哲思官方群认证群组 - 讨论区
标题：[zeuux-universe] ext3文件恢复【我实验过了】
2009年02月01日 星期日 16:47
李磊 lilei1008在gmail.com
星期日 二月 1 16:47:09 CST 2009
[导入自Mailman归档：http://www.zeuux.org/pipermail/zeuux-universe]
星期日 二月 1 16:47:09 CST 2009
原文载于：http://huaidan.org/archives/1913.html 工作中遇见了，查了网上文章，发现没几个实际能通过的，实在是怒。自己找了软件做了一次实战操作，基本可以保证稳定恢复。 测试环境 [root在localhost ~]# uname -a Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux 所需的相关库 [root在localhost ~]# rpm -qa |grep e2fsprogs e2fsprogs-libs-1.39-8.el5 e2fsprogs-1.39-8.el5 e2fsprogs-devel-1.39-8.el5 分区情况 [root在localhost ~]# df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/VolGroup00-LogVol00 6.2G 1.8G 4.2G 30% / /dev/sda1 99M 11M 83M 12% /boot /dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data tmpfs 125M 0 125M 0% /dev/shm 需要软件 http://code.google.com/p/ext3grep/downloads/list 先下载软件 [root在localhost ~]# cd /root/src/ [root在localhost src]# wget http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src [root在localhost src]# ls ext3grep-0.6.0.tar.gz [root在localhost src]# tar xfvz ext3grep-0.6.0.tar.gz [root在localhost ext3grep-0.6.0]# ./configure [root在localhost ext3grep-0.6.0]# make install [root在localhost ext3grep-0.6.0]# ext3grep Running ext3grep version 0.6.0 编译然后测试可以使用了，一切做好了以后开始我们的恢复过程。 我的目录是/data分区，我先格式化了分区，我放一个文件在根目录下和一个子目录下的文件。 /dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data 拷贝点文件过去 [root在localhost ~]# ]# cp /bin/ls /data/ [root在localhost ~]# ]# cp -rf /bin /data/ [root在localhost ~]# ]# ls -la /data/ total 136 drwxr-xr-x 4 root root 4096 Apr 21 17:37 . drwxr-xr-x 25 root root 4096 Apr 21 17:11 .. drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin drwx------ 2 root root 16384 Apr 21 17:15 lost+found -rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls [root在localhost ~]# 一个子目录一个可执行文件 现在删除ls文件和bin下面的zcat [root在localhost ~]# rm /data/ls rm: remove regular file `/data/ls'? y [root在localhost ~]# rm /data/bin/zcat rm: remove regular file `/data/bin/zcat'? y [root在localhost ~]# ls -la /data/ls /data/bin/zcat ls: /data/ls: No such file or directory ls: /data/bin/zcat: No such file or directory 文件没有了然后我们来恢复 首先umount掉分区 [root在localhost ~]# umount /dev/mapper/VolGroup00-LogVol02 [root在localhost ~]# df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/VolGroup00-LogVol00 6.2G 1.8G 4.2G 30% / /dev/sda1 99M 11M 83M 12% /boot tmpfs 125M 0 125M 0% /dev/shm 确认卸载，然后使用ext3grep来恢复。 [root在localhost ~]# ext3grep/dev/mapper/VolGroup00-LogVol02 --ls --inode 2 这里会创建扫描分区 [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2 [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... sorting... done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... done Restoring ls [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/ls Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... sorting... done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... done Restoring bin/ls [root在localhost ~]# ls -la RESTORED_FILES/ total 124 drwxr-xr-x 3 root root 4096 Apr 21 18:01 . drwxr-x--- 5 root root 4096 Apr 21 17:55 .. -rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/zcat Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... sorting... done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... done Restoring bin/zcat [root在localhost ~]# ls -la RESTORED_FILES/bin/ total 188 drwxr-xr-x 2 root root 4096 Apr 21 18:01 . drwxr-xr-x 3 root root 4096 Apr 21 18:01 .. -rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat 看看都恢复在RESTORED_FILES目录下，大小也一样 参考资料 http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
[导入自Mailman归档：http://www.zeuux.org/pipermail/zeuux-universe]
2009年02月02日 星期一 21:13
Bill Xu bill在zeuux.org
星期一 二月 2 21:13:49 CST 2009
[导入自Mailman归档：http://www.zeuux.org/pipermail/zeuux-universe]
星期一 二月 2 21:13:49 CST 2009
