linux下rm -f刪除檔案恢複辦法

linux下rm -f刪除檔案恢複辦法 本人使用ext3grep工具恢複資料，大家首先在官方網站下載ext3grep軟體包，然後解壓安裝。  www.2cto.com  1.ext3grep /data/afh  --ls  --inode 2   ：/data/afh為資料丟失的目錄 ，這裡是列出/data/afh目錄的inode資訊，目錄inode資訊一般為2. （這個命令主要掃描當前檔案系統下所有檔案資訊，包括存在的和已經刪除的檔案，其中含有D標誌的就是已被刪除的檔案，如果不記得被刪除的檔案名稱，可以通過以下命令獲得要恢複的檔案名稱）2.ext3grep /data/afh  --dump-names  :此命令列出當前檔案系統下所有檔案資訊。3.現在我們恢複刪除的資料。 [root@jiankong /]# mkdir -p /data/[root@jiankong /]#dd if=/dev/zero of=/data/afh  bs=1024 count=1024010240+0 records in10240+0 records out10485760 bytes (10 MB) copied, 0.0448091 s, 234 MB/s[root@jiankong /]#mkfs.ext3 /data/afhmke2fs 1.41.12 (17-May-2010)/data/afh is not a block special device.Proceed anyway? (y,n) yFilesystem label=OS type: LinuxBlock size=1024 (log=0)Fragment size=1024 (log=0)Stride=0 blocks, Stripe width=0 blocks2560 inodes, 10240 blocks512 blocks (5.00%) reserved for the super userFirst data block=1Maximum filesystem blocks=104857602 block groups8192 blocks per group, 8192 fragments per group1280 inodes per groupSuperblock backups stored on blocks:  8193Writing inode tables: done                            Creating journal (1024 blocks): doneWriting superblocks and filesystem accounting information: doneThis filesystem will be automatically checked every 23 mounts or180 days, whichever comes first.  Use tune2fs -c or -i to override.[root@jiankong /]#mkdir /afc[root@jiankong /]#mount -o loop /data/afh /afc[root@jiankong /]# cp /etc/passwd /boot/* /afc/[root@jiankong /]# cd /afh[root@jiankong afc]# lsconfig-2.6.32-279.el6.x86_64         symvers-2.6.32-279.el6.x86_64.gzinitramfs-2.6.32-279.el6.x86_64.img  System.map-2.6.32-279.el6.x86_64lost+found                           vmlinuz-2.6.32-279.el6.x86_64passwd[root@jiankong afc]# rm -rf *[root@jiankong afc]# ls[root@jiankong afc]# cd /opt/[root@jiankong opt]# ls[root@jiankong opt]#[root@jiankong opt]# ext3grep /data/afh --ls --inode 2Running ext3grep version 0.10.2WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.Number of groups: 2Loading group metadata... doneMinimum / maximum journal block: 218 / 1247Loading journal descriptors... sorting... doneThe oldest inode block that is still in the journal, appears to be from 1361608793 = Sat Feb 23 16:39:53 2013Number of descriptors in journal: 198; min / max sequence numbers: 2 / 27Inode is AllocatedFinding all blocks that might be directories.D: block containing directory start, d: block containing more directory entries.Each plus represents a directory start that references the same inode as a directory start that we found previously.Searching group 0: DD++++D+++Searching group 1: +Writing analysis so far to 'disk1.ext3grep.stage1'. Delete that file if you want to do this stage again.Result of stage one:  3 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.  2 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.  0 blocks contain an extended directory.Result of stage two:  1 of those inodes could be resolved because it is still allocated.  1 inodes could be resolved because all refering blocks but one were journal blocks.All directory inodes are accounted for! Writing analysis so far to 'disk1.ext3grep.stage2'. Delete that file if you want to do this stage again.The first block of the directory is 204.Inode 2 is directory "".Directory block 204:          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)          |          .-- D: Deleted ; R: ReallocatedIndx Next |  Inode   | Deletion time                        Mode        File name==========+==========+----------------data-from-inode------+-----------+=========   0    1 d       2                                         drwxr-xr-x  .   1  end d       2                                         drwxr-xr-x  ..   