找回删除文件的试验

找回删除文件的试验

ext2文件系统可以，ext3,ext4都不行，因为使用debugfs工具找不到删除文件的inode.

深层次的原因，待查。

1.删除file 

linux-gyzy:/mnt/sdb1 # ls

lost+found  out

linux-gyzy:/mnt/sdb1 # rm out

2.找到删除文件的inode

debugfs:  lsdel

 Inode  Owner  Mode    Size      Blocks   Time deleted

    12      0 100644 31031296   6887/  6887 Sat Dec 25 20:11:21 2010

1 deleted inodes found.

3.使用debugfs 恢复

debugfs:  stat <12>

Inode: 12   Type: regular    Mode:  0644   Flags: 0x0

Generation: 2233663327    Version: 0x00000000

User:     0   Group:     0   Size: 31031296

File ACL: 0    Directory ACL: 0

Links: 0   Blockcount: 60680

Fragment:  Address: 0    Number: 0    Size: 0

ctime: 0x4d169639 -- Sat Dec 25 20:11:21 2010

atime: 0x4d16960c -- Sat Dec 25 20:10:36 2010

mtime: 0x4d169632 -- Sat Dec 25 20:11:14 2010

dtime: 0x4d169639 -- Sat Dec 25 20:11:21 2010

Size of extra inode fields: 0

BLOCKS:

(0-11):26624-26635, (IND):26636, (12-1035):26637-27660, (DIND):27661, (IND):27662, (1036-2059):27663-28686, (IND):28687, (2060-3083):28688-29711, (IND):29712, (3084-4107):29713-30736, (IND):30737, (4108-5131):30738-31761, (IND):31762, (5132-6136):31763-32767, (6137-6155):33608-33626, (IND):33627, (6156-6878):33628-34350

TOTAL: 6887

debugfs:  dump <12>  /root/out.recover