linux刪除文件時其實刪的是文件名，數據還是存儲在硬盤中的。在誤刪除文件后不做其他操作（比如創建新的文件），然后用umount卸載掉存儲該數據的硬盤，再進行恢復操作，可以通過一些工具來恢復被誤刪的文件，以extundelete文件恢復工具為例：
extundelete是文件恢復工具，支持ext3/ext4雙格式分區恢復。
extundelete工具的下載地址：https://sourceforge.net/projects/extundelete/
安裝extundelete工具前先安裝依賴包：yum install e2fsprogs* -y
rz -y（從windows中下載extundelete軟件包）
tar jxf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4.tar.bz2
./confgiure
make
make install
此時extundelete工具已經安裝好了。下面我們模擬恢復誤刪文件。
首先添加一塊測試的硬盤
然后開機查看一下硬盤是否成功加載到系統中
創建ext4文件系統並掛載到/data中：
mkfs -t ext4 /dev/sdb
mkdir /data
mount /dev/sdb /data/
向/data目錄寫入數據
刪除/data中的數據rm -rf /data/*
卸載硬盤umount /data/並用extundelete /dev/sdb --inode 2查看可恢復文件
[root@liuhui ~]# umount /data/
[root@liuhui ~]# extundelete /dev/sdb --inode 2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 160 groups loaded.
Group: 0
Contents of inode 2:
0000 | ed 41 00 00 00 10 00 00 28 6a 9c 5b 24 6a 9c 5b | .A......(j.[$j.[
0010 | 24 6a 9c 5b 00 00 00 00 00 00 02 00 08 00 00 00 | $j.[............
0020 | 00 00 00 00 05 00 00 00 21 24 00 00 00 00 00 00 | ........!$......
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 1c 00 00 00 68 dc ee 16 68 dc ee 16 44 83 ba de | ....h...h...D...
0090 | 9a 68 9c 5b 00 00 00 00 00 00 00 00 00 00 00 00 | .h.[............
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
Inode is Allocated
File mode: 16877
Low 16 bits of Owner Uid: 0
Size in bytes: 4096
Access time: 1536977448
Creation time: 1536977444
Modification time: 1536977444
Deletion Time: 0
Low 16 bits of Group Id: 0
Links count: 2
Blocks count: 8
File flags: 0
File version (for NFS): 0
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 9249, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11 Deleted
passwd 12 Deleted
test 262145 Deleted
檢測到被刪除的文件又三個
開始恢復數據。
注意：恢復過程不要在誤刪分區進行，謹防inode.block塊相互覆蓋
以恢復/data/passwd為例：extundelete /dev/sdb --restore-file passwd
恢復成功后會在當前目錄下生成一個RECOVERED_FILES目錄，在這個目錄里就可以看到被誤刪后得到恢復的文件
也可以用inode恢復passwd文件，從上extundelete /dev/sdb --inode 2執行結果可 知passwd的inode為12
注：用inode恢復后的文件名會跟之前的文件名不一樣
用md5sum校驗RECOVERED_FILES/file.12是否跟源配置文件/etc/passwd相同
結果是一樣的。證明已經恢復成功了
恢復/data中的全部文件用：extundelete /dev/sdb --restore-all這個命令