Shulou(Shulou.com)06/01 Report--

In this issue, the editor will bring you about how to recover the enterprise server files after being deleted by mistake. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.

Using ext3grep to recover files deleted by rm-rf

Linux as an enterprise server, data security is very important, any valuable data is mistakenly deleted can not be tolerated, and may even bring great disaster! As a linux system administrator, we must have the meaning of data protection, not only do a good job of data backup, but also have the ability to restore important data after mistakenly deleted. Here I would like to introduce an open source data recovery tool, ext3grep, which can recover files mistakenly deleted by rm-rf.

First, the principle of ext3grep:

Using ext3grep to recover files does not depend on any file format. First, ext3grep uses the inode of root to obtain all the file information in the file system, including existing or deleted files, including file name, inode number, and then use inode combined with system log to query the block location of the inode, including direct and indirect block information, and finally use the dd command to back up the data information so as to restore the data!

When it is found that the file has been mistakenly deleted, the first thing to do is to uninstall the partition where the file is located, or mount the partition read-only, because after the file is deleted, the data in the file remains on disk. Unless the system allocates the block in which the data is located, it will always exist, so for insurance, the first thing to do is to uninstall the partition where the file is located.

As for the root partition, you can restart the system, then enter the system in single-user mode and mount the root partition as read-only:

Mount-o ro,remount /

II. Ext3grep installation

Before installation, first check whether the system has installed e2fsprogs-related software, if you do not need to download and install, otherwise you will report an error when installing ext3greep!

[root@localhost ~] # rpm-qa | grep e2fs

E2fsprogs-devel-1.39-23.el5_5.1

E2fsprogs-libs-1.39-23.el5_5.1

E2fsprogs-1.39-23.el5_5.1

E2fsprogs-libs-1.39-23.el5_5.1

You can download the ext3grep source package from the Internet:

Wget http://code.google.com/p/ext3grep/downloads/detail?name=ext3grep-0.10.2.tar.gz

Extract, compile, install

Tar zxf ext3grep-0.10.2.tar.gz

Cd ext3grep-0.10.2

. / configure-prefix=/usr/local/ext3grep

Make

Make install

Third, using ext3grep to recover the data deleted by rm-rf

First, we simulate a disk partition and create a virtual device.

[root@localhost ~] # mkdir / disk create mount point

[root@localhost ~] # mkdir / virtual

[root@localhost ~] # dd if=/dev/zero of=/virtual/disk1 conut=102400

[root@localhost] # mkfs-t ext3 / vittual/disk1

[root@localhost] # mount-o loop / virtual/disk1 / disk

[root@localhost ~] # echo "this is an ext3grep test,thank you" > / disk/ext3grep-test.txt

Delete the file you just created with rm-rf

Rm-rf / disk/*

Then check to confirm that the file has been deleted

Use ext3grep to recover deleted files

Create a directory dedicated to storing restored files

Mkdir restore

Cd restore

IV. The process of restoring files

Execute under the restore directory you just created

View deleted file information

[root@localhost restore] # / usr/local/ext3grep/bin/ext3grep / virtual/disk-ls-inode 2

File type in dir_entry (r=regular file, d=directory, l=symlink)

| |.-D: Deleted; R: Reallocated |

Indx Next | Inode | Deletion time Mode File name

= +-data-from-inode-+-+=

0 1 d 2 drwxr-xr-x.

1 end d 2 drwxr-xr-x..

2 end d 11 D 1340620814 Mon Jun 25 18:40:14 2012 drwx- lost+found

3 end r 12 D 1340620814 Mon Jun 25 18:40:14 2012 rrw-r--r-- ext3grep-test.txt

Start recovery

[root@localhost restore] # / usr/local/ext3grep/bin/ext3grep / virtual/disk-- restore-file ext3grep-test.txt

Running ext3grep version 0.10.2

WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

Number of groups: 7

Minimum / maximum journal block: 16616 / 20729

Loading journal descriptors... Sorting... Done

The oldest inode block that is still in the journal, appears to be from 1340620763 = Mon Jun 25 18:39:23 2012

Number of descriptors in journal: 20; min / max sequence numbers: 2 / 5

Writing output to directory RESTORED_FILES/

Loading disk.ext3grep.stage2... Done

Restoring ext3grep-test.txt

As you can see from the output above, the ext3grep-test.txt file has been restored successfully, a RESTORED_FILES directory is generated under the current directory, and the restored files are placed there.

[root@localhost RESTORED_FILES] # ls

Ext3grep-test.txt

Although this tool can recover files deleted by the rm-rf command, as a system administrator, you should have a concept of backing up data all the time. After all, backup is king!

Of course, there are already system recovery tools in rhel7, and foreign tools are no longer used to recover data.

The above is how the enterprise server files shared by Xiaobian were deleted by mistake. If you happen to have similar doubts, you might as well refer to the above analysis to understand. If you want to know more about it, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.