分类： LINUX
2012-02-16 12:28:58
安装恢复利器ext3grep，目前最新版本ext3grep-0.10.2.tar.gz，下载地址：
误删除的文件为/root/tg2/gp/gp/public/javascript/test_grid.js
df查看发现/root没有单独分区,所以需要查找的块设备是: /dev/mapper/VolGroup00-LogVol00
[root@dev2 ext3grep-0.10.2]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
5.7G 4.0G 1.5G 74% /
/dev/xvda1 99M 14M 80M 15% /boot
tmpfs 512M 0 512M 0% /dev/shm
查询块设备上的所有inode，如需要可umount或恢复模式启动后操作
[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 2
Writing analysis so far to 'LogVol00.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 1396.
Inode 2 is directory "".
Directory block 1396:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found
3 4 d 945633 drwxr-xr-x boot
4 5 d 65217 drwxr-xr-x sys
5 6 d 163041 drwxr-xr-x proc
6 7 d 1108673 drwxr-xr-x dev
7 8 d 1076065 drwxr-xr-x etc
8 9 d 195649 drwxr-xr-x var
9 10 d 1467361 drwxrwxrwt tmp
10 11 d 1043457 drwxr-x--- root
11 12 d 489121 drwxr-xr-x selinux
12 13 d 1141281 drwxr-xr-x lib64
13 14 d 1173889 drwxr-xr-x usr
14 15 d 652161 drwxr-xr-x bin
15 16 d 456513 drwxr-xr-x home
16 17 d 97825 drwxr-xr-x lib
17 18 d 782593 drwxr-xr-x media
18 19 d 228257 drwxr-xr-x mnt
19 20 d 586945 drwxr-xr-x opt
20 21 d 130433 drwxr-xr-x sbin
21 22 d 1206497 drwxr-xr-x srv
22 23 d 260865 drwxr-xr-x misc
23 24 r 163767 rrw-r--r-- .autorelabel
24 25 d 684791 dr-xr-xr-x net
25 26 d 554338 drwxr-xr-x mirror
26 27 d 619565 drwxr-xr-x db
27 end r 163768 rrw-r--r-- .autofsck
找到 /root的Inode: 1043457
列出/root中的Inode,最终找到/root/tg2/gp/gp/public/javascript的Inode
[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 1043457
找的的javascript目录的inode为1145906，列出所有文件
[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 1145906
The first block of the directory is 1152799.
Inode 1145906 is directory "root/tg2/gp/gp/public/javascript".
Directory block 1152799:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1145906 drwxr-xr-x .
1 2 d 1145869 drwxr-xr-x ..
2 3 d 1145997 drwxr-xr-x .svn
3 4 d 1146006 drwxr-xr-x ext2.2.1
4 5 d 1146007 drwxr-xr-x a
5 end d 1149201 drwxr-xr-x util
6 end r 1149665 D 1329361101 Thu Feb 16 10:58:21 2012 rrw-r--r-- test_grid.js
7 8 r 1149252 D 1329361101 Thu Feb 16 10:58:21 2012 rrw-r--r-- jquery.divbox.js
8 9 r 1149253 D 1329361101 Thu Feb 16 10:58:21 2012 rrw-r--r-- jquery.js
11 12 r 1149515 D 1329361101 Thu Feb 16 10:58:21 2012 rrw-r--r-- test_extjs.js
12 end r 1149653 D 1329361101 Thu Feb 16 10:58:21 2012 rrw-r--r-- test_grid_class.js.error
找出test_grid.js的inode,恢复test_grid.js
[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --restore-inode 1149665
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 47
Minimum / maximum journal block: 1402 / 35600
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 14156800 = Sun Jun 14 04:26:40 1970
Journal transaction 319708 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 28191; min / max sequence numbers: 317456 / 322029
Restoring inode.1149665
恢复出来的文件保存在RESTORED_FILES目录下
mv RESTORED_FILES/inode.1149665 /root/tg2/gp/gp/public/javascript/test_grid.js
