分类：
2009-02-27 14:18:02
前天发现AIX5.2的fsdb命令与AIX5.3的不同，不提供hex dump子命令，导致恢复文件时陷入困境——无法知道已删文件的i-node。不过可以另辟蹊径——观察文件系统下现有文件的i-node的连续性，从而猜出已删文件的i-node。昨天做的一个简单的恢复过程如下：
10:05:58 . -xdev -exec ls -id {} \; | sort -n
2 .
3 ./lost+found
4 ./aa
6 ./lost+found/6
10:11:02 /
10:11:10 /test
10:11:26 /test
File System: /test
File System Size: 65120 (512 byte blocks)
Aggregate Block Size: 4096
Allocation Group Size: 8192 (aggregate blocks)
> i 5
Inode 5 at block 26, offset 0xa00:
[1] di_fileset: 16 [14] di_inostamp: 0x49a50fa7
[2] di_number: 5 [15] di_gen: 3651829905
[3] di_size: 0x000000000000001f [16] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [17] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [18] di_ixpxd.addr2: 0x0000001a
[6] di_mode: 0x000281a4 di_ixpxd.address: 26
0100644 -rw-r--r-- [19] di_uid: 0
[7] di_ea.flag: 0x00 [20] di_gid: 0
[21] di_atime.tj_sec:0x0000000049a5da07
[8] di_ea.nEntry: 0x00 [22] di_atime.tj_nsec: 0x234fcccf
[9] di_ea.len: 0 [23] di_ctime.tj_sec:0x0000000049a5da1c
[10] di_ea.addr1: 0x00 [24] di_ctime.tj_nsec: 0x2f1e6fe8
[11] di_ea.addr2: 0x00000000 [25] di_mtime.tj_sec:0x0000000049a5da07
di_ea.address: 0 [26] di_mtime.tj_nsec: 0x2420ac9b
[12] di_ea.type: 0x0000 [27] di_otime.tj_sec:0x0000000049a5da07
[28] di_otime.tj_nsec: 0x234fcccf
[13] di_ea.nblocks: 0 [29]
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > m 5 1
Inode 5 at block 26, offset 0xa00:
[1] di_fileset: 16 [14] di_inostamp: 0x49a50fa7
[2] di_number: 5 [15] di_gen: 3651829905
[3] di_size: 0x000000000000001f [16] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [17] di_ixpxd.addr1: 0x00
[5] di_nlink: 1 [18] di_ixpxd.addr2: 0x0000001a
[6] di_mode: 0x000281a4 di_ixpxd.address: 26
0100644 -rw-r--r-- [19] di_uid: 0
[7] di_ea.flag: 0x00 [20] di_gid: 0
[21] di_atime.tj_sec:0x0000000049a5da07
[8] di_ea.nEntry: 0x00 [22] di_atime.tj_nsec: 0x234fcccf
[9] di_ea.len: 0 [23] di_ctime.tj_sec:0x0000000049a5da1c
[10] di_ea.addr1: 0x00 [24] di_ctime.tj_nsec: 0x2f1e6fe8
[11] di_ea.addr2: 0x00000000 [25] di_mtime.tj_sec:0x0000000049a5da07
di_ea.address: 0 [26] di_mtime.tj_nsec: 0x2420ac9b
[12] di_ea.type: 0x0000 [27] di_otime.tj_sec:0x0000000049a5da07
[28] di_otime.tj_nsec: 0x234fcccf
[13] di_ea.nblocks: 0 [29]
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > x
> quit
10:12:02 /test
****************
The current volume is: /dev/fslv05
**Phase 1 - Check Blocks, Files/Directories, and Directory Entries
**Phase 2 - Count links
**Phase 3 - Duplicate Block Rescan and Directory Connectedness
**Phase 4 - Report Problems
**Phase 5 - Check Connectivity
**Phase 6 - Perform Corrections
**Phase 7 - Verify File/Directory Allocation Maps
File system inode map is corrupt; FIX? y
**Phase 8 - Verify Disk Allocation Maps
Block allocation map is corrupt; FIX? y
32768 kilobytes total disk space.
1 kilobytes in 2 directories.
9 kilobytes in 3 user files.
32424 kilobytes are available for use.
File system is clean.
Superblock is marked dirty; FIX? y
All observed inconsistencies have been repaired.
10:12:10 /test
10:12:19 /test
10:12:21
aa lost+found
10:12:22 l*
10:12:25
5 6
10:12:26 5
Thu Feb 26 07:53:43 BEIST 2009
10:12:28 ]#
说明：这是针对AIX5.2的JFS2文件系统的，不针对JFS文件系统，也不针对AIX5.3及以上的操作系统。
========================================================================
任何形式的转载，请写明出处：
email:
blog: http://www.cublog.cn/u/739/
========================================================================
