Restore deleted Ext3 files in Linux

1. Brief introduction to the Ext3 File System Structure

In the Ext3 File System Used in Linux, files are stored in blocks. By default, the size of each block is 1 K. Different blocks are distinguished by block numbers. Each file has a node that contains information such as the file owner, read/write permission, and file type. For a file smaller than 12 blocks, the block number of the file data block is directly stored in the node. If the file contains more than 12 blocks, the node stores the block number of an indirect block after the 12 blocks. In the block corresponding to this indirect block number, each block number in the block number Ext2fs that stores 256 file data blocks occupies 4 bytes, so that the block number that can be stored in a block is 1024/4 = 256 ). If a larger file exists, the second-level indirect block and third-level indirect block appear in the node.

2. Restore the accidentally deleted file

Most Linux distributions provide a debugfs tool for editing Ext3 file systems. However, there is still some work to do before using this tool.

First, Remount the partition where the accidentally deleted file is located in read-only mode. Run the following command: Suppose the file is in the/usr partition)

[Pre] mount-r-n-o remount/usr [/pre]

R indicates read-only mounting;-n indicates no write to/etc/mtab. If the file is restored to/etc, add this parameter. If the system says xxx partion busy, you can run the fuser command to check which processes use the files in this partition:

[Pre] fuser-v-m/usr [/pre]

If there are no important processes, run the following command to stop them:

[Pre] fuser-k-v-m/usr [/pre]

Then you can remount these file systems.

If all the files are installed in a large partition, you can use linux single to enter the single-user mode at the boot prompt to minimize the chance of system processes writing data to the hard disk, or simply mount the hard disk on another machine. In addition, do not write the recovered data to/to avoid damaging the useful data. If the host has dos/windows, you can write it to these partitions:

[Pre] mount-r-n/dev/hda1/mnt/had [/pre]

Then you can execute debugfs: Suppose Linux is in/dev/hda5)

[Pre] # debugfs/dev/hda5 [/pre]

The prompt debugfs appears:

The lsdel command can be used to list the information of many deleted files:

[Pre] debugfs: lsdel debugfs: 2692 deleted inodes found. inode Owner Mode Size Blocks Time deleted 164821 0 100600 8192 1/1 2001 Sun May 13 19:22:46 36137 100644 0 1/1 4 2001 Tue Apr 24 10:11:15 196829 100644 0 149500 38/38 Mon May 27 13:52:04 2001 debugfs: [/pre]

The first field is the file node number, the second field is the file owner, the third field is the read and write permissions, and the next is the file size, number of blocks, and deletion time. Then we can determine what we need based on the file size and deletion date. For example, we want to restore a file with a node of 196829:

You can first check the file data status:

[Pre] debugfs: stat Inode: 196829 Type: regular Mode: 0644 Flags: 0x0 Version: 1 User: 0 Group: 0 Size: 149500 File ACL: 0 Directory ACL: 0 Links: 0 Blockcount: 38 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x31a9a574 -- Mon May 27 13:52:04 2001 atime: 0x31a21dd1 -- Tue May 21 20:47:29 2001 mtime: 0x313bf4d7 -- Tue Mar 5 08:01:27 2001 dtime: 0x31a9a574 -- Mon May 27 13:52:04 2001 BLOCKS: 594810 59 4811 594814 594815 594816 594817 ........................................ TOTAL: 38 [/pre]

Then you can use the dump command to restore the file:

[Pre] debugfs: dump/mnt/hda/01.sav[/pre]

In this way, the file is restored. Exit debugfs:

[Pre] debugfs: quit [/pre]

Another method is to manually edit inode:

[Pre] debugfs: mi Mode [0100644] User ID [0] Group ID [0] Size [149500] Creation time [0x31a9a574] Modification time [0x31a9a574] Access time [0x31a21dd1] Deletion time [0x31a9a574] 0 link count [0] 1 Block count [38] File flags [0x0] Reserved1 [0] File acl [0] Directory acl [0] Fragment address [0] Fragment number [0] Fragment size [0] Direct Block #0 [594810] Triple Indirect Block [0] [/pre]

After the mi command is used, a line of information is displayed each time for editing. For other lines, press enter to confirm and change the deletion time to 0. The Link count value is changed to 1. After modification, exit debugfs:

[Pre] debugfs: quit [/pre]

Then use fsck to check/dev/hda5 fsck/dev/hda5. The program will say that the lost data block is located in lost + found.

1. How to configure the Netware server in Linux
2. Development of Linux systems on embedded devices
3. In-depth introduction to how the Linux kernel works (1)