Linux ext3/ext4 文件系统数据恢复
来源:互联网 发布:编程英语怎么说 编辑:程序博客网 时间:2024/05/16 12:44
Linux ext3/ext4 文件系统数据恢复
ext3 ext3grep
ext3/ext4 extundelete
下载地址:
ext3grep https://code.google.com/p/ext3grep/downloads/list
extundelete http://nchc.dl.sourceforge.net/project/extundelete/extundelete
安装依赖组件:
yum -y install gcc gcc-c++ make e2fsprogs-devel e2fsprogs-libs
安装 ext3grep
[root@localhost src]# tar zxf ext3grep-0.10.2.tar.gz
[root@localhost src]# cd ext3grep-0.10.2
[root@localhost ext3grep-0.10.2]# ./configure ; make ; make install
[root@localhost ~]# ext3grep -v
Running ext3grep version 0.10.2
ext3grep v0.10.2, Copyright (C) 2008 Carlo Wood.
ext3grep comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.
安装 extundelete
[root@localhost src]# tar jxf extundelete-0.2.4.tar.bz2
[root@localhost src]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure ; make ; make install
[root@localhost ~]# extundelete -v
extundelete version 0.2.4
libext2fs version 1.41.12
Processor is little endian.
验证数据恢复:
文件系统: ext3
使用工具: ext3grep
[root@localhost ~]# mkfs.ext3 /dev/my_vg/my_lv # 将分区格式化为 ext3
[root@localhost ~]# mount /dev/my_vg/my_lv /data/ # 挂载到 /data 目录
[root@localhost ~]# cd /data/
[root@localhost data]# mkdir share # 创建测试目录
[root@localhost data]# echo "***************************" > file1.txt
[root@localhost data]# echo "&&&&&&&&&&&&&&&&&&&&&&&&&&&" > share/file2.txt # 测试文件
[root@localhost data]# rm -rf * # 我们将 data 目录下的所有文件、目录全部删除
[root@localhost data]# cd /tmp/ # 切换到别的目录
[root@localhost tmp]# umount /data/ # 卸载分区
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --ls --inode 2 # 使用工具通过 inode 值扫描(一般“根”目录的 inode 都是 2)
<=====================================================================================>
Inode 2 is directory "".
Directory block 835:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 end d 2 drwxr-xr-x ..
2 5 d 11 D 1399471894 Wed May 7 22:11:34 2014 drwx------ lost+found
3 end d 24577 D 1399471894 Wed May 7 22:11:34 2014 drwxr-xr-x share
4 end r 13 D 1399471894 Wed May 7 22:11:34 2014 rrw-r--r-- file1.txt
<=====================================================================================>
# 这里扫描到了我们删除的东西,有字母 D 标识的表示已经删除
# 接下来我们在扫描一下 /data/ 目录下的 share 目录
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --ls --inode 24577
<=====================================================================================>
Inode 24577 is directory "share".
Directory block 112640:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 24577 D 1399471894 Wed May 7 22:11:34 2014 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 end r 24578 D 1399471894 Wed May 7 22:11:34 2014 rrw-r--r-- file2.txt
<=====================================================================================>
# 这里也扫描到了被删除的文件
# 现在我们只恢复 /data/share/file2.txt
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --restore-inode 24578
# 恢复回在当前目录下的 RESTORED_FILES/ 目录下,文件以 inode.文件 i 节点号命名
[root@localhost tmp]# cat RESTORED_FILES/inode.24578
&&&&&&&&&&&&&&&&&&&&&&&&&&&
# 我们可以看到文件内容没有改变,所以 文件恢复成功!
# 接下来 我们恢复被删除的全部内容
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --restore-all
[root@localhost tmp]# ls RESTORED_FILES/
file1.txt inode.24578 lost+found share
[root@localhost tmp]# ls RESTORED_FILES/share/
file2.txt
# 成功 ! 接下来就是修改权限,然后将他们移回原位!
文件系统: ext4
使用工具: extundelete
[root@localhost ~]# mkfs.ext4 /dev/my_vg/my_lv
[root@localhost ~]# mount /dev/my_vg/my_lv /data/
[root@localhost ~]# cd /data/
[root@localhost data]# mkdir public
[root@localhost data]# echo "ooooooooooooooooooooo" > file1.txt
[root@localhost data]# echo "mmmmmmmmmmmmmmmmmmmmm" > public/file2.txt
[root@localhost data]# rm -rf *
[root@localhost data]# cd /tmp/
[root@localhost tmp]# umount /data/
[root@localhost tmp]# extundelete /dev/my_vg/my_lv --inode 2
<=====================================================================================>
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11 Deleted
public 131073 Deleted
file1.txt 12 Deleted
<=====================================================================================>
########### 说实话 , 这里我遇到麻烦了 !!!
ext3 ext3grep
ext3/ext4 extundelete
下载地址:
ext3grep https://code.google.com/p/ext3grep/downloads/list
extundelete http://nchc.dl.sourceforge.net/project/extundelete/extundelete
安装依赖组件:
yum -y install gcc gcc-c++ make e2fsprogs-devel e2fsprogs-libs
安装 ext3grep
[root@localhost src]# tar zxf ext3grep-0.10.2.tar.gz
[root@localhost src]# cd ext3grep-0.10.2
[root@localhost ext3grep-0.10.2]# ./configure ; make ; make install
[root@localhost ~]# ext3grep -v
Running ext3grep version 0.10.2
ext3grep v0.10.2, Copyright (C) 2008 Carlo Wood.
ext3grep comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.
