Linux ext2/ext3 文件删除恢复工具ext3grep安装使用
2010-08-23 18:03:10| 分类： 默认分类|举报|字号 订阅
一． 安装前系统环境检查（我的实验环境：AS5.2 2.6.18-92.el5内核）< xmlnamespace prefix ="o" ns ="urn:schemas-microsoft-com:office:office" />
1.）查看所需要的依赖包
rpm -qa |grep e2fsprogs
|
e2fsprogs-devel-1.39-15.el5 e2fsprogs-libs-1.39-15.el5 e2fsprogs-1.39-15.el5 e2fsprogs-libs-1.39-15.el5 |
保证以上的包已经正确安装。
2.）下载安装运行ext3grep
|
mkdir –p /home/erico/test/ cd /home/erico/test/ wgethttp://ext3grep.googlecode.com/files/ext3grep-0.10.1.tar.gz mkdir –p /soft/data_recover/ tar xzvf ext3grep-0.10.1.tar.gz cd ext3grep-0.10.1 ./configure --prefix=/soft/data_recover/ make && make install |
运行ext3grep命令必须要加路径
/soft/data_recover/bin/ext3grep【参数】
3.）利用ext3grep测试恢复数据
1）我的硬盘分区情况
|
[[email protected] erico]# fdisk -l Disk /dev/sda: 80.0 GB, 80026361856 bytes 255 heads, 63 sectors/track, 9729 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 * 1 127 1020096 83 Linux /dev/sda2 2434 9729 58605120 f W95 Ext‘d (LBA) /dev/sda3 128 2039 15358140 83 Linux /dev/sda4 2040 2166 1020127+ 82 Linux swap / Solaris /dev/sda5 2434 9729 58605088+ 83 Linux Partition table entries are not in disk order |
2.）把/dev/sda5挂载到/data/下，用来做测试。
|
[[email protected] erico]# mount /dev/sda5 /data/ |
3.）创建测试文件和文件目录，准备做测试
|
[[email protected] data]# cp /home/erico/all_system_app_check_bak_test.log /data/ |
4.)删除/data/目录下的文件
|
[[email protected] erico]# rm -rf /data/all_system_app_check_bak_test.log |
5.）取消挂载需要恢复数据的区/dev/sda5
|
[[email protected] /]# umount /dev/sda5 |
6.)恢复数据
测试一：文本文件（小文件）
1】扫描/dev/sda5被删除的数据情况
|
[[email protected] erico]#/soft/data_recover/bin/ext3grep /dev/sda5 --ls --inode 2 Loading group metadata... done Minimum / maximum journal block: 1542 / 35880 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1246478245 = Wed Jul 1 15:57:25 2009 Number of descriptors in journal: 19; min / max sequence numbers: 2 / 5 Inode is Allocated Loading sda5.ext3grep.stage2... done The first block of the directory is 1536. Inode 2 is directory "". Directory block 1536: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 2 d 2 drwxr-xr-x .. 2 end d 11 drwx------ lost+found 3 end r 48865 D 1246478282 Wed Jul 1 15:58:02 2009 rrw-r--r-- all_system_app_check_bak_test.log |
根据上面的情况，可以知道我们删除了的文件。
2】恢复数据
|
[[email protected]]#/soft/data_recover/bin/ext3grep /dev/sda5 --restore-file all_system_app_check_bak_test.log [[email protected] erico]# ls -al RESTORED_FILES/ total 12 drwxr-xr-x 2 root root 4096 Jul 1 15:59 . drwxr-xr-x 7 root root 4096 Jul 1 15:56 .. -rw-r--r-- 1 root root 1368 Jul 1 15:57 all_system_app_check_bak_test.log |
在RESTORED_FILES/下我们看到了恢复出来的文件all_system_app_check_bak_test.log
测试二：大文件（220M）
1】重新格式化测试盘，让盘变成空盘
|
[[email protected] erico]# umount /dev/sda5 [[email protected] erico]# mkfs.ext3 /dev/sda5 mke2fs 1.39 (29-May-2006) Filesystem label= OS type: Linux Block size=4096 (log=2) Fragment size=4096 (log=2) 2443200 inodes, 4885760 blocks 244288 blocks (5.00%) reserved for the super user First data block=0 Maximum filesystem blocks=4294967296 150 block groups 32768 blocks per group, 32768 fragments per group 16288 inodes per group Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000 Writing inode tables: done Creating journal (32768 blocks): done Writing superblocks and filesystem accounting information: done This filesystem will be automatically checked every 30 mounts or 180 days, whichever comes first. Use tune2fs -c or -i to override. |
确认格式后盘是空的！
|
[[email protected] erico]# /soft/data_recover/bin/ext3grep /dev/sda5 --ls --inode 2 Running ext3grep version 0.10.1 Number of groups: 150 Loading group metadata... done Minimum / maximum journal block: 1542 / 35880 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 0 = Wed Dec 31 19:00:00 1969 Number of descriptors in journal: 0; min / max sequence numbers: 4294967295 / 0 Inode is Allocated Loading sda5.ext3grep.stage2... done The first block of the directory is 1536. Inode 2 is directory "". Directory block 1536: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 2 d 2 drwxr-xr-x .. 2 end d 11 drwx------ lost+found [[email protected] erico]# |
