Ext3 file System Undelete Weapon-ext3grep

Linux as an enterprise-Class server, the security of data is critical, any data del lost and mistakenly deleted are not tolerated! Recently I contacted a software-ext3grep, it can restore the data mistakenly deleted, the following is a brief explanation of the software. recovery principle of Ext3grep

Using Ext3grep to recover files is not dependent on a specific text format. The first step is to get information about all the files under the current filesystem, including the file name and the Inode, by Ext3grep the filesystem's root inode (the inode of the root directory is typically 2). Then, the inode information is used to query the block location of the inode, including the information such as direct block and indirect block. Finally, the DD command is used to back up the information and restore the data file.

installation of Ext3grep

EXT3GREP Official website: http://code.google.com/p/ext3grep/

NET disk Download: Http://pan.baidu.com/s/1i47ZPsT

The required system-related packages are as follows:

[[Email protected] ~] #rpm-qa | grep E2fsprogse2fsprogs-libs-1.39-8.el5e2fsprogs-1.39-8.el5e2fsprogs-devel-1.39-8.el5

The above three must be installed, or the subsequent installation will cause problems.

The following steps go into the compile and install phase, as follows:

[Email protected]/opt]# tar zxvf ext3grep-0.10.2.tar.gz[[email protected] ext3grep-0.10.2]#./configure[[email Protected] ext3grep-0.10.2]# Make[[email protected] ext3grep-0.10.2]# make Install[[email protected] ext3grep-0.10.2]# Ext3grep-vrunning Ext3grep version 0.10.2

The default Ext3grep command is placed in the/usr/local/bin directory, please use "Ext3grep--help" for detailed usage help.

actual combat ext3grep recover files simulated data mistakenly deleted environment

The following is a simulation environment that details the process of recovering a data file using Ext3grep:

[[email protected] ~]# mkdir/disk[[email protected] ~]# mkdir/mydata[[email protected] ~]# Cd/mydata[[email protected] mydata]# DD If=/dev/zero  of=/mydata/disk1 count=102400[[email protected] mydata] #mkfs. Ext3/mydata/disk1

[[email protected] mydata] #mount-o loop/mydata/disk1  /disk[[email protected] MyData] #cd/disk[[email protected] disk]# Cp/etc/profile/disk[[email protected] disk]# cp/boot/initramfs-2.6.32-220.el6.i686.img/disk[[email protected ] disk] #echo "I am Archy" > Ext3grep.txt[[email protected] disk] #mkdir/disk/ext3grep[[email protected] disk] #cp/etc/h Osts/disk/ext3grep[[email protected] disk] #ls-al

[[email protected] disk] #md5sum Profile[[email protected] disk] #md5sum Initramfs-2.6.32-220.el6.i686.img[[email Protected] disk] #md5sum Ext3grep.txt[[email protected] disk] #rm-rf/disk/*[[email protected]/opt]# Umount/disk

Querying data recovery information

Execute the following command to query the data information that needs to be recovered:

[Email protected]/opt]# ext3grep/mydata/disk1  --ls--inode 2

This command is primarily used to scan all information under the current file system, including existing and deleted files, which contain the D-ID that the file has been deleted. You can get the path information for the file to be recovered by using the following command:

[Email protected]/opt]# Ext3grep/mydata/disk1  --dump-names

Recovering deleted data

The single File Recovery command is as follows:

[Email protected]/opt]# ext3grep/mydata/disk1  --restore-file  ext3grep.txt

The recovered files are stored in the/opt/restored_files directory.

The command to recover all deleted data is as follows:

[Email protected]/opt]# Ext3grep/mydata/disk1  --reatore-all

This article reprinted address: http://www.linuxprobe.com/file-undelete-ext3grep.html

Free to provide the latest Linux technology tutorials Books, for open-source technology enthusiasts to do more and better: http://www.linuxprobe.com/

Ext3 file System Undelete Weapon-ext3grep