2    3 d      11  D 1361608866 Sat Feb 23 16:41:06 2013  drwx------  lost+found   3    7 r      12  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  profile   4    6 r      13  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  hosts   5    6 r      14  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  config-2.6.32-279.el6.x86_64   6    7 r      15  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  initramfs-2.6.32-279.el6.x86_64.img   7    8 r    1281  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  symvers-2.6.32-279.el6.x86_64.gz   8    9 r    1282  D 1361608866 Sat Feb 23 16:41:06 2013  rrw-r--r--  System.map-2.6.32-279.el6.x86_64   9  end r    1283  D 1361608866 Sat Feb 23 16:41:06 2013  rrwxr-xr-x  vmlinuz-2.6.32-279.el6.x86_64  10  end：執行命令就開始搜尋可以恢複的資料檔案資訊（包括已刪除的和存在的），其中包含D標誌的是已被刪除的檔案，如果不記得被刪除的檔案名稱，可以通過下面命令獲得。 d    1284  D 1361608866 Sat Feb 23 16:41:06 2013  drwxr-xr-x  ext3grep[root@jiankong opt]# ext3grep /data/afh   --dump-namesRunning ext3grep version 0.10.2WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.Number of groups: 2Minimum / maximum journal block: 218 / 1247Loading journal descriptors... sorting... doneThe oldest inode block that is still in the journal, appears to be from 1361608793 = Sat Feb 23 16:39:53 2013Number of descriptors in journal: 198; min / max sequence numbers: 2 / 27Loading disk1.ext3grep.stage2... doneSystem.map-2.6.32-279.el6.x86_64config-2.6.32-279.el6.x86_64ext3grepext3grep/hostshostsinitramfs-2.6.32-279.el6.x86_64.imglost+foundprofilesymvers-2.6.32-279.el6.x86_64.gzvmlinuz-2.6.32-279.el6.x86_64[root@jiankong opt]#  ext3grep /data/afh  --restore-file  ext3grep/hostsRunning ext3grep version 0.10.2WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.Number of groups: 2Minimum / maximum journal block: 218 / 1247Loading journal descriptors... sorting... doneThe oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27Writing output to directory RESTORED_FILES/Loading afh.ext3grep.stage2... doneCannot find an inode number for file "ext3grep/hosts".[root@jiankong opt]# lsafh.ext3grep.stage1 RESTORED_FILESafh.ext3grep.stage2[root@jiankong opt]# cd RESTORED_FILES/[root@jiankong RESTORED_FILES]# ls[root@jiankong RESTORED_FILES]# cd ..[root@jiankong opt]# ext3grep /data/afh  --restore-inode 12Running ext3grep version 0.10.2WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.Number of groups: 2Minimum / maximum journal block: 218 / 1247Loading journal descriptors... sorting... doneThe oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27Restoring inode.12[root@jiankong opt]# lsafh.ext3grep.stage1    RESTORED_FILESafh.ext3grep.stage2  [root@jiankong opt]# cd RESTORED_FILES/[root@jiankong RESTORED_FILES]# lsinode.12[root@jiankong RESTORED_FILES]#  ext3grep /data/afh  --restore-allRunning ext3grep version 0.10.2WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.Number of groups: 2Minimum / maximum journal block: 218 / 1247Loading journal descriptors... sorting... doneThe oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27Writing output to directory RESTORED_FILES/Finding all blocks that might be directories.D: block containing directory start, d: block containing more directory entries.Each plus represents a directory start that references the same inode as a directory start that we found previously.Searching group 0: DD++++++Searching group 1: Writing analysis so far to 'afh.ext3grep.stage1'. Delete that file if you want to do this stage again.Result of stage one:  2 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.  1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.  0 blocks contain an extended directory.Result of stage two:  1 of those inodes could be resolved because it is still allocated.All directory inodes are accounted for! Writing analysis so far to 'afh.ext3grep.stage2'. Delete that file if you want to do this stage again.Restoring System.map-2.6.32-279.el6.x86_64Restoring config-2.6.32-279.el6.x86_64Restoring initramfs-2.6.32-279.el6.x86_64.imgRestoring passwdRestoring symvers-2.6.32-279.el6.x86_64.gzRestoring vmlinuz-2.6.32-279.el6.x86_64[root@jiankong RESTORED_FILES]# lsafh.ext3grep.stage1  afh.ext3grep.stage2  inode.12  RESTORED_FILES[root@jiankong RESTORED_FILES]# cd RESTORED_FILES/[root@jiankong RESTORED_FILES]# lsconfig-2.6.32-279.el6.x86_64         symvers-2.6.32-279.el6.x86_64.gzinitramfs-2.6.32-279.el6.x86_64.img  System.map-2.6.32-279.el6.x86_64lost+found                           vmlinuz-2.6.32-279.el6.x86_64passwd恢複完畢  親們這是相互學習，不對的地方大家指教。