Shulou(Shulou.com)06/01 Report--

This article will explain in detail how to use ext3grep to recover deleted files under Linux. The editor thinks it is very practical, so I share it with you for reference. I hope you can get something after reading this article.

10 GB of data was mistakenly deleted, almost crashed, tried all the regular recovery software, useless, about to give up, found this open source thing ext3grep!

Smooth recovery of all data, so data deletion under linux is not terrible, the terrible thing is that there is no way to restore after deletion, take a look at the following operation!

[root@localhost] # uname-a Linux localhost.localdomain 2.6.18-8.el5 # 1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux

In fact, it doesn't matter what version of the system!

Required related libraries

[root@localhost ~] # rpm-qa | grep e2fsprogs e2fsprogs-libs-1.39-8.el5 e2fsprogs-1.39-8.el5 e2fsprogs-devel-1.39-8.el5

There must be e2fsprogs-libs, or there will be problems with the installation of ext3grep later.

Zoning:

[root@localhost ~] # df-h Filesystem Size Used Avail Use% Mounted on / dev/mapper/VolGroup00-LogVol00 6.2G 1.8G 4.2G 30% / / dev/sda1 99M 11M 83M 12% / boot / dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% / data tmpfs 125m 0125m 0% / dev/shm

Software is required

Http://code.google.com/p/ext3grep/downloads/list

Download the software first

[root@localhost ~] # cd / root/src/ [root@localhost src] # wget http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src [root@localhost src] # ls ext3grep-0.6.0.tar.gz [root@localhost src] # tar xfvz ext3grep-0.6.0.tar.gz [root@localhost ext3grep-0.6.0] #. / configure [root@localhost ext3grep-0.6.0] # make Install [root@localhost ext3grep-0.6.0] # ext3grep Running ext3grep version 0.6.0

Compilation and testing are ready for use, and when everything is done, we begin our recovery process.

My directory is the / data partition. I formatted the partition first. I put a file in the root directory and a file in a subdirectory.

/ dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% / data

The following italics are not required:

In fact, it doesn't matter what partition is used here, you can also simulate one. Here are the simulation steps:

Mkdir / data1/ cd / data1/ dd if=/dev/zero of=disk1 count=2048000 mkfs.ext3 disk1 mkdir-p / dfs/a mount-o loop / data1/disk1 / dfs/a

Here, we use the / data partition to copy some files first.

[root@localhost ~] #] # cp / bin/ls / data/ [root@localhost ~] #] # cp-rf / bin/ data/ [root@localhost ~] #] # ls-la / data/ total 136 drwxr-xr-x 4 root root 4096 Apr 21 17:37 Drwxr-xr-x 25 root root 4096 Apr 21 17:11.. Drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin drwx-- 2 root root 16384 Apr 21 17:15 lost+found-rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls [root@localhost ~] #

One subdirectory, one executable.

Now delete the ls file and the zcat under bin

[root@localhost ~] # rm / data/ls rm: remove regular file `/ data/ls'? Y [root@localhost ~] # rm / data/bin/zcat rm: remove regular file `/ data/bin/zcat'? Y [root@localhost ~] # ls-la / data/ls / data/bin/zcat ls: / data/ls: No such file or directory ls: / data/bin/zcat: No such file or directory

The file is gone, and then we'll restore:

First, umount must delete the partition of the data by mistake:

[root@localhost ~] # umount / dev/mapper/VolGroup00-LogVol02 [root@localhost ~] # df-h Filesystem Size Used Avail Use% Mounted on / dev/mapper/VolGroup00-LogVol00 6.2G 1.8G 4.2G 30% / / dev/sda1 99M 11M 83M 12% / boot tmpfs 125m 0125m 0% / dev/shm

Confirm the uninstall, and then use ext3grep to restore.

[root@localhost] # ext3grep / dev/mapper/VolGroup00-LogVol02-- ls-- inode 2

A scan partition will be created here

[root@localhost] # ext3grep / dev/mapper/VolGroup00-LogVol02-- ls-- inode 2 [root@localhost ~] # ext3grep / dev/mapper/VolGroup00-LogVol02-- restore-file ls Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... Sorting... Done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... Done Restoring ls [root@localhost ~] # ext3grep / dev/mapper/VolGroup00-LogVol02-- restore-file bin/ls Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... Sorting... Done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... Done Restoring bin/ls [root@localhost] # ls-la RESTORED_FILES/ total 124 drwxr-xr-x 3 root root 4096 Apr 21 18:01. Drwxr-x- 5 root root 4096 Apr 21 17:55.. -rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls [root@localhost] # ext3grep / dev/mapper/VolGroup00-LogVol02-- restore-file bin/zcat Running ext3grep version 0.6.0 WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. Number of groups: 8 Minimum / maximum journal block: 585 / 8787 Loading journal descriptors... Sorting... Done Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5 Loading VolGroup00-LogVol02.ext3grep.stage2... Done Restoring bin/zcat [root@localhost] # ls-la RESTORED_FILES/bin/ total 188 drwxr-xr-x 2 root root 4096 Apr 21 18:01. Drwxr-xr-x 3 root root 4096 Apr 21 18:01.. -rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat

Look at the restore in the RESTORED_FILES directory, the same size, where the RESTORED_FILES directory is the current directory where ext3grep is executed!

You can also use:

Ext3grep / termite/cc-disk-- restore-all

Restore all files and directories, but directories, if deleted for a long time, may not be fully restored, compressed files can generally be restored.

This is the end of this article on "how to use ext3grep to recover deleted files under Linux". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, please share it out for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.