Use Debugfs to recover RM deleted files under Linux

Use Debugfs to recover RM deleted files under Linux
?? The following methods are tested on the Ext3 file system and are implemented by root
? Mainly with the help of Debugfs

Fdisk/dev/vda
Mkdir/mnt/test
Mount/dev/vda3/mnt/test
1 running Debugfs, entering the dispatch mode
[Email protected] test]# debugfs-w/dev/vda3
[[email protected] test] #sudo debugfs-w/dev/vda3

??? 2 Executive Open/dev/vda3
3 Execution ls-d Lists the most recent operation for this directory, where you can see the log deletion record for <num>

4 Perform logdump-i <num> display this log content
Debugfs:logdump-i <13>

??? 5 Look for the block in the output to delete the file, record it down Blockid

??? 6 exit Debugfs, run [[email protected] test] #dd if=/dev/vda3 of=/tmp/saved? bs=1027 count=138476 skip=47
??? At this point, the deleted files restored, but this method has a problem, if the deletion is a large file, it occupies a number of blocks, the operation is more troublesome.
?? Debugfs in debug mode, the command line is difficult to use, but it supports the-r option, can be executed in the shell, is to use multiple-R to execute the command to connect, if the command needs to specify the parameters need to add "", or shell parsing will be problematic.

Use Debugfs to recover RM deleted files under Linux