Linux 下的恢复软件

1、extundelete

http://zhumeng8337797.blog.163.com/blog/static/100768914201212354523149/

[root@yznvm1 yzn]# df
文件系统               1K-块        已用     可用 已用% 挂载点
/dev/sda3             18129292   2651744  14541764  16% /
/dev/sda1               194442     12197    172206   7% /boot
tmpfs                   254804         0    254804   0% /dev/shm
/dev/hdc               4149676   4149676         0 100% /mnt/cdrom

 

[root@yznvm1 yzn]# extundelete /dev/sda3 --restore-file /home/yzn/helloworld/Makefile.am        
WARNING: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 143 groups loaded.
Loading journal descriptors ... 29535 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Restored inode 4223596 to file RECOVERED_FILES/home/yzn/helloworld/Makefile.am

 

ok,这样就恢复成功了。

2、ntfsundelete

http://pbraun.nethence.com/unix/filesystems/ntfsundelete.html

NTFS undelete from a Linux system

Requirements

Make sure you've got ntfsundelete available,

which ntfsundelete

Note. it comes with ntfs-3g

Usage

Unmount the volume,

umount /dev/sdb2

Look for fully recoverable files, then for last two monthes only,

ntfsundelete /dev/sdb2 -p100

ntfsundelete /dev/sdb2 -p100 -t2m

Either undelete the precise files you need,

mkdir -p /data/undelete/

ntfsundelete /dev/sdb2 (-p100 -t2m) -u -d /data/undelete/ -i INODE_NUMBER

all the fully recoverable files, for last two monthes, ending with the mp3 extension,

ntfsundelete /dev/sdb2 -p100 -t2m -u -d /data/undelete/ -m'.mp3'

all the fully recoverable files, for last two monthes, for last two monthes,

ntfsundelete /dev/sdb2 -p100 -t2m -u -d /data/undelete/ -m'*'

References

http://www.tuxera.com/community/ntfs-3g-download/