Linux ext3grep 恢复数据

下载地址 http://code.google.com/p/ext3grep/downloads/list

安装

[root@local ext3grep-0.10.1]# ./configure
[root@local ext3grep-0.10.1]# make
[root@local ext3grep-0.10.1]# make install

安装完后，测试一下删除   /boot  下一个的文件

[root@local boot]# ls
config-2.6.18-194.el5      lost+found       symvers-2.6.18-194.el5.gz
grub                       memtest86+-1.65  System.map-2.6.18-194.el5
initrd-2.6.18-194.el5.img  message          vmlinuz-2.6.18-194.el5

[root@local boot]# rm -rf symvers-2.6.18-194.el5.gz
[root@local boot]# ls
config-2.6.18-194.el5  initrd-2.6.18-194.el5.img  memtest86+-1.65  System.map-2.6.18-194.el5
grub                   lost+found                 message          vmlinuz-2.6.18-194.el5

开始恢复

先卸载

[root@local boot]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                      3.8G  2.1G  1.5G  59% /
tmpfs                 252M     0  252M   0%

/dev/shm/dev/sda1              99M   12M   82M  13% /boot

[root@local boot]#cd ..
[root@local /]# umount /boot
查看有哪些文件被删除了

[root@local /]# ext3grep  /dev/sda1  --ls --inode 2
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Loading group metadata... done
Minimum / maximum journal block: 526 / 4640
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1331487878 = Mon Mar 12 01:44:38 2012
Number of descriptors in journal: 84; min / max sequence numbers: 6 / 44
Inode is Allocated
Loading sda1.ext3grep.stage2... done
The first block of the directory is 512.
Inode 2 is directory "".
Directory block 512:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d       2                                         drwxr-xr-x  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 d      11                                         drwx------  lost+found
   3    4 d   10041                                         drwxr-xr-x  grub
   4    5 r      13                                         rrw-r--r--  memtest86+-1.65
   5    6 r      12                                         rrw-r--r--  message
   6    7 r      19                                         rrw-------  initrd-2.6.18-194.el5.img
   7    8 r      14                                         rrw-r--r--  .vmlinuz-2.6.18-194.el5.hmac
   8    9 r      15                                         rrw-r--r--  System.map-2.6.18-194.el5
   9   11 r      16                                         rrw-r--r--  config-2.6.18-194.el5
  10   11 r      17  D 1331490557 Mon Mar 12 02:29:17 2012  rrw-r--r--  symvers-2.6.18-194.el5.gz
  11  end r      18                                         rrw-r--r--  vmlinuz-2.6.18-194.el5
可以看到symvers-2.6.18-194.el5.gz 的删除时间
[root@local /]# ext3grep  /dev/sda1  --restore-file  symvers-2.6.18-194.el5.gz
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 526 / 4640
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1331487878 = Mon Mar 12 01:44:38 2012
Number of descriptors in journal: 84; min / max sequence numbers: 6 / 44
Loading sda1.ext3grep.stage2... done
Restoring symvers-2.6.18-194.el5.gz

恢复删除文件 后 保存在 RESTORED_FILES 文件夹里

[root@local /]# cd RESTORED_FILES/

[root@local RESTORED_FILES]# ls
symvers-2.6.18-194.el5.gz

恢复可以指定文件恢复，可以全部恢复，也可以指定时间恢复