2】创建测试文件和文件目录，准备做测试
|
[[email protected] erico]# mount /dev/sda5 /data/ [[email protected] erico]# cp /home/erico/Level1.7z /data/ |
该文件大小是220M的压缩文件（里面包括几十万以上的png图片文件）
3.)删除/data/目录下的文件
|
[[email protected] erico]# rm -rf /data/Level1.7z |
4.)扫描/dev/sda5被删除的数据情况
|
[[email protected] erico]# /soft/data_recover/bin/ext3grep /dev/sda5 --ls --inode 2 Running ext3grep version 0.10.1 WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state. Number of groups: 150 Loading group metadata... done Minimum / maximum journal block: 1542 / 35880 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1246479046 = Wed Jul 1 16:10:46 2009 Number of descriptors in journal: 82; min / max sequence numbers: 2 / 8 Inode is Allocated Loading sda5.ext3grep.stage2... done The first block of the directory is 1536. Inode 2 is directory "". Directory block 1536: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 2 d 2 drwxr-xr-x .. 2 end d 11 drwx------ lost+found 3 end r 48865 D 1246479377 Wed Jul 1 16:16:17 2009 rrw-r--r-- Level1.7z [[email protected] erico]# |
同样找到了删除的文件Level1.7z
5.)恢复Level1.7z文件
|
[[email protected] erico]# /soft/data_recover/bin/ext3grep /dev/sda5 --restore-file Level1.7z Running ext3grep version 0.10.1 WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state. Number of groups: 150 Minimum / maximum journal block: 1542 / 35880 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1246479046 = Wed Jul 1 16:10:46 2009 Number of descriptors in journal: 82; min / max sequence numbers: 2 / 8 Loading sda5.ext3grep.stage2... done Restoring Level1.7z [[email protected] erico]# du -hs RESTORED_FILES/ 60K RESTORED_FILES/ [[email protected] erico]# |
恢复让人失望，文件是恢复了，但是内容只有几十K，打开文件打不开。说明恢复失败！
|
[[email protected] erico]# /soft/data_recover/bin/ext3grep /dev/sda5 --restore-file Level12.7z Running ext3grep version 0.10.1 WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state. Number of groups: 150 Minimum / maximum journal block: 1542 / 35880 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1246479046 = Wed Jul 1 16:10:46 2009 Number of descriptors in journal: 103; min / max sequence numbers: 2 / 12 Writing output to directory RESTORED_FILES/ Loading sda5.ext3grep.stage2... done Restoring Level12.7z WARNING: Failed to restore Level12.7z: encountered a reused or corrupted (double/triple) indirect block! Running iterate_over_all_blocks_of again with diagnostic messages ON: Processing direct blocks... 124928 124929 124930 124931 124932 124933 124934 124935 124936 124937 124938 124939 Processing indirect block 124940: entry 0 contains block number 2979148019, which is too large. [[email protected] erico]# ls RESTORED_FILES/Level12.7z RESTORED_FILES/Level12.7z [[email protected] erico]# du -hs RESTORED_FILES/Level12.7z 48K RESTORED_FILES/Level12.7z [[email protected] erico]# |
注意到了，由于我是在windows下拷贝Level12.7z文件到/data/目录下的，该BLOCK NUMBER
太大，导致恢复不了。
【尝试恢复1.8GB的数据】
|
Result of stage one: 5 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated. 1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated. 0 blocks contain an extended directory. Result of stage two: 1 of those inodes could be resolved because it is still allocated. All directory inodes are accounted for! Writing analysis so far to ‘sda5.ext3grep.stage2‘. Delete that file if you want to do this stage again. The first block of the directory is 1536. Inode 2 is directory "". Directory block 1536: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 end d 2 drwxr-xr-x .. 