如何使用ext3grep恢复Linux中的误删除的文件
|
看一下有没有挂上 [root@localhost bin]# df -HT Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/VolGroup00-LogVol00 ext3 20G 4.3G 15G 23% / /dev/sda1 ext3 104M 13M 86M 13% /boot tmpfs tmpfs 185M 0 185M 0% /dev/shm /tmp/test/file ext3 51M 5.1M 44M 11% /mnt 然后写入数据到里面 [root@localhost bin]#cd /mnt [root@localhost bin]#ls lost+found [root@localhost mnt]# mkdir del [root@localhost mnt]# cd del [root@localhost del]# touch 1 2 3 [root@localhost del]# ls 1 2 3 lost+found [root@localhost del]# cd .. [root@localhost mnt]#rf -rf del [root@localhost bin]#ls lost+found 下面开始恢复了 [root@localhost mnt]#cd /usr/local/ext3grep/bin 扫描一下分区 [root@localhost bin]# ./ext3grep /tmp/test/file --ls --inode 2 Running ext3grep version 0.10.2 Number of groups: 7 Loading group metadata... done Minimum / maximum journal block: 447 / 4561 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1315980293 = Wed Sep 14 14:04:53 2011 Number of descriptors in journal: 36; min / max sequence numbers: 2 / 6 Inode is Allocated Finding all blocks that might be directories. D: block containing directory start, d: block containing more directory entries. Each plus represents a directory start that references the same inode as a directory start that we found previously. Searching group 0: DD++D++ Searching group 1: Searching group 2: Searching group 3: Searching group 4: Searching group 5: Searching group 6: Writing analysis so far to 'file.ext3grep.stage1'. Delete that file if you want to do this stage again. Result of stage one: 3 inodes are referenced by one or more directory blocks, 2 of those inodes are still allocated. 1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated. 0 blocks contain an extended directory. Result of stage two: 2 of those inodes could be resolved because they are still allocated. All directory inodes are accounted for! Writing analysis so far to 'file.ext3grep.stage2'. Delete that file if you want to do this stage again. The first block of the directory is 433. Inode 2 is directory "". Directory block 433: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 2 d 2 drwxr-xr-x .. 2 end d 11 drwx------ lost+found 3 4 r 12 D 1315980355 Wed Sep 14 14:05:55 2011 rrw-r--r-- 1 4 5 r 13 D 1315980355 Wed Sep 14 14:05:55 2011 rrw-r--r-- 2 5 6 r 14 D 1315980355 Wed Sep 14 14:05:55 2011 rrw-r--r-- 3 6 end d 1833 D 1315980355 Wed Sep 14 14:05:55 2011 drwxr-xr-x del [root@localhost bin]# ./ext3grep /tmp/test/file --restore-file del --depth del Running ext3grep version 0.10.2 Number of groups: 7 Minimum / maximum journal block: 447 / 4561 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1315980293 = Wed Sep 14 14:04:53 2011 Number of descriptors in journal: 36; min / max sequence numbers: 2 / 6 Writing output to directory RESTORED_FILES/ Loading file.ext3grep.stage2... done 本文URL地址：http://www.bianceng.cn/OS/Linux/201410/45343.htm （编辑：佛山站长网） 【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容! |
