【Linux】ext3grep 误删恢复

ext3grep能够恢复通过rm -rf删除的文件
模拟实验恢复
1 分区状况

1. [root@node2 RESTORED_FILES]# df -h
   
2. Filesystem Size Used Avail Use% Mounted on
   
3. /dev/mapper/VolGroup00-LogVol00
   
4.                       5.7G 4.3G 1.2G 80% /
   
5. /dev/sda1 99M 12M 82M 13% /boot
   
6. tmpfs 147M 0 147M 0% /dev/shm
   
7. /dev/sdb1 5.0G 139M 4.6G 3% /ext3dir     ---目标

2 误删操作

1. [root@node2 ext3dir]#  ls
   
2. ib_logfile1 mysqlbin.000001 mysql-bin.000003 mysqlbin.000004 mysqlbin.000006 mysql-bin.index mysqld-relay-bin.index zabbix
   
3. ibdata1 lost+found mysql-bin.000002 mysqlbin.000003 mysql-bin.000005 mysqlbin.000007 mysqlbin.index node2.err
   
4. ib_logfile0 mysql-bin.000001 mysqlbin.000002 mysql-bin.000004 mysqlbin.000005 mysqlbin.000008 mysqld-relay-bin.000001 node2-slow.log
   
5. [root@node2 ext3dir]#  rm -rf /ext3dir/*

3 恢复

1. 赶快对盘umount，防止重新写入补删文件扇区。下载ext3grep，安装（编译安装过程艰辛暂且不表）。
   

1. *先执行扫描文件名命令：

1. 1. [root@node2 ~]# ext3grep /dev/sdb1 --dump-names
      
   2. Running ext3grep version 0.10.1
      
   3. Number of groups: 40
      
   4. Minimum / maximum journal block: 841 / 34478
      
   5. Loading journal descriptors... sorting... done
      
   6. The oldest inode block that is still in the journal, appears to be from 1472610198 = Wed Aug 31 10:23:18 2016
      
   7. Number of descriptors in journal: 82; min / max sequence numbers: 2 / 12
      
   8. Finding all blocks that might be directories.
      
   9. D: block containing directory start, d: block containing more directory entries.
      
   10. Each plus represents a directory start that references the same inode as a directory start that we found previously.
       
   11. 
       
   12. Searching group 0: DD++D++
   13. 。。
   14. abbix/trigger_discovery.frm
       zabbix/triggers.frm
       zabbix/user_history.frm
       zabbix/users.frm
       zabbix/users_groups.frm
       zabbix/usrgrp.frm
       zabbix/valuemaps.frm
       
       

1. *执行文件恢复命令

1. 1. 这款软件不能按目录恢复文件，只能执行恢复全部命令：
      
   2. [root@node2 ~]# ext3grep /dev/sdb1 --restore-all
   3. 。。。
   4. 。。。
   5. 注意：（在哪个目录下执行ext3grep 命令，恢复的数据文件就在哪个目录的RESTORED_FILES目录下）
   
   
   *检查
   
2. 已全部恢复

[root@node2 RESTORED_FILES]# pwd
/root/RESTORED_FILES
[root@node2 RESTORED_FILES]# ls
?? ib_logfile1 mysqlbin.000001 mysql-bin.000003 mysqlbin.000004 mysqlbin.000006 mysql-bin.index mysqld-relay-bin.index zabbix
ibdata1 lost+found mysql-bin.000002 mysqlbin.000003 mysql-bin.000005 mysqlbin.000007 mysqlbin.index node2.err
ib_logfile0 mysql-bin.000001 mysqlbin.000002 mysql-bin.000004 mysqlbin.000005 mysqlbin.000008 mysqld-relay-bin.000001 node2-slow.log

*恢复单个文件

[root@node2 ~]# ext3grep /dev/sdb1 --restore-file mysqlbin.000004 Running ext3grep version 0.10.1
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 40
Minimum / maximum journal block: 841 / 34478
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1472610198 = Wed Aug 31 10:23:18 2016
Number of descriptors in journal: 82; min / max sequence numbers: 2 / 15
Loading sdb1.ext3grep.stage2... done
Restoring mysqlbin.000004
[root@node2 ~]# ls RESTORED_FILES/
mysqlbin.000004

后续：ext4文件系统是否支持还没测试，待续！
参考文档：
http://dbaplus.cn/news-21-641-1.html
http://blog.sina.com.cn/s/blog_96c3ca3a01014qe6.html

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/29096438/viewspace-2124248/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/29096438/viewspace-2124248/