linux文件误删恢复_ext3grep使用记录

系统版本：redhat6.3

一、google下载源码包

下载地址：http://code.google.com/p/ext3grep/downloads/detail?name=ext3grep-0.10.2.tar.gz

二、解压安装

    1.tar -zxvf ext3grep-0.10.2.tar.gz

    2.mv ext3grep-0.10.2 /usr/src/

    3../configrue --prefix=/usr/local/ext3grep

    4.make

    5.make install

   安装报错记录

w1:

checking how to run the C++ preprocessor... /lib/cpp
configure: error: in `/usr/src/ext3grep-0.10.2':
configure: error: C++ preprocessor "/lib/cpp" fails sanity check
See `config.log' for more details.

   解决: yum install gcc-c++.x86_64

w2:

configure: error: Missing headers. Please install the package e2fslibs-dev from e2fsprogs, or http://e2fsprogs.sourceforge.net for the upstream tar-ball.

   解决:yum install e2fsprogs-devel.x86_64 

三、测试

 

[root@www2 /]# mkfs.ext3 /dev/sdc4
mke2fs 1.41.12 (17-May-2010)
文件系统标签=
操作系统:Linux
块大小=1024 (log=0)
分块大小=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
28112 inodes, 112420 blocks
5621 blocks (5.00%) reserved for the super user
第一个数据块=1
Maximum filesystem blocks=67371008
14 block groups
8192 blocks per group, 8192 fragments per group
2008 inodes per group
Superblock backups stored on blocks: 
        8193, 24577, 40961, 57345, 73729

正在写入inode表: 完成                            
Creating journal (4096 blocks): 完成
Writing superblocks and filesystem accounting information: 完成

This filesystem will be automatically checked every 38 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
[root@www2 /]# mount /dev/sdc4 /test
[root@www2 /]# cp /etc/passwd /test/
[root@www2 /]# cp -r /etc/vsftpd/ /test/
[root@www2 /]# cp /home/sybase/ext3grep-0.10.2.tar\(1\).gz  /test/
[root@www2 /]# ls -lh /test
总用量 250K
-rw-r--r--. 1 root root 231K 4月   8 15:49 ext3grep-0.10.2.tar(1).gz
drwx------. 2 root root  12K 4月   8 15:48 lost+found
-rw-r--r--. 1 root root 1.8K 4月   8 15:49 passwd
drwxr-xr-x. 2 root root 1.0K 4月   8 15:49 vsftpd
root@www2 /]# rm -rf* /test

 开始恢复

  1.查看删除文件

[root@www2 etc]# umount /dev/sdc4
[root@www2 etc]# cd /back
[root@www2 back]# ext3grep /dev/sdc4 --dump-names
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 14
Minimum / maximum journal block: 49406 / 53519
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1396943355 = Tue Apr  8 15:49:15 2014
Number of descriptors in journal: 42; min / max sequence numbers: 2 / 8
Loading sdc4.ext3grep.stage2... done
ext3grep-0.10.2.tar(1).gz
lost+found
passwd
vsftpd
vsftpd/ftpusers
vsftpd/user_list
vsftpd/vsftpd.conf
vsftpd/vsftpd_conf_migrate.sh

2.恢复单个文件

[root@www2 back]# ext3grep /dev/sdc4 --restore-file 'passwd'
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 14
Minimum / maximum journal block: 49406 / 53519
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1396943355 = Tue Apr  8 15:49:15 2014
Number of descriptors in journal: 42; min / max sequence numbers: 2 / 8
Loading sdc4.ext3grep.stage2... done
Restoring passwd
[root@www2 back]# ls
aa  RESTORED_FILES  sdc4.ext3grep.stage1  sdc4.ext3grep.stage2
[root@www2 back]# cd RESTORED_FILES/
[root@www2 RESTORED_FILES]# ls
passwd

3.全部恢复

[root@www2 RESTORED_FILES]# ext3grep /dev/sdc4 --restore-all
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 14
Minimum / maximum journal block: 49406 / 53519
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1396943355 = Tue Apr  8 15:49:15 2014
Number of descriptors in journal: 42; min / max sequence numbers: 2 / 8
Writing output to directory RESTORED_FILES/
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.

Searching group 0: DD
Searching group 1: D++
Searching group 2: 
Searching group 3: 
Searching group 4: 
Searching group 5: 
Searching group 6: +++++
Searching group 7: 
Searching group 8: 
Searching group 9: D
Searching group 10: 
Searching group 11: 
Searching group 12: 
Searching group 13: 
Writing analysis so far to 'sdc4.ext3grep.stage1'. Delete that file if you want to do this stage again.
Result of stage one:
  4 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.
  2 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.
  0 blocks contain an extended directory.
Result of stage two:
  1 of those inodes could be resolved because it is still allocated.
  1 inodes could be resolved because at least one of the blocks was found in the journal.
All directory inodes are accounted for!
Writing analysis so far to 'sdc4.ext3grep.stage2'. Delete that file if you want to do this stage again.
Restoring ext3grep-0.10.2.tar(1).gz
Restoring passwd
Restoring vsftpd/ftpusers
Restoring vsftpd/user_list
Restoring vsftpd/vsftpd.conf
Restoring vsftpd/vsftpd_conf_migrate.sh
[root@www2 RESTORED_FILES]# cd RESTORED_FILES/
[root@www2 RESTORED_FILES]# ls
ext3grep-0.10.2.tar(1).gz  lost+found  passwd  vsftpd