zeuux-universe  - 讨论区

标题:[zeuux-universe] ext3文件恢复【我实验过了】

2009年02月01日 星期日 16:47

李磊 lilei1008在gmail.com
星期日 二月 1 16:47:09 CST 2009

原文载于:http://huaidan.org/archives/1913.html

工作中遇见了,查了网上文章,发现没几个实际能通过的,实在是怒。自己找了软件做了一次实战操作,基本可以保证稳定恢复。
测试环境
[root在localhost ~]# uname -a
Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21
EST 2007 i686 i686 i386 GNU/Linux

所需的相关库
[root在localhost ~]# rpm -qa |grep e2fsprogs
e2fsprogs-libs-1.39-8.el5
e2fsprogs-1.39-8.el5
e2fsprogs-devel-1.39-8.el5
分区情况
[root在localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
6.2G 1.8G 4.2G 30% /
/dev/sda1 99M 11M 83M 12% /boot
/dev/mapper/VolGroup00-LogVol02
1008M 34M 924M 4% /data
tmpfs 125M 0 125M 0% /dev/shm
需要软件
http://code.google.com/p/ext3grep/downloads/list
先下载软件
[root在localhost ~]# cd /root/src/
[root在localhost src]# wget
http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src
[root在localhost src]# ls
ext3grep-0.6.0.tar.gz
[root在localhost src]# tar xfvz ext3grep-0.6.0.tar.gz
[root在localhost ext3grep-0.6.0]# ./configure
[root在localhost ext3grep-0.6.0]# make install
[root在localhost ext3grep-0.6.0]# ext3grep
Running ext3grep version 0.6.0
编译然后测试可以使用了,一切做好了以后开始我们的恢复过程。
我的目录是/data分区,我先格式化了分区,我放一个文件在根目录下和一个子目录下的文件。
/dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data
拷贝点文件过去
[root在localhost ~]# ]# cp /bin/ls /data/
[root在localhost ~]# ]# cp -rf /bin /data/
[root在localhost ~]# ]# ls -la /data/
total 136
drwxr-xr-x 4 root root 4096 Apr 21 17:37 .
drwxr-xr-x 25 root root 4096 Apr 21 17:11 ..
drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin
drwx------ 2 root root 16384 Apr 21 17:15 lost+found
-rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls
[root在localhost ~]#
一个子目录一个可执行文件
现在删除ls文件和bin下面的zcat
[root在localhost ~]# rm /data/ls
rm: remove regular file `/data/ls'? y
[root在localhost ~]# rm /data/bin/zcat
rm: remove regular file `/data/bin/zcat'? y
[root在localhost ~]# ls -la /data/ls /data/bin/zcat
ls: /data/ls: No such file or directory
ls: /data/bin/zcat: No such file or directory
文件没有了然后我们来恢复
首先umount掉分区
[root在localhost ~]# umount /dev/mapper/VolGroup00-LogVol02
[root在localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
6.2G 1.8G 4.2G 30% /
/dev/sda1 99M 11M 83M 12% /boot
tmpfs 125M 0 125M 0% /dev/shm
确认卸载,然后使用ext3grep来恢复。
[root在localhost ~]# ext3grep/dev/mapper/VolGroup00-LogVol02 --ls --inode 2
这里会创建扫描分区
[root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2
[root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls
Running ext3grep version 0.6.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 8
Minimum / maximum journal block: 585 / 8787
Loading journal descriptors... sorting... done
Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
Loading VolGroup00-LogVol02.ext3grep.stage2... done
Restoring ls
[root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02
--restore-file bin/ls
Running ext3grep version 0.6.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 8
Minimum / maximum journal block: 585 / 8787
Loading journal descriptors... sorting... done
Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
Loading VolGroup00-LogVol02.ext3grep.stage2... done
Restoring bin/ls
[root在localhost ~]# ls -la RESTORED_FILES/
total 124
drwxr-xr-x 3 root root 4096 Apr 21 18:01 .
drwxr-x--- 5 root root 4096 Apr 21 17:55 ..
-rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls
[root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02
--restore-file bin/zcat
Running ext3grep version 0.6.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 8
Minimum / maximum journal block: 585 / 8787
Loading journal descriptors... sorting... done
Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
Loading VolGroup00-LogVol02.ext3grep.stage2... done
Restoring bin/zcat
[root在localhost ~]# ls -la RESTORED_FILES/bin/
total 188
drwxr-xr-x 2 root root 4096 Apr 21 18:01 .
drwxr-xr-x 3 root root 4096 Apr 21 18:01 ..
-rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat
看看都恢复在RESTORED_FILES目录下,大小也一样
参考资料
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

[导入自Mailman归档:http://www.zeuux.org/pipermail/zeuux-universe]