还没仔细看，不过是非常实用的技术。记得之前在做邮件业务的时候，硬盘几乎是 天天坏，尤其是到了天热的时候。呵呵。 李磊 写道: > 原文载于：http://huaidan.org/archives/1913.html > > 工作中遇见了，查了网上文章，发现没几个实际能通过的，实在是怒。自己找了软件做了一次实战操作，基本可以保证稳定恢复。 > 测试环境 > [root在localhost ~]# uname -a > Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 > EST 2007 i686 i686 i386 GNU/Linux > > 所需的相关库 > [root在localhost ~]# rpm -qa |grep e2fsprogs > e2fsprogs-libs-1.39-8.el5 > e2fsprogs-1.39-8.el5 > e2fsprogs-devel-1.39-8.el5 > 分区情况 > [root在localhost ~]# df -h > Filesystem Size Used Avail Use% Mounted on > /dev/mapper/VolGroup00-LogVol00 > 6.2G 1.8G 4.2G 30% / > /dev/sda1 99M 11M 83M 12% /boot > /dev/mapper/VolGroup00-LogVol02 > 1008M 34M 924M 4% /data > tmpfs 125M 0 125M 0% /dev/shm > 需要软件 > http://code.google.com/p/ext3grep/downloads/list > 先下载软件 > [root在localhost ~]# cd /root/src/ > [root在localhost src]# wget > http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src > [root在localhost src]# ls > ext3grep-0.6.0.tar.gz > [root在localhost src]# tar xfvz ext3grep-0.6.0.tar.gz > [root在localhost ext3grep-0.6.0]# ./configure > [root在localhost ext3grep-0.6.0]# make install > [root在localhost ext3grep-0.6.0]# ext3grep > Running ext3grep version 0.6.0 > 编译然后测试可以使用了，一切做好了以后开始我们的恢复过程。 > 我的目录是/data分区，我先格式化了分区，我放一个文件在根目录下和一个子目录下的文件。 > /dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data > 拷贝点文件过去 > [root在localhost ~]# ]# cp /bin/ls /data/ > [root在localhost ~]# ]# cp -rf /bin /data/ > [root在localhost ~]# ]# ls -la /data/ > total 136 > drwxr-xr-x 4 root root 4096 Apr 21 17:37 . > drwxr-xr-x 25 root root 4096 Apr 21 17:11 .. > drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin > drwx------ 2 root root 16384 Apr 21 17:15 lost+found > -rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls > [root在localhost ~]# > 一个子目录一个可执行文件 > 现在删除ls文件和bin下面的zcat > [root在localhost ~]# rm /data/ls > rm: remove regular file `/data/ls'? y > [root在localhost ~]# rm /data/bin/zcat > rm: remove regular file `/data/bin/zcat'? y > [root在localhost ~]# ls -la /data/ls /data/bin/zcat > ls: /data/ls: No such file or directory > ls: /data/bin/zcat: No such file or directory > 文件没有了然后我们来恢复 > 首先umount掉分区 > [root在localhost ~]# umount /dev/mapper/VolGroup00-LogVol02 > [root在localhost ~]# df -h > Filesystem Size Used Avail Use% Mounted on > /dev/mapper/VolGroup00-LogVol00 > 6.2G 1.8G 4.2G 30% / > /dev/sda1 99M 11M 83M 12% /boot > tmpfs 125M 0 125M 0% /dev/shm > 确认卸载，然后使用ext3grep来恢复。 > [root在localhost ~]# ext3grep/dev/mapper/VolGroup00-LogVol02 --ls --inode 2 > 这里会创建扫描分区 > [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2 > [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls > Running ext3grep version 0.6.0 > WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. > Number of groups: 8 > Minimum / maximum journal block: 585 / 8787 > Loading journal descriptors... sorting... done > Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 > Loading VolGroup00-LogVol02.ext3grep.stage2... done > Restoring ls > [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 > --restore-file bin/ls > Running ext3grep version 0.6.0 > WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. > Number of groups: 8 > Minimum / maximum journal block: 585 / 8787 > Loading journal descriptors... sorting... done > Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 > Loading VolGroup00-LogVol02.ext3grep.stage2... done > Restoring bin/ls > [root在localhost ~]# ls -la RESTORED_FILES/ > total 124 > drwxr-xr-x 3 root root 4096 Apr 21 18:01 . > drwxr-x--- 5 root root 4096 Apr 21 17:55 .. > -rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls > [root在localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 > --restore-file bin/zcat > Running ext3grep version 0.6.0 > WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. > Number of groups: 8 > Minimum / maximum journal block: 585 / 8787 > Loading journal descriptors... sorting... done > Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 > Loading VolGroup00-LogVol02.ext3grep.stage2... done > Restoring bin/zcat > [root在localhost ~]# ls -la RESTORED_FILES/bin/ > total 188 > drwxr-xr-x 2 root root 4096 Apr 21 18:01 . > drwxr-xr-x 3 root root 4096 Apr 21 18:01 .. > -rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat > 看看都恢复在RESTORED_FILES目录下，大小也一样 > 参考资料 > http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html > _______________________________________________ > zeuux-universe mailing list > zeuux-universe在zeuux.org > http://www.zeuux.org/mailman/listinfo/zeuux-universe > > ZEUUX Project - Free Software, Free Society! > http://www.zeuux.org
[导入自Mailman归档：http://www.zeuux.org/pipermail/zeuux-universe]
Zeuux © 2024
京ICP备05028076号