2 end d 11 D 1246482239 Wed Jul 1 17:03:59 2009 drwx------ lost+found 3 4 r 48865 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK 4 5 r 48866 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK.bak 5 6 r 48867 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x ITS_APP_CHECK_25_port7001 6 7 r 48868 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK_25_port7001.bak 7 8 r 48869 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x ITS_APP_CHECK_25_port80 8 9 r 48870 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK_25_port80.bak 9 10 r 48871 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x ITS_APP_CHECK_25_port8008_16_port80 10 11 r 48872 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK_25_port8008_16_port80.bak 11 12 r 48873 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x ITS_APP_CHECK_25_port8080 12 13 r 48874 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- ITS_APP_CHECK_25_port8080.bak 13 14 r 48875 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x check_file_from_15 14 15 r 48876 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- check_file_from_15.bak 15 16 r 48877 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x check_file_from_16 16 17 r 48878 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- check_file_from_16.bak 17 18 r 48879 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x check_pro_and_send_message_15 18 19 r 48880 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- check_pro_and_send_message_15.bak 19 20 r 48881 D 1246482237 Wed Jul 1 17:03:57 2009 rrwxr-xr-x check_pro_and_send_message_16 20 21 r 48882 D 1246482237 Wed Jul 1 17:03:57 2009 rrw-r--r-- check_pro_and_send_message_16.bak 21 end r 48883 D 1246482239 Wed Jul 1 17:03:59 2009 rrw-r--r-- linux_11gR1_database_1013.zip |
再次确认了，ext3grep只能恢复小文件，大于200M单文件的都无法恢复！
测试三：多文件和多目录恢复（文件目录多于100个，文件多于50万个，全部为png图片
1】重新格式化测试盘，让盘变成空盘
2】创建测试文件和文件目录，准备做测试
|
[[email protected] erico]# mount /dev/sda5 /data/ [[email protected] erico]# ls –al /data/ total 124 drwxr-xr-x 6 root root 4096 Jul 2 10:01 . drwxr-xr-x 28 root root 4096 Jul 2 10:03 .. drwx------ 2225 root root 69632 Jul 2 11:45 Level1 drwxr-xr-x 656 root root 20480 Jul 2 05:45 Level6 drwxr-xr-x 3 root root 4096 Jul 2 05:24 Level9 drwx------ 2 root root 16384 Jul 1 17:46 lost+found [[email protected] data]# ls /data/Level9/ |wc -l 4 [[email protected] data]#ls /data/Level6/ |wc -l 654 [[email protected] T00110011]# df -h Filesystem Size Used Avail Use% Mounted on /dev/sda3 15G 13G 663M 96% / /dev/sda1 965M 23M 893M 3% /boot tmpfs 234M 0 234M 0% /dev/shm /dev/sda5 56G 4.6G 48G 9% /data [[email protected] T00110011]# |
其中：一级目录有4个，二级目录有Level1:4522*225=1017450 Level6：657个（总文件大约：657*225=147825）
Level9：4个（总文件大约：4*225=900）估计恢复文件大小为：4.6G,总文件数：1166175
3.)删除/data/目录下的文件
|
[[email protected] erico]# rm -rf /data/* [[email protected] /]# umount /data/ |
4.)扫描/dev/sda5被删除的数据情况
|
Adding extended directory block(s) for directory "Level1". WARNING: Rejecting a dir_entry (block 153811) because it contains legal but unlikely characters. Use --ls --block 153811 to examine this possible directory block. If it looks like a directory to you, and ‘\020‘ looks like a filename that might belong in that directory, then add --accept=‘\020‘ as commandline parameter AND remove both stage* files! Adding extended directory block(s) for directory "Level6". Writing analysis so far to ‘sda5.ext3grep.stage2‘. Delete that file if you want to do this stage again. The first block of the directory is 1538. Inode 2 is directory "". Directory block 1538: .-- File type in dir_entry (r=regular file, d=directory, l=symlink) | .-- D: Deleted ; R: Reallocated Indx Next | Inode | Deletion time Mode File name ==========+==========+----------------data-from-inode------+-----------+========= 0 1 d 2 drwxr-xr-x . 1 2 d 2 drwxr-xr-x .. 2 end d 11 drwx------ lost+found 3 end d 5428865 D 1246561941 Thu Jul 2 15:12:21 2009 drwxr-xr-x Level9 4 end d 5903073 D 1246561941 Thu Jul 2 15:12:21 2009 drwxr-xr-x Level6 5 end d 5379809 D 1246561926 Thu Jul 2 15:12:06 2009 drwx------ Level1 |
同样找到了删除的文件夹
5.)恢复所有文件
|
[[email protected] erico]# /soft/data_recover/bin/ext3grep /dev/sda5 --restore-all |
查看恢复出来的文件和目录：
|
[[email protected] Level9]# find ../../../RESTORED_FILES/ -name *.png -print |wc -l 33057 [[email protected] Level9]#find ../../../RESTORED_FILES/ -type d -print |wc -l 5163 |
恢复出来的PNG文件只有33057个（只恢复了很少很少一部分文件），目录是5163个（全部恢复）
ext3grep 恢复删除