安装 extundelete
[root@localhost src]# tar jxf extundelete-0.2.4.tar.bz2
[root@localhost src]# cd extundelete-0.2.4
[root@localhost extundelete-0.2.4]# ./configure ; make ; make install
[root@localhost ~]# extundelete -v
extundelete version 0.2.4
libext2fs version 1.41.12
Processor is little endian.
验证数据恢复:
文件系统: ext3
使用工具: ext3grep
[root@localhost ~]# mkfs.ext3 /dev/my_vg/my_lv # 将分区格式化为 ext3
[root@localhost ~]# mount /dev/my_vg/my_lv /data/ # 挂载到 /data 目录
[root@localhost ~]# cd /data/
[root@localhost data]# mkdir share # 创建测试目录
[root@localhost data]# echo "***************************" > file1.txt
[root@localhost data]# echo "&&&&&&&&&&&&&&&&&&&&&&&&&&&" > share/file2.txt # 测试文件
[root@localhost data]# rm -rf * # 我们将 data 目录下的所有文件、目录全部删除
[root@localhost data]# cd /tmp/ # 切换到别的目录
[root@localhost tmp]# umount /data/ # 卸载分区
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --ls --inode 2 # 使用工具通过 inode 值扫描(一般“根”目录的 inode 都是 2)
<=====================================================================================>
Inode 2 is directory "".
Directory block 835:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 end d 2 drwxr-xr-x ..
2 5 d 11 D 1399471894 Wed May 7 22:11:34 2014 drwx------ lost+found
3 end d 24577 D 1399471894 Wed May 7 22:11:34 2014 drwxr-xr-x share
4 end r 13 D 1399471894 Wed May 7 22:11:34 2014 rrw-r--r-- file1.txt
<=====================================================================================>
# 这里扫描到了我们删除的东西,有字母 D 标识的表示已经删除
# 接下来我们在扫描一下 /data/ 目录下的 share 目录
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --ls --inode 24577
<=====================================================================================>
Inode 24577 is directory "share".
Directory block 112640:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 24577 D 1399471894 Wed May 7 22:11:34 2014 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 end r 24578 D 1399471894 Wed May 7 22:11:34 2014 rrw-r--r-- file2.txt
<=====================================================================================>
# 这里也扫描到了被删除的文件
# 现在我们只恢复 /data/share/file2.txt
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --restore-inode 24578
# 恢复回在当前目录下的 RESTORED_FILES/ 目录下,文件以 inode.文件 i 节点号命名
[root@localhost tmp]# cat RESTORED_FILES/inode.24578
&&&&&&&&&&&&&&&&&&&&&&&&&&&
# 我们可以看到文件内容没有改变,所以 文件恢复成功!
# 接下来 我们恢复被删除的全部内容
[root@localhost tmp]# ext3grep /dev/my_vg/my_lv --restore-all
[root@localhost tmp]# ls RESTORED_FILES/
file1.txt inode.24578 lost+found share
[root@localhost tmp]# ls RESTORED_FILES/share/
file2.txt
# 成功 ! 接下来就是修改权限,然后将他们移回原位!
文件系统: ext4
使用工具: extundelete
[root@localhost ~]# mkfs.ext4 /dev/my_vg/my_lv
[root@localhost ~]# mount /dev/my_vg/my_lv /data/
[root@localhost ~]# cd /data/
[root@localhost data]# mkdir public
[root@localhost data]# echo "ooooooooooooooooooooo" > file1.txt
[root@localhost data]# echo "mmmmmmmmmmmmmmmmmmmmm" > public/file2.txt
[root@localhost data]# rm -rf *
[root@localhost data]# cd /tmp/
[root@localhost tmp]# umount /data/
[root@localhost tmp]# extundelete /dev/my_vg/my_lv --inode 2
<=====================================================================================>
File name | Inode number | Deleted status
. 2
.. 2
lost+found 11 Deleted
public 131073 Deleted
file1.txt 12 Deleted
<=====================================================================================>
########### 说实话 , 这里我遇到麻烦了 !!!
0 0
- Linux ext3/ext4 文件系统数据恢复
- linux系统下EXT2/EXT3/EXT4文件系统的数据恢复
- ext3、ext4文件系统数据恢复--extundelete
- linux ext3 ext4 文件系统 rm -rf删除后数据快速恢复
- Linux 文件系统ext2, ext3, ext4
- Linux ext3/ext4误删文件,数据恢复方法
- Linux ext3/ext4误删文件,数据恢复方法
- Linux ext2, ext3, ext4 文件系统解读[1]
- Linux ext2, ext3, ext4 文件系统解读[2]
- Linux ext2, ext3, ext4 文件系统解读[3]
- Linux ext2, ext3, ext4 文件系统解读[4]
- Linux ext2, ext3, ext4 文件系统解读[5]
- opensuse 12.3 使用extundelete恢复ext3,ext4文件系统下被rm删除的数据
- linux ext3 ext4文件系统下 恢复 rm -rf 误删除文件
- 使用extundelete恢复linux ext3 ext4文件系统下由 rm -rf 误删除文件
- linux用extundelete恢复ext2、ext3、ext4下rm -rf误删除的数据
- Linux文件系统Ext2,Ext3,Ext4性能大比拼
- Linux文件系统格式Ext4,Ext3的特点和区别
- jquery mobile入门技巧
- RSA公钥加密—私钥解密&私钥加密—公钥解密&私钥签名—公钥验证签名
- 堆和栈的区别
- 利用itms services发布app
- Php调用java
- Linux ext3/ext4 文件系统数据恢复
- [深入浅出Cocoa]iOS网络编程之NSStream
- BIN,BCD码
- 上传附件
- prinf(str)输出带来的问题
- kvm : Permission denied
- 用实例谈谈javascript中的this和prototype
- html5点滴积累
- putchar与getchar以及对缓冲区的理解