下載地址 http://code.google.com/p/ext3grep/downloads/list

安裝

[root@local ext3grep-0.10.1]# ./configure
[root@local ext3grep-0.10.1]# make
[root@local ext3grep-0.10.1]# make install
?

?

安裝完后，測試一下刪除 /boot 下一個的文件

[root@local boot]# ls
config-2.6.18-194.el5 lost+found symvers-2.6.18-194.el5.gz
grub memtest86+-1.65 System.map-2.6.18-194.el5
initrd-2.6.18-194.el5.img message vmlinuz-2.6.18-194.el5

[root@local boot]# rm -rf symvers-2.6.18-194.el5.gz
[root@local boot]# ls
config-2.6.18-194.el5 initrd-2.6.18-194.el5.img memtest86+-1.65 System.map-2.6.18-194.el5
grub lost+found message vmlinuz-2.6.18-194.el5
?

開始恢復

先卸載

[root@local boot]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
3.8G 2.1G 1.5G 59% /
tmpfs 252M 0 252M 0%
?

/dev/shm/dev/sda1 99M 12M 82M 13% /boot
?

[root@local boot]#cd ..
[root@local /]# umount /boot
查看有哪些文件被刪除了

[root@local /]# ext3grep /dev/sda1 --ls --inode 2
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Loading group metadata... done
Minimum / maximum journal block: 526 / 4640
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1331487878 = Mon Mar 12 01:44:38 2012
Number of descriptors in journal: 84; min / max sequence numbers: 6 / 44
Inode is Allocated
Loading sda1.ext3grep.stage2... done
The first block of the directory is 512.
Inode 2 is directory "".
Directory block 512:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found
3 4 d 10041 drwxr-xr-x grub
4 5 r 13 rrw-r--r-- memtest86+-1.65
5 6 r 12 rrw-r--r-- message
6 7 r 19 rrw------- initrd-2.6.18-194.el5.img
7 8 r 14 rrw-r--r-- .vmlinuz-2.6.18-194.el5.hmac
8 9 r 15 rrw-r--r-- System.map-2.6.18-194.el5
9 11 r 16 rrw-r--r-- config-2.6.18-194.el5
10 11 r 17 D 1331490557 Mon Mar 12 02:29:17 2012 rrw-r--r-- symvers-2.6.18-194.el5.gz
11 end r 18 rrw-r--r-- vmlinuz-2.6.18-194.el5
可以看到symvers-2.6.18-194.el5.gz 的刪除時間
[root@local /]# ext3grep /dev/sda1 --restore-file symvers-2.6.18-194.el5.gz
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 526 / 4640
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1331487878 = Mon Mar 12 01:44:38 2012
Number of descriptors in journal: 84; min / max sequence numbers: 6 / 44
Loading sda1.ext3grep.stage2... done
Restoring symvers-2.6.18-194.el5.gz

恢復刪除文件 后 保存在 RESTORED_FILES 文件夾里

[root@local /]# cd RESTORED_FILES/

[root@local RESTORED_FILES]# ls
symvers-2.6.18-194.el5.gz

恢復可以指定文件恢復，可以全部恢復，也可以指定時間恢復

轉載于:https://blog.51cto.com/gaoming/1109802

總結

以上是生活随笔為你收集整理的Linux ext3grep 恢复数据的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。