Using ext3grep to restore mistakenly deleted files
Click to download the software: ext3grep
1. View the required related libraries
[root@ns2 ~] # rpm-qa | grep e2fsprogs
E2fsprogs-libs-1.39-8.el5
E2fsprogs-1.39-8.el5
E2fsprogs-devel-1.39-8.el5
Note: there is no libs program under RHEL4, but you can still install ext3grep 0.7.0.
There must be e2fsprogs-libs, or there will be problems with the installation of ext3grep later.
two。 Check the partition:
[root@ns2] # df-h
3. Software is required
Http://code.google.com/p/ext3grep/downloads/list
Download the software first
[root@ns2 ~] # cd / root/src/
[root@ns2 src] #
Wget http://ext3grep.googlecode.com/files/ext3grep-0.6.0.tar.gz src
Note: the author has downloaded it and no longer downloads it.
4. Install ext3grep
A. Mount the CD first
b. Installation steps:
1. [root@ns2 ~] # tar zxvf ext3grep-0\ [1\] .10.1.tar.gz-C / usr/src
2. [root@ns2 ~] # cd / usr/src/ext3grep-0.10.1->
3. [root@ns2 ~] #. / configure
4. [root@ns2] # make & & make install
5. To facilitate the experiment, we can simulate one. Here are the simulation steps:
A. # mkdir / data/
B. # cd / data/
C. # dd if=/dev/zero of=disk1 count=2048000
D. # mkfs.ext3 disk1
E. # mkdir-p / dfs/a
F. # mount-o loop / data/disk1 / asd/a
As shown in the figure, a simulated partition / data/disk1 has been created
6. Create a new file beijing, shanghai under / asd/a
7. Delete the beijing,shanghai file later
8. The file is gone, and then we'll restore:
First, umount must delete the partition of the data by mistake:
[root@ns2 ~] # umount / data/disk1
[root@ns2] # df-h
9. Confirm the uninstall, and then use ext3grep to restore.
[root@ns2 ~] # ext3grep / data/disk1-- ls-- inode 2 scan partition will be created here
You can see two deleted beijing,shanghai files from the picture.
10. Recover data
[root@ns2 ~] # ext3grep / data/disk1-- restore-file shanghai
Data recovered successfully
[root@ns2 ~] # ext3grep / data/disk1-- restore-file Beijing
11. [root@ns2 ~] # ls-la RESTORED_FILES/
Note: the recovered data is restored to the RESTORED_FILES/ directory by default.
twelve。 The successfully recovered file or directory under RESTORED_FILES can be manipulated freely, and the author puts it back to its original location.
Note: all operations have been done so far, if the data is in other partitions, uninstall the partition that deleted the data by mistake, and perform the same recovery steps as above!
