# 常见数据丢失场景
# 1. 误删除文件
# – 使用rm命令误删文件
# – 使用rmdir命令误删目录
# – 清空回收站

# 2. 文件系统损坏
# – 磁盘坏道
# – 文件系统错误
# – 超级块损坏

# 3. 系统崩溃
# – 操作系统崩溃
# – 引导加载程序损坏
# – 内核崩溃

# 4. 硬件故障
# – 磁盘故障
# – RAID损坏
# – 存储控制器故障

# 5. 人为破坏
# – 恶意删除
# – 格式化磁盘
# – 病毒攻击

# 安装extundelete工具（用于ext3/ext4文件系统）
$ sudo dnf install -y extundelete
Last metadata expiration check: 0:45:23 ago on Thu 03 Apr 2026 15:40:15 AM CST.
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
extundelete x86_64 0.2.4-19.el10 epel 123 k
Transaction Summary
================================================================================
Install 1 Packages

Total download size: 123 k
Installed size: 345 k
Downloading Packages:
extundelete-0.2.4-19.el10.x86_64.rpm 1.2 MB/s | 123 kB 00:00
——————————————————————————–
Total 1.2 MB/s | 123 kB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : extundelete-0.2.4-19.el10.x86_64 1/1
Verifying : extundelete-0.2.4-19.el10.x86_64 1/1

Installed:
extundelete-0.2.4-19.el10.x86_64

Complete!

# 安装testdisk工具（用于分区恢复）
$ sudo dnf install -y testdisk

# 安装photorec工具（用于文件恢复）
$ sudo dnf install -y photorec

# 安装ddrescue工具（用于磁盘镜像）
$ sudo dnf install -y ddrescue

# 场景：误删除文件恢复
# 1. 立即卸载文件系统（防止数据覆盖）
$ sudo umount /dev/sdb1

# 2. 查看可恢复的文件
$ sudo extundelete /dev/sdb1 –restore-file path/to/deleted/file
Only show output of restore file

# 3. 恢复单个文件
$ sudo extundelete /dev/sdb1 –restore-file home/user/important.txt
Loading filesystem metadata … 120 groups loaded.
Loading journal descriptors … 312 descriptors loaded.
Searching for recoverable inodes in directory home/user/ …
9 recoverable inodes found.
Looking through the directory structure for deleted files …
Restored inode 12345 to file RECOVERED_FILES/home/user/important.txt

# 4. 恢复整个目录
$ sudo extundelete /dev/sdb1 –restore-directory home/user/
Loading filesystem metadata … 120 groups loaded.
Loading journal descriptors … 312 descriptors loaded.
Searching for recoverable inodes in directory home/user/ …
15 recoverable inodes found.
Looking through the directory structure for deleted files …
Restored inode 12345 to file RECOVERED_FILES/home/user/file1.txt
Restored inode 12346 to file RECOVERED_FILES/home/user/file2.txt
Restored inode 12347 to file RECOVERED_FILES/home/user/file3.txt

# 5. 恢复所有文件
$ sudo extundelete /dev/sdb1 –restore-all
Loading filesystem metadata … 120 groups loaded.
Loading journal descriptors … 312 descriptors loaded.
Searching for recoverable inodes in directory / …
100 recoverable inodes found.
Looking through the directory structure for deleted files …
Restored inode 12345 to file RECOVERED_FILES/home/user/file1.txt
Restored inode 12346 to file RECOVERED_FILES/home/user/file2.txt
…

# 6.更多视频教程www.fgedu.net.cn 查看恢复的文件
$ ls -l RECOVERED_FILES/
total 1.2M
-rw-r–r–. 1 root root 1.2K Apr 3 15:45:00 file1.txt
-rw-r–r–. 1 root root 2.3K Apr 3 15:45:00 file2.txt
-rw-r–r–. 1 root root 3.4K Apr 3 15:45:00 file3.txt

# 启动更多学习教程公众号风哥教程itpux_comtestdisk
$ sudo testdisk

# TestDisk 7.1, data recovery utility
# Copyright (C) 2023, Christophe GRENIER
# https://www.cgsecurity.org

# 选择Create创建新日志文件
# 选择要恢复的磁盘
# 选择分区表类型（Intel/PC）
# 选择Analyse分析分区
# 选择Quick Search快速搜索
# 选择Write写入分区表

# 命令行模式恢复分区
$ sudo testdisk /dev/sdb

# 查看磁盘分区信息
$ sudo fdisk -l /dev/sdb
Disk /dev/sdb: 100 GiB, 107374182400 bytes, 209715200 sectors
Disk model: VBOX HARDDISK
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x12345678

Device Boot Start End Sectors Size Id Type
/dev/sdb1 2048 209715166 209713119 100G 83 Linux

# 创建磁盘镜像
$ sudo ddrescue -f /dev/sdb /backup/sdb.img /backup/sdb.log
GNU ddrescue 1.27
ipos: 10737 MB, non-trimmed: 0 B, current rate: 1024 kB/s
opos: 10737 MB, non-scraped: 0 B, average rate: 1024 kB/s
non-tried: 0 B, bad-sector: 0 B, error rate: 0 B/s
rescued: 10737 MB, bad areas: 0, run time: 2 hours 56 mins
pct rescued: 100.00%, read errors: 0, remaining time: 0 s
time since last successful read: 0 s
Finished

# 从镜像文件恢复数据
$ sudo mount -o loop /backup/sdb.img /mnt/recovery/

# 查看恢复的数据
$ ls -l /mnt/recovery/
total 20
drwx——. 2 root root 16384 Apr 3 15:50:00 lost+found
drwxr-xr-x. 2 root root 4096 Apr 3 15:50:00 data
drwxr-xr-x. 2 root root 4096 Apr 3 15:50:00 backup

# 恢复特定文件
$ sudo cp -r /mnt/recovery/data /restore/

# 验证恢复的数据
$ ls -l /restore/data/
total 1.2M
-rw-r–r–. 1 root root 1.2K Apr 3 15:50:00 file1.txt
-rw-r–r–. 1 root root 2.3K Apr 3 15:50:00 file2.txt

# 数据恢复注意事项
# 1. 立即停止写入操作
# – 卸载文件学习交流加群风哥微信: itpux-com系统
# – 避免数据覆盖

# 2. 创建磁盘镜像
# – 使用ddrescue创建镜像
# – 从镜像恢复数据

# 3. 选择合适的恢复工具
# – extundeletfrom PG视频:www.itpux.come：ext3/ext4文件系统
# – testdisk：分区恢复
# – photorec：文件恢复
# – ddrescue：磁盘镜像

# 4. 恢复前备份
# – 备份当前状态
# – 避免二次损坏

# 5. 专业数据恢复
# – 硬件故障找专业机构
# – 重要数据不要自行恢复

# 数据恢复流程
# 1. 评估数据丢失情况
# 2. 停止写入操作
# 3. 创建磁盘镜像
# 4. 选择恢复工具
# 5. 执行恢复操作
# 6. 验证恢复数据
# 7. 恢复数据到原位置