CentOS系統中對Ext3檔案系統刪除後恢複

大家好，昨天有一同事在linux系統中用管理使用者(root)刪除了另一使用者的根目錄(rm -rf /home/tong),所有的檔案無法找回了,我找了百度和穀哥終於把這個問題解決了,現在我把處理的過程寫出來,希望對大家以後有協助.

1.安裝軟體(ext3grep依賴於系統的e2fsprogs三個軟體包)

[root@redhat1 home]# mkdir /mnt/cdrom --建立光碟片掛載目錄

[root@redhat1 home]# mount /dev/cdrom /mnt/cdrom --掛載光碟片
mount: block device /dev/sr0 is write-protected, mounting read-only
[root@redhat1 home]# vim /etc/yum.repos.d/base.repo --配置系統的本地源

[base]
name=base
baseurl=file:///mnt/cdrom
enabled=1
gpgcheck=1
gpgkey=file:///mnt/cdrom/RPM-GPG-KEY-REDHAT-6

[root@redhat1 home]# yum install e2fs* --安裝ext3grep軟體的依賴包

[root@redhat1 home]# rpm -aq |grep e2fs --檢查軟體包是否安裝
e2fsprogs-devel-1.41.12-14.el6.i686
e2fsprogs-libs-1.41.12-14.el6.i686
e2fsprogs-1.41.12-14.el6.i686

[root@redhat1 home]#wget http://code.google.com/p/ext3grep/downloads/detail?name=ext3grep-0.10.2.tar.gz--下載ext3grep軟體包

[root@redhat1 home]# tar xvf ext3grep-0.10.2.tar.gz --解壓軟體包

[root@redhat1 home]# cd ext3grep-0.10.2 --進入軟體包

[root@redhat1 ext3grep-0.10.2]# ./configure --prefix=/usr/local/ext3grep && make && make install --安裝軟體

[root@redhat1 ext3grep-0.10.2]# ll /usr/local/ |grep ext3 --查看軟體安裝成功
drwxr-xr-x. 3 root root 4096 Dec 2 17:24 ext3grep
[root@redhat1 ext3grep-0.10.2]#

2.建立個塊裝置,用塊裝置做測試.如果你用/home目錄,home目錄必須是一個單獨的分區,在後面要進行掛載和卸載.

[root@redhat1 home]# dd if=/dev/zero of=123 bs=1M count=100 --在home目錄下建立一個塊裝置123
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.634943 s, 165 MB/s

[root@redhat1 home]# mkfs.ext3 123 --格式化塊裝置

mke2fs 1.41.12 (17-May-2010)
123 is not a block special device.
Proceed anyway? (y,n) y --輸入y確定
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
25688 inodes, 102400 blocks
5120 blocks (5.00%) reserved for the super user
First data block=1
Maximum filesystem blocks=67371008
13 block groups
8192 blocks per group, 8192 fragments per group
1976 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729

Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 27 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.

[root@redhat1 home]#mkdir /mnt/123 --建立塊裝置掛載的目錄

[root@redhat1 home]# mount 123 /mnt/123 -o loop --將塊裝置123掛載到/mnt/123中

[root@redhat1 home]# df -TH --查看目錄是否掛載
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
ext4 20G 3.8G 16G 20% /
tmpfs tmpfs 262M 0 262M 0% /dev/shm
/dev/sda1 ext4 508M 32M 451M 7% /boot
df: `/mnt/cdrom': No such file or directory
/dev/sr0 iso9660 3.2G 3.2G 0 100% /mnt
/home/123 ext3 102M 5.8M 91M 7% /mnt/123 --裝置已掛載

3.拷貝檔案,刪除檔案.
[root@redhat1 home]# cp -a /etc/passwd /etc/shadow /etc/group /mnt/123/ --將檔案移動到裝置中

[root@redhat1 home]# ll /mnt/123/ --查看是否有檔案
total 19
-rw-r--r--. 1 root root 712 Dec 2 14:39 group
drwx------. 2 root root 12288 Dec 4 11:14 lost+found
-rw-r--r--. 1 root root 1509 Dec 2 14:39 passwd
----------. 1 root root 976 Dec 2 14:39 shadow
[root@redhat1 home]# sync --檔案同步一下

