实施步骤如下：
（1） 模拟MYSQL表被删除环境，注明：下面介绍在采用的是MyISAM存储引擎的mysql中模拟表被误删除的恢复过程。假设：mysql所在的磁盘分区为/dev/sdb1， 挂在到/test目录下。
（2）查看mysql数据库表信息
[root@localhost test]# mysql -u root -p
mysql> use mysql;
Database changed
mysql> show tables;
+---------------------------+
| Tables_in_mysql |
+---------------------------+
| columns_priv |
| db |
| func |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| proc |
| procs_priv |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+---------------------------+
17 rows in set (0.01 sec)
mysql> select * from host;
Empty set (0.01 sec)
mysql> desc host;
+-----------------------+---------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-----------------------+---------------+------+-----+---------+-------+
| Host | char(60) | NO | PRI | | |
| Db | char(64) | NO | PRI | | |
| Select_priv | enum('N','Y') | NO | | N | |
| Insert_priv | enum('N','Y') | NO | | N | |
| Update_priv | enum('N','Y') | NO | | N | |
| Delete_priv | enum('N','Y') | NO | | N | |
| Create_priv | enum('N','Y') | NO | | N | |
| Drop_priv | enum('N','Y') | NO | | N | |
| Grant_priv | enum('N','Y') | NO | | N | |
| References_priv | enum('N','Y') | NO | | N | |
| Index_priv | enum('N','Y') | NO | | N | |
| Alter_priv | enum('N','Y') | NO | | N | |
| Create_tmp_table_priv | enum('N','Y') | NO | | N | |
| Lock_tables_priv | enum('N','Y') | NO | | N | |
| Create_view_priv | enum('N','Y') | NO | | N | |
| Show_view_priv | enum('N','Y') | NO | | N | |
| Create_routine_priv | enum('N','Y') | NO | | N | |
| Alter_routine_priv | enum('N','Y') | NO | | N | |
| Execute_priv | enum('N','Y') | NO | | N | |
+-----------------------+---------------+------+-----+---------+-------+
19 rows in set (0.01 sec)
mysql>
（3）删除 “host”表
mysql> drop table host;
Query OK, 0 rows affected (0.03 sec)
mysql> show tables;
+---------------------------+
| Tables_in_mysql |
+---------------------------+
| columns_priv |
| db |
| func |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| proc |
| procs_priv |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+---------------------------+
16 rows in set (0.01 sec)
（4）停止mysql数据库，卸载MYSQL所在分区
[root@localhost ~]# service mysqld stop
[root@localhost ~]# umount /test/
（5）ext3grep分析数据，恢复数据
对mysql执行分区数据扫描
[root@localhost ~]# ext3grep /dev/sdb1 --ls --inode 2
Running ext3grep version 0.10.2
Number of groups: 16
Loading group metadata... done
Minimum / maximum journal block: 649 / 8851
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1340192235 = Wed Jun 20 19:37:15 2012
Number of descriptors in journal: 238; min / max sequence numbers: 18 / 65
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 643.
Inode 2 is directory "".
Directory block 643:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 16385 drwxr-xr-x ext3grep
3 4 r 11 rrw-r--r-- ext3grep.txt
4 5 r 12 rrw------- initrd-2.6.18-164.el5.img
5 6 r 13 rrw-r--r-- inode.12
6 7 d 32769 drwx------ lost+found
7 8 r 14 rrw-r--r-- profile
8 9 d 114689 drwx------ mysql
9 10 d 131073 drwx------ test
10 11 r 15 rrw-rw---- ibdata1
11 12 r 16 rrw-rw---- ib_logfile0
12 end r 17 rrw-rw---- ib_logfile1
通过上图可知，mysql目录中有可恢复数据信息，根据查询到的恢复信息，可知mysql目录Inode号是114689 ，接着扫描mysql目录的inode信息。
[root@localhost ~]# ext3grep /dev/sdb1 --ls --inode 114689
Running ext3grep version 0.10.2
Number of groups: 16
Minimum / maximum journal block: 649 / 8851
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1340192235 = Wed Jun 20 19:37:15 2012
Number of descriptors in journal: 238; min / max sequence numbers: 18 / 65
Inode is Allocated
Loading sdb1.ext3grep.stage2... done
The first block of the directory is 253952.
Inode 114689 is directory "ext3grep".
Directory block 253952:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 114689 drwx------ .
1 2 d 2 drwxr-xr-x ..
2 end r 114690 rrw-rw---- hosts
注明：在上面的操作中，首先通过“--ls --inode 2” 参数扫描了整个分区信息，查找到mysql目录对应的inode为114689，接着查找inode为114689下面的文件信息。通过对inode为114689的mysql目录进行扫描，查找到了目录下所有文件盒目录的inode信息，根据上面一步操作可知mysql目录的Directory block为253952 下面通过命令查看mysql目录下inode信息。
[root@localhost ~]# ext3grep /dev/sdb1 --ls --block 253952
Running ext3grep version 0.10.2
Number of groups: 16
Minimum / maximum journal block: 649 / 8851
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1340192235 = Wed Jun 20 19:37:15 2012
Number of descriptors in journal: 238; min / max sequence numbers: 18 / 65
Group: 7
Block 253952 is a directory. The block is Unallocated
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 114689 drwx------ .
1 2 d 2 drwxr-xr-x ..
2 end r 114690 rrw-rw---- hosts
WARNING: inode 114689 was reallocated!
（6）恢复mysql数据文件
[root@localhost ~]# ext3grep /dev/sdb1 --restore-inode 114690
Running ext3grep version 0.10.2
Number of groups: 16
Minimum / maximum journal block: 649 / 8851
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1340192235 = Wed Jun 20 19:37:15 2012
Number of descriptors in journal: 238; min / max sequence numbers: 18 / 65
Restoring inode.114690
