分类： LINUX
2011-03-26 20:52:17
LINUX恢复删除后的文件
1、恢复ext3文件系统中的删除文件操作：
（1） ext3grep /dev/sdb1 --ls --inode 2
查询/dev/sdb1文件系统下删除的所有文件。显示内容如下：
Runningext3grep version 0.10.1 WARNING:I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. WARNING:EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that yourpartition is still mounted, and/or the file system is in an uncleanstate. Numberof groups: 16 Loadinggroup metadata... done Minimum/ maximum journal block: 197095 / 205296 Loadingjournal descriptors... sorting... done Theoldest inode block that is still in the journal, appears to be from1280903562 = Wed Aug 4 14:32:42 2010 Numberof descriptors in journal: 55; min / max sequence numbers: 6 / 17 Inodeis Allocated Loadingsdb1.ext3grep.stage2... done Thefirst block of the directory is 610. Inode2 is directory "". Directoryblock 610: .--File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated IIndxNext | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+=========
（2） ext3grep /dev/sdb1 --restore-file abc ＃恢复文件名为abc
（3） ext3grep /dev/sdb1 –restore-all ＃恢复所有被删除的文件及目录。注：恢复的文件或目录存放在当前目录的RESTORED_FILES目录下。
2、恢复NTFS格式文件系统的删除掉的文件
步骤1：安装ntfsprogs
sudoapt-get install ntfsprogs
步骤2：卸载误删文件的NTFS分区
umount /media/ufdisk/
步骤3：查看最近1天删除的文件
ntfsundelete /dev/sdb1 -t 1d
Inode Flags %age Date Size Filename
---------------------------------------------------------------
16 F... 0% 2010-08-04 0
17 F... 0% 2010-08-04 0
18 F... 0% 2010-08-04 0
19 F... 0% 2010-08-04 0
20 F... 0% 2010-08-04 0
21 F... 0% 2010-08-04 0
22 F... 0% 2010-08-04 0
23 F... 0% 2010-08-04 0
68 FR.. 100% 2010-08-04 13
Fileswith potentially recoverable content: 1
步骤4：恢复INODE为68的文件
ntfsundelete /dev/sdb1 -u -i 68 -d test/
Inode Flags %age Date Size Filename
---------------------------------------------------------------
68 FR.. 0% 2010-08-04 13
Undeleted'(null)' successfully.
步骤5：成功后，本例恢复后的文件是test/unknow文件，是否正确。