[root@redhat1 home]# rm -rf /mnt/123/passwd /mnt/123/shadow --刪除檔案

[root@redhat1 home]# sync --檔案同步一下

[root@redhat1 home]# umount /mnt/123 --卸載裝置

4.恢複檔案

[root@redhat1 home]# cd /usr/local/ext3grep/bin/ --進入ext3grep軟體的目錄

[root@redhat1 bin]# ./ext3grep --ls --inode 2 /home/123
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Loading group metadata... done
Minimum / maximum journal block: 49402 / 53515
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1386127317 = Wed Dec 4 11:21:57 2013
Number of descriptors in journal: 22; min / max sequence numbers: 2 / 5
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.

Searching group 0: DD
Searching group 1:
Searching group 2:
Searching group 3:
Searching group 4:
Searching group 5:
Searching group 6: ++
Searching group 7:
Searching group 8:
Searching group 9:
Searching group 10:
Searching group 11:
Searching group 12:
Writing analysis so far to '123.ext3grep.stage1'. Delete that file if you want to do this stage again.
Result of stage one:
2 inodes are referenced by one or more directory blocks, 2 of those inodes are still allocated.
1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.
0 blocks contain an extended directory.
Result of stage two:
2 of those inodes could be resolved because they are still allocated.
All directory inodes are accounted for!

Writing analysis so far to '123.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 508.
Inode 2 is directory "".
Directory block 508:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 5 d 11 drwx------ lost+found
3 4 r 12 D 1386127493 Wed Dec 4 11:24:53 2013 rrw-r--r-- passwd --D表示是刪除的檔案
4 5 r 13 D 1386127493 Wed Dec 4 11:24:53 2013 r--------- shadow
5 end r 14 rrw-r--r-- group
[root@redhat1 bin]# ./ext3grep --restore-file passwd /home/123 --restore-file用檔案名稱來恢複檔案
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 49402 / 53515
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1386127317 = Wed Dec 4 11:21:57 2013
Number of descriptors in journal: 22; min / max sequence numbers: 2 / 5
Writing output to directory RESTORED_FILES/
Loading 123.ext3grep.stage2... done
Restoring passwd --恢複passwd檔案成功
[root@redhat1 bin]# ./ext3grep --restore-inode 13 /home/123 --用節點號(--restore-inode)來恢複檔案
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 49402 / 53515
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1386127317 = Wed Dec 4 11:21:57 2013

Number of descriptors in journal: 22; min / max sequence numbers: 2 / 5
Restoring inode.13 --恢複成功
[root@redhat1 bin]# ll RESTORED_FILES/ --在自己目前的目錄下有個RESTORED_FILES目錄存放恢複檔案

total 8
----------. 1 root root 976 Dec 2 14:39 inode.13
-rw-r--r--. 1 root root 1509 Dec 2 14:39 passwd
[root@redhat1 bin]#

註：Linux系統中對Ext4檔案系統刪除後恢複:http://597011036.blog.51cto.com/6214144/1335953

重點:1.ext3grep命令參考:

ext3grep /home/123 --dump-names --查看存在的和刪除的檔案
ext3grep /home/123 --ls --inode 2 --詳細查看存在的刪除的檔案(d 刪除 r 存在)
ext3grep /home/123 --restore-file 檔案名稱 --恢複檔案
ext3grep /home/123 --restore-all --恢複所有檔案
ext3grep /home/123 --restore-inode 節點號 --恢複指定節點號的檔案
ext3grep /home/123 --ls --inode 15809 --可以進入節點為15809的檔案夾中,看是否有還有的是的檔案
ext3grep /home/1234--restore-file 目錄/檔案 --還原目錄下面的檔案(進入目錄 ext3grep /home/1234 --ls --inode 目錄節點)

2.錯誤處理:

1)如果執行命令報錯

[root@redhat1 bin]# ./ext3grep --ls --inode 2 /home/123

解決方案:rm -rf 123.ext3grep.stage1 123.ext3grep.stage2 RESTORED_FILES就可以了