Restoration Method for accidentally deleted files in the EXT3 File System

The previous article explains how to restore a deleted file by mistake using rm-rf. This method is a prerequisite and must be ensured that the Oracle instance is not closed.

The previous article explains how to restore a deleted file by mistake using rm-rf. This method is a prerequisite and must be ensured that the Oracle instance is not closed.

The previous article explains how to restore a deleted file by mistake using rm-rf. This method is a prerequisite and must be ensured that the Oracle instance is not closed, oracle-related processes are still running. When the Oracle process is closed, it cannot be recovered by using the ora _ process trace file handle. Is there a way to restore the accidentally deleted file?

Recovery Process of rm-rf misoperations

In the Linux EXT3 file system, deleted files are successfully restored.

The following describes how to restore data using third-party software:

-- First, make sure that the e2fsprogs package is installed.
[Root @ ora10g ext3grep-0.10.2] # rpm-qa | grep e2fsprogs
E2fsprogs-1.39-20.el5
E2fsprogs-devel-1.39-20.el5
E2fsprogs-libs-1.39-20.el5

-- Software download:

-- Copy the file to the/opt directory using Xshell, decompress the file, compile and install the file.

[Root @ ora10g ~] # Cd/opt/

[Root @ ora10g opt] # tar-zxvf ext3grep-0.10.2.tar.gz

[Root @ ora10g opt] # ll
Total 500
Drwxr-xr-x 3 1000 1000 4096 Aug 26 ext3grep-0.10.2
-Rw-r -- 1 root 236364 Aug 26 ext3grep-0.10.2.tar.gz
Drwxr-xr-x 3 root 4096 Aug 22 16: 44 ORCLfmap
Drwxrwxr-x 8 oracle oinstall 4096 Aug 25 rlwrap-0.37
-Rw-r -- 1 root 251438 Aug 25 rlwrap-0.37.tar.gz
[Root @ ora10g opt] # cd ext3grep-0.10.2
[Root @ ora10g ext3grep-0.10.2] #./configure & make install
Compilation process ......

-- View how to use software commands
[Root @ ora10g ext3grep-0.10.2] # ext3grep -- help
Running ext3grep version 0.10.2
Usage: ext3grep [options] [--] device-file
Options:
-- Version,-[vV] Print version and exit successfully.
-- Help, Print this help and exit successfully.
-- Superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
-- Print Print content of block or inode, if any.
-- Ls Print directories with only one line per entry.
This option is often needed to turn on filtering.
-- Accept filen Accept 'filen' as a legal filename. Can be used multi-
Ple times. If you change any -- accept you must remove
BOTH stage * files!
-- Accept-all Simply accept everything as filename.
-- Journal Show content of journal.
-- Show-path-inodes Show the inode of each directory component in paths.
Filters:
-- Group grp Only process group 'grp '.
-- Directory Only process directory inodes.
-- After dtime Only entries deleted on or after 'dtime '.
-- Before dtime Only entries deleted before 'dtime '.
-- Deleted Only show/process deleted entries.
-- Allocated Only show/process allocated inodes/blocks.
-- Unallocated Only show/process unallocated inodes/blocks.
-- Reallocated Do not suppress entries with reallocated inodes.
Inodes are considered 'reallocated' if the entry
Is deleted but the inode is allocated, but also when
The file type in the dir entry and the inode are
Different.
-- Zeroed-inodes Do not suppress entries with zeroed inodes. Linked
Entries are always shown, regardless of this option.
-- Depth Process directories recursively up till a depth
Of 'depth '.
Actions:
-- Inode-to-block ino Print the block that contains inode 'ino '.
-- Inode ino Show info on inode 'ino '.
If -- ls is used and the inode is a directory, then
The filters apply to the entries of the directory.
If you do not use -- ls then -- print is implied.
-- Block blk Show info on block 'blk '.
If -- ls is used and the block is the first block
Of a directory, then the filters apply to entries
Of the directory.
If you do not use -- ls then -- print is implied.
-- Histogram = [atime | ctime | mtime | dtime | group]
Generate a histogram based on the given specs.
Using atime, ctime or mtime will change
Meaning of -- after and -- before to those times.
-- Journal-block jblk Show info on journal block 'jblk '.
-- Journal-transaction seq
Show info on transaction with sequence number 'seq '.
-- Dump-names Write the path of files to stdout.
This implies -- ls but suppresses it's output.
-- Search-start str Find blocks that start with the fixed string 'str '.
-- Search str Find blocks that contain the fixed string 'str '.
-- Search-inode blk Find inodes that refer to block 'blk '.
-- Search-zeroed-inodes Return allocated inode table entries that are zeroed.
-- Inode-dirblock-table dir
Print a table for directory path 'dir' of directory
Block numbers found and the inodes used for each file.
-- Show-journal-inodes ino
Show copies of inode 'ino 'still in the journal.
-- Restore-inode ino [@ seqnr] [, ino [@ seqnr],...]
Restore the file (s) with known inode number 'ino '.
The restored files are created in./RESTORED_FILES/
With their inode number as extension (ie, inode.12345 ).
If '@ seqnr' is provided then (only) the journal entry
With that sequence number is used, otherwise the latest
Entry is used (if any). You can use that in the case
A file was overwritten or truncated, rather than deleted.
-- Restore-file 'path' [-- restore-file 'path'...]
Will restore file 'path'. 'path' is relative to
Root of the partition and does not start with a'/'(it
Must be one of the paths returned by -- dump-names ).
The restored directory, file or symbolic link is
Created in the current directory as 'restored _ FILES/path '.
-- Restore-all As -- restore-file but attempts to restore everything.
The use of -- after is highly recommended because
Attempt to restore very old files will only result in
Them being hard linked to a more recently deleted file
And as such polute the output.
-- Show-hardlinks Show all inodes that are shared by two or more files.