File methods for recovering deleted files under Linux (Ext2 and ext3)

Methods for recovering deleted files under Linux (Ext2 and ext3) 2009-12-19 15:23:47

Category: LINUX

if it is ext2 file system, the direct use of Debugfs can be recovered, but for Ext3,debugfs there is nothing, fortunately we have ext3grep this open source tool (http://code.google.com/p/ext3grep/)! For ext21. Create and delete test files on/data (/DEV/SDB) (for testing purposes plantodelete for example)#vi PlantodeleteEnter this text is plantodelete! save exit#rm-F plantodelete   2. Remount/data in read-only mode to prevent file re-writing#mount-R-n-o Remount/datain case of busy#fuser-K/data3. Recover deleted files by mistake#Debugfs/dev/sdb Debugfs 1.35 (28-feb-2004)
Debugfs: lsdel <--list deleted files Inode Owner Mode Size Blocks time deleted
0 100600 4096 1/1 Sat Dec 19 15:54:04 2009
-0 100644 1/1 Sat Dec 19 15:54:08 2009
2 deleted inodes found.
Debugfsstat <13> <--View status
Inode:13 type:regular mode:0644 flags:0x0 generation:2897353947
user:0 group:0 size:14
File acl:1033 Directory acl:0
links:0 blockcount:16
fragment:address:0 number:0 size:0
CTIME:0X4B2C86A0-Sat Dec 19 15:54:08 2009
atime:0x4b2c869c-Sat Dec 19 15:54:04 2009
mtime:0x4b2c869c-Sat Dec 19 15:54:04 2009
DTIME:0X4B2C86A0-Sat Dec 19 15:54:08 2009
BLOCKS:
(0): 8200
Total:1
Debugfsdump <13> plantodelete <--recover filesDebugfs: q <--exit Debugfs you can see the recovered files in the current directory running the DEBUGFS command.

For ext31. Download and install Ext3grep#wget-Chttp://ext3grep.googlecode.com/files/ext3grep-0.10.1.tar.gz #tar zxf ext3grep-0.10.1.tar.gz #cd ext3grep-0.10.1#./configure#make#make InstallDependency Packages

-r--r--r--1 root root 863808 Nov 5 19:03 e2fsprogs-1.39-33.el5.x86_64.rpm
-r--r--r--1 root root 587041 Nov 5 19:03 e2fsprogs-devel-1.39-33.el5.i386.rpm
-r--r--r--1 root root 652235 Nov 5 19:03 e2fsprogs-devel-1.39-33.el5.x86_64.rpm
-r--r--r--1 root root 122537 Nov 5 19:03 e2fsprogs-libs-1.39-33.el5.i386.rpm
-r--r--r--1 root root 122590 Nov 5 19:03 e2fsprogs-libs-1.39-33.el5.x86_64.rpm
Drwxr-xr-x 3 4096 Nov 5 19:04 ext3grep-0.10.2
-rw-r--r--1 root root 236364 Nov 5 18:55 ext3grep-0.10.2.tar.gz

Install with RPM-IVH xxxx.rpm to install

2. Partition umount to recover data (take/dev/sdb/data as an example)#umount/dataIf the busy does not umount properly, use the#fuser-K/datakill the process and Umount3. Find and recover deleted files by mistake#Ext3grep/dev/sdb--ls--inode 2 find the Inode of the file you want to recover#Ext3grep/dev/sdb--restore-file--inode after successful recovery, there will be files recovered in the Restore_files directory under the current directory running Ext3grep .  

File methods for recovering deleted files under Linux (Ext2 and ext3)