename If the parameter is 0, logging for the specifiedlevel will be turned off. If the parameter isfilename, messages with that level will be writtento filename.-o directory Save the recovered files to the named directory.The restored files are created in a directorynamed RECOVERED_FILES/by default.好课推荐红帽认证-RHCE \ RHCA红帽认证是全球公认的 Linux 权威认证也是国内企业招聘 Linux 运维、云计算、容器、大数据工程师时最常标注的 “优先条件”甚至很多企业将 RHCE/RHCA 作为入职的基础技能要求。认准红帽官方授权微思-红帽官方授权合作伙伴— Linux文章推荐 —【资料领取】200个Linux常用命令手册《鸟哥Linux私房菜》全新完整中文版PDFRHCE 证书价值解析薪资水平与热门招聘企业分析linux运维必备100道常见面试题超强linux学习笔记值得一看(附PDF下载)红红帽认证、麒麟认证与 K8S 该如何选择5 种 Linux 安装包管理工具中文手册抓紧看
