ext3文件系统恢复文件

安装恢复利器ext3grep，目前最新版本ext3grep-0.10.2.tar.gz，下载地址：

误删除的文件为/root/tg2/gp/gp/public/javascript/test_grid.js

df查看发现/root没有单独分区,所以需要查找的块设备是: /dev/mapper/VolGroup00-LogVol00

[root@dev2 ext3grep-0.10.2]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                      5.7G  4.0G  1.5G  74% /
/dev/xvda1             99M   14M   80M  15% /boot
tmpfs                 512M     0  512M   0% /dev/shm

查询块设备上的所有inode，如需要可umount或恢复模式启动后操作

[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 2

Writing analysis so far to 'LogVol00.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 1396.
Inode 2 is directory "".
Directory block 1396:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d       2                                         drwxr-xr-x  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 d      11                                         drwx------  lost+found
   3    4 d  945633                                         drwxr-xr-x  boot
   4    5 d   65217                                         drwxr-xr-x  sys
   5    6 d  163041                                         drwxr-xr-x  proc
   6    7 d 1108673                                         drwxr-xr-x  dev
   7    8 d 1076065                                         drwxr-xr-x  etc
   8    9 d  195649                                         drwxr-xr-x  var
   9   10 d 1467361                                         drwxrwxrwt  tmp
  10   11 d 1043457                                         drwxr-x---  root
  11   12 d  489121                                         drwxr-xr-x  selinux
  12   13 d 1141281                                         drwxr-xr-x  lib64
  13   14 d 1173889                                         drwxr-xr-x  usr
  14   15 d  652161                                         drwxr-xr-x  bin
  15   16 d  456513                                         drwxr-xr-x  home
  16   17 d   97825                                         drwxr-xr-x  lib
  17   18 d  782593                                         drwxr-xr-x  media
  18   19 d  228257                                         drwxr-xr-x  mnt
  19   20 d  586945                                         drwxr-xr-x  opt
  20   21 d  130433                                         drwxr-xr-x  sbin
  21   22 d 1206497                                         drwxr-xr-x  srv
  22   23 d  260865                                         drwxr-xr-x  misc
  23   24 r  163767                                         rrw-r--r--  .autorelabel
  24   25 d  684791                                         dr-xr-xr-x  net
  25   26 d  554338                                         drwxr-xr-x  mirror
  26   27 d  619565                                         drwxr-xr-x  db
  27  end r  163768                                         rrw-r--r--  .autofsck

找到 /root的Inode: 1043457

列出/root中的Inode,最终找到/root/tg2/gp/gp/public/javascript的Inode

[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 1043457

找的的javascript目录的inode为1145906，列出所有文件

[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --ls --inode 1145906
The first block of the directory is 1152799.
Inode 1145906 is directory "root/tg2/gp/gp/public/javascript".
Directory block 1152799:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d 1145906                                         drwxr-xr-x  .
   1    2 d 1145869                                         drwxr-xr-x  ..
   2    3 d 1145997                                         drwxr-xr-x  .svn
   3    4 d 1146006                                         drwxr-xr-x  ext2.2.1
   4    5 d 1146007                                         drwxr-xr-x  a
   5  end d 1149201                                         drwxr-xr-x  util
   6  end r 1149665  D 1329361101 Thu Feb 16 10:58:21 2012  rrw-r--r--  test_grid.js
   7    8 r 1149252  D 1329361101 Thu Feb 16 10:58:21 2012  rrw-r--r--  jquery.divbox.js
   8    9 r 1149253  D 1329361101 Thu Feb 16 10:58:21 2012  rrw-r--r--  jquery.js
  11   12 r 1149515  D 1329361101 Thu Feb 16 10:58:21 2012  rrw-r--r--  test_extjs.js
  12  end r 1149653  D 1329361101 Thu Feb 16 10:58:21 2012  rrw-r--r--  test_grid_class.js.error

找出test_grid.js的inode,恢复test_grid.js

[root@dev2 ext3grep-0.10.2]# /usr/local/bin/ext3grep /dev/VolGroup00/LogVol00 --restore-inode 1149665
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 47
Minimum / maximum journal block: 1402 / 35600
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 14156800 = Sun Jun 14 04:26:40 1970
Journal transaction 319708 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 28191; min / max sequence numbers: 317456 / 322029
Restoring inode.1149665

恢复出来的文件保存在RESTORED_FILES目录下

mv RESTORED_FILES/inode.1149665 /root/tg2/gp/gp/public/javascript/test_grid.js