2009年02月02日 星期一 21:13

Bill Xu bill在zeuux.org
星期一 二月 2 21:13:49 CST 2009

还没仔细看,不过是非常实用的技术。记得之前在做邮件业务的时候,硬盘几乎是 
天天坏,尤其是到了天热的时候。呵呵。

李磊 写道:
> 原文载于:http://huaidan.org/archives/1913.html
>
> 工作中遇见了,查了网上文章,发现没几个实际能通过的,实在是怒。自己找了软件做了一次实战操作,基本可以保证稳定恢复。
> 测试环境
> [root在localhost ~]# uname -a
> Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21
> EST 2007 i686 i686 i386 GNU/Linux
>   
> 所需的相关库
> [root在localhost ~]# rpm -qa |grep e2fsprogs
> e2fsprogs-libs-1.39-8.el5
> e2fsprogs-1.39-8.el5
> e2fsprogs-devel-1.39-8.el5
> 分区情况
> [root在localhost ~]# df -h
> Filesystem Size Used Avail Use% Mounted on
> /dev/mapper/VolGroup00-LogVol00
> 6.2G 1.8G 4.2G 30% /
> /dev/sda1 99M 11M 83M 12% /boot
> /dev/mapper/VolGroup00-LogVol02
> 1008M 34M 924M 4% /data
> tmpfs 125M 0 125M 0% /dev/shm
> 需要软件
> http://code.google.com/p/ext3grep/downloads/list
> 先下载软件
> [root在localhost ~]# cd /root/src/
> [root在localhost src]# wget
> http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src
> [root在localhost src]# ls
> ext3grep-0.6.0.tar.gz
> [root在localhost src]# tar xfvz ext3grep-0.6.0.tar.gz
> [root在localhost ext3grep-0.6.0]# ./configure
> [root在localhost ext3grep-0.6.0]# make install
> [root在localhost ext3grep-0.6.0]# ext3grep
> Running ext3grep version 0.6.0
> 编译然后测试可以使用了,一切做好了以后开始我们的恢复过程。
> 我的目录是/data分区,我先格式化了分区,我放一个文件在根目录下和一个子目录下的文件。
> /dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data
> 拷贝点文件过去
> [root在localhost ~]# ]# cp /bin/ls /data/
> [root在localhost ~]# ]# cp -rf /bin /data/
> [root在localhost ~]# ]# ls -la /data/
> total 136
> drwxr-xr-x 4 root root 4096 Apr 21 17:37 .
> drwxr-xr-x 25 root root 4096 Apr 21 17:11 ..
> drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin
> drwx------ 2 root root 16384 Apr 21 17:15 lost+found
> -rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls
> [root在localhost ~]#
> 一个子目录一个可执行文件
> 现在删除ls文件和bin下面的zcat
> [root在localhost ~]# rm /data/ls
> rm: remove regular file `/data/ls'? y
> [root在localhost ~]# rm /data/bin/zcat
> rm: remove regular file `/data/bin/zcat'? y
> [root在localhost ~]# ls -la /data/ls /data/bin/zcat
> ls: /data/ls: No such file or directory
> ls: /data/bin/zcat: No such file or directory
> 文件没有了然后我们来恢复
> 首先umount掉分区
> [root在localhost ~]# umount /dev/mapper/VolGroup00-LogVol02
> [root在localhost ~]# df -h
> Filesystem Size Used Avail Use% Mounted on
> /dev/mapper/VolGroup00-LogVol00
> 6.2G 1.8G 4.2G 30% /
> /dev/sda1 99M 11M 83M 12% /boot
> tmpfs 125M 0 125M 0% /dev/shm
> 确认卸载,然后使用ext3grep来恢复。
> [root在localhost ~]# ext3grep/dev/mapper/VolGroup00-LogVol02 --ls --inode 2
> 这里会创建扫描分区
> [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2
> [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls
> Running ext3grep version 0.6.0
> WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
> Number of groups: 8
> Minimum / maximum journal block: 585 / 8787
> Loading journal descriptors... sorting... done
> Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
> Loading VolGroup00-LogVol02.ext3grep.stage2... done
> Restoring ls
> [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02
> --restore-file bin/ls
> Running ext3grep version 0.6.0
> WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
> Number of groups: 8
> Minimum / maximum journal block: 585 / 8787
> Loading journal descriptors... sorting... done
> Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
> Loading VolGroup00-LogVol02.ext3grep.stage2... done
> Restoring bin/ls
> [root在localhost ~]# ls -la RESTORED_FILES/
> total 124
> drwxr-xr-x 3 root root 4096 Apr 21 18:01 .
> drwxr-x--- 5 root root 4096 Apr 21 17:55 ..
> -rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls
> [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02
> --restore-file bin/zcat
> Running ext3grep version 0.6.0
> WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
> Number of groups: 8
> Minimum / maximum journal block: 585 / 8787
> Loading journal descriptors... sorting... done
> Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5
> Loading VolGroup00-LogVol02.ext3grep.stage2... done
> Restoring bin/zcat
> [root在localhost ~]# ls -la RESTORED_FILES/bin/
> total 188
> drwxr-xr-x 2 root root 4096 Apr 21 18:01 .
> drwxr-xr-x 3 root root 4096 Apr 21 18:01 ..
> -rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat
> 看看都恢复在RESTORED_FILES目录下,大小也一样
> 参考资料
> http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
> _______________________________________________
> zeuux-universe mailing list
> zeuux-universe在zeuux.org
> http://www.zeuux.org/mailman/listinfo/zeuux-universe
>
> ZEUUX Project - Free Software, Free Society!
> http://www.zeuux.org

[导入自Mailman归档:http://www.zeuux.org/pipermail/zeuux-universe]

如下红色区域有误,请重新填写。

    你的回复:

    请 登录 后回复。还没有在Zeuux哲思注册吗?现在 注册 !

    Zeuux © 2024

    京ICP备05028076号