Linux下利用ext3grep恢復被刪除的文件

10個G的數據被誤刪除了,差點崩潰,試遍了全部常規恢復軟件,無用,就要放棄的時候,發現了ext3grep這個開源東東!html

順利恢復全部數據,因此linux下數據刪除並不可怕,可怕的是刪除後沒有恢復的方法,看看下面的操做吧!node

[root@localhost ~]# uname -alinux

Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linuxshell

其實什麼版本的系統無所謂 !app

所需的相關庫dom

[root@localhost ~]# rpm -qa |grep e2fsprogsoop

e2fsprogs-libs-1.39-8.el5測試

e2fsprogs-1.39-8.el5google

e2fsprogs-devel-1.39-8.el5rest

必需要有e2fsprogs-libs,否則在後面ext3grep的安裝會有問題。

分區狀況:

[root@localhost ~]# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/VolGroup00-LogVol00

6.2G 1.8G 4.2G 30% /

/dev/sda1 99M 11M 83M 12% /boot

/dev/mapper/VolGroup00-LogVol02

1008M 34M 924M 4% /data

tmpfs 125M 0 125M 0% /dev/shm

須要軟件

http://code.google.com/p/ext3grep/downloads/list

下載軟件

[root@localhost ~]# cd /root/src/

[root@localhost src]# wget http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src

[root@localhost src]# ls

ext3grep-0.6.0.tar.gz

[root@localhost src]# tar xfvz ext3grep-0.6.0.tar.gz

[root@localhost ext3grep-0.6.0]# ./configure

[root@localhost ext3grep-0.6.0]# make install

[root@localhost ext3grep-0.6.0]# ext3grep

Running ext3grep version 0.6.0

編譯而後測試可使用了,一切作好了之後開始咱們的恢復過程。

個人目錄是/data分區,我先格式化了分區,我放一個文件在根目錄下和一個子目錄下的文件。

/dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data

下面斜體部分不是必須的:

其實這裏用什麼分區卻是無所謂,也能夠模擬一個出來,下面是模擬步驟:

1.        mkdir /data1/

2.        cd /data1/

3.        dd if=/dev/zero of=disk1 count=2048000

4.        mkfs.ext3 disk1

5.        mkdir -p /dfs/a

6.        mount -o loop /data1/disk1 /dfs/a

這裏,咱們用/data分區,先拷貝些文件過去

[root@localhost ~]# ]# cp /bin/ls /data/

[root@localhost ~]# ]# cp -rf /bin /data/

[root@localhost ~]# ]# ls -la /data/

total 136

drwxr-xr-x 4 root root 4096 Apr 21 17:37 .

drwxr-xr-x 25 root root 4096 Apr 21 17:11 ..

drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin

drwx—— 2 root root 16384 Apr 21 17:15 lost+found

-rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls

[root@localhost ~]#

 

一個子目錄一個可執行文件

如今刪除ls文件和bin下面的zcat

[root@localhost ~]# rm /data/ls

rm: remove regular file `/data/ls’? y

[root@localhost ~]# rm /data/bin/zcat

rm: remove regular file `/data/bin/zcat’? y

[root@localhost ~]# ls -la /data/ls /data/bin/zcat

ls: /data/ls: No such file or directory

ls: /data/bin/zcat: No such file or directory

文件沒有了而後咱們來恢復:

首先必須umount掉誤刪除數據的分區:

[root@localhost ~]# umount /dev/mapper/VolGroup00-LogVol02

[root@localhost ~]# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/VolGroup00-LogVol00

6.2G 1.8G 4.2G 30% /

/dev/sda1 99M 11M 83M 12% /boot

tmpfs 125M 0 125M 0% /dev/shm

確認卸載,而後使用ext3grep來恢復。

[root@localhost ~]# ext3grep  /dev/mapper/VolGroup00-LogVol02 --ls --inode 2

這裏會建立掃描分區

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls

Running ext3grep version 0.6.0

WARNING: I don’t know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

Number of groups: 8

Minimum / maximum journal block: 585 / 8787

Loading journal descriptors… sorting… done

Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5

Loading VolGroup00-LogVol02.ext3grep.stage2… done

Restoring ls

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/ls

Running ext3grep version 0.6.0

WARNING: I don’t know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

Number of groups: 8

Minimum / maximum journal block: 585 / 8787

Loading journal descriptors… sorting… done

Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5

Loading VolGroup00-LogVol02.ext3grep.stage2… done

Restoring bin/ls

[root@localhost ~]# ls -la RESTORED_FILES/

total 124

drwxr-xr-x 3 root root 4096 Apr 21 18:01 .

drwxr-x— 5 root root 4096 Apr 21 17:55 ..

-rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/zcat

Running ext3grep version 0.6.0

WARNING: I don’t know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

Number of groups: 8

Minimum / maximum journal block: 585 / 8787

Loading journal descriptors… sorting… done

Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5

Loading VolGroup00-LogVol02.ext3grep.stage2… done

Restoring bin/zcat

[root@localhost ~]# ls -la RESTORED_FILES/bin/

total 188

drwxr-xr-x 2 root root 4096 Apr 21 18:01 .

drwxr-xr-x 3 root root 4096 Apr 21 18:01 ..

-rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat

看看都恢復在RESTORED_FILES目錄下,大小也同樣,這裏RESTORED_FILES目錄是執行ext3grep的當前目錄下!

也可使用:

ext3grep /termite/cc-disk --restore-all

恢復全部文件和目錄,可是目錄的話,若是刪除時間較長,不必定能徹底恢復,壓縮文件通常都能恢復。

若是想詳細的瞭解ext3grep,能夠到它的的HOW TO頁去看看:

http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

一、刪除/root/shell/hehe下的a文件

二、安裝ext3grep-0.10.1.tar.gz     ext3grep命令已經能夠正常使用

三、ext3grep /dev/sda3  --ls --inode 2 建立掃描分區(不明白這步有什麼用,請高手指點)

四、ext3grep /dev/sda3  --restore-file root/shell/hehe/a 恢復文件a

五、ext3grep /dev/sda3  --restore-inode 75631   根基inode

相關文章
相關標籤/搜索