如何在ext3上恢複資料--實踐

工作中遇見了，查了網上文章，發現沒幾個實際能通過的，實在是怒。自己找了軟體做了一次實戰操作，基本可以保證穩定恢複。

測試環境

[root@localhost ~]# uname -a

Linux localhost.localdomain 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux

所需的相關庫

[root@localhost ~]# rpm -qa |grep e2fsprogs

e2fsprogs-libs-1.39-8.el5

e2fsprogs-1.39-8.el5

e2fsprogs-devel-1.39-8.el5

分區情況

[root@localhost ~]# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/VolGroup00-LogVol00

6.2G 1.8G 4.2G 30% /

/dev/sda1 99M 11M 83M 12% /boot

/dev/mapper/VolGroup00-LogVol02

1008M 34M 924M 4% /data

tmpfs 125M 0 125M 0% /dev/shm

需要軟體

<a href="http://code.google.com/p/ext3grep/downloads/list">http://code.google.com/p/ext3grep/downloads/list</a>

先下載下傳軟體

[root@localhost ~]# cd /root/src/

[root@localhost src]# ls

ext3grep-0.6.0.tar.gz

[root@localhost src]# tar xfvz ext3grep-0.6.0.tar.gz

[root@localhost ext3grep-0.6.0]# ./configure

[root@localhost ext3grep-0.6.0]# make install

[root@localhost ext3grep-0.6.0]# ext3grep

Running ext3grep version 0.6.0

編譯然後測試可以使用了，一切做好了以後開始我們的恢複過程。

我的目錄是/data分區，我先格式化了分區，我放一個檔案在根目錄下和一個子目錄下的檔案。

/dev/mapper/VolGroup00-LogVol02 1008M 34M 924M 4% /data

拷貝點檔案過去

[root@localhost ~]# ]# cp /bin/ls /data/

[root@localhost ~]# ]# cp -rf /bin /data/

[root@localhost ~]# ]# ls -la /data/

total 136

drwxr-xr-x 4 root root 4096 Apr 21 17:37 .

drwxr-xr-x 25 root root 4096 Apr 21 17:11 ..

drwxr-xr-x 2 root root 4096 Apr 21 17:37 bin

drwx------ 2 root root 16384 Apr 21 17:15 lost+found

-rwxr-xr-x 1 root root 93560 Apr 21 17:37 ls

[root@localhost ~]#

一個子目錄一個可執行檔案

現在删除ls檔案和bin下面的zcat

[root@localhost ~]# rm /data/ls

rm: remove regular file `/data/ls'? y

[root@localhost ~]# rm /data/bin/zcat

rm: remove regular file `/data/bin/zcat'? y

[root@localhost ~]# ls -la /data/ls /data/bin/zcat

ls: /data/ls: No such file or directory

ls: /data/bin/zcat: No such file or directory

檔案沒有了然後我們來恢複

首先umount掉分區

[root@localhost ~]# umount /dev/mapper/VolGroup00-LogVol02

确認解除安裝，然後使用ext3grep來恢複。

[root@localhost ~]# ext3grep/dev/mapper/VolGroup00-LogVol02 --ls --inode 2

這裡會建立掃描分區

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --ls --inode 2

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file ls

WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

Number of groups: 8

Minimum / maximum journal block: 585 / 8787

Loading journal descriptors... sorting... done

Number of descriptors in journal: 58; min / max sequence numbers: 2 / 5

Loading VolGroup00-LogVol02.ext3grep.stage2... done

Restoring ls

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/ls

Restoring bin/ls

[root@localhost ~]# ls -la RESTORED_FILES/

total 124

drwxr-xr-x 3 root root 4096 Apr 21 18:01 .

drwxr-x--- 5 root root 4096 Apr 21 17:55 ..

-rwxr-xr-x 1 root root 93560 Apr 21 17:48 ls

[root@localhost ~]# ext3grep /dev/mapper/VolGroup00-LogVol02 --restore-file bin/zcat

Restoring bin/zcat

[root@localhost ~]# ls -la RESTORED_FILES/bin/

total 188

drwxr-xr-x 2 root root 4096 Apr 21 18:01 .

drwxr-xr-x 3 root root 4096 Apr 21 18:01 ..

-rwxr-xr-x 1 root root 62136 Apr 21 17:48 zcat

看看都恢複在RESTORED_FILES目錄下，大小也一樣

參考資料

<a href="http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html">http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html</a>