linux下rm -f删除文件恢复办法
发布时间：2014-09-05 15:10:22作者：知识屋
linux下rm -f删除文件恢复办法
本人使用ext3grep工具恢复数据，大家首先在官方网站下载ext3grep软件包，然后解压安装。 www.zhishiwu.com
1.ext3grep /data/afh --ls --inode 2 ：/data/afh为数据丢失的目录 ，这里是列出/data/afh目录的inode信息，目录inode信息一般为2.
（这个命令主要扫描当前文件系统下所有文件信息，包括存在的和已经删除的文件，其中含有D标志的就是已被删除的文件，如果不记得被删除的文件名称，可以通过以下命令获得要恢复的文件名称）
2.ext3grep /data/afh --dump-names :此命令列出当前文件系统下所有文件信息。
3.现在我们恢复删除的数据。
[root@jiankong /]# mkdir -p /data/
[root@jiankong /]#dd if=/dev/zero of=/data/afh bs=1024 count=10240
10240+0 records in
10240+0 records out
10485760 bytes (10 MB) copied, 0.0448091 s, 234 MB/s
[root@jiankong /]#mkfs.ext3 /data/afh
mke2fs 1.41.12 (17-May-2010)
/data/afh is not a block special device.
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
2560 inodes, 10240 blocks
512 blocks (5.00%) reserved for the super user
First data block=1
Maximum filesystem blocks=10485760
2 block groups
8192 blocks per group, 8192 fragments per group
1280 inodes per group
Superblock backups stored on blocks:
8193
Writing inode tables: done
Creating journal (1024 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 23 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
[root@jiankong /]#mkdir /afc
[root@jiankong /]#mount -o loop /data/afh /afc
[root@jiankong /]# cp /etc/passwd /boot/* /afc/
[root@jiankong /]# cd /afh
[root@jiankong afc]# ls
config-2.6.32-279.el6.x86_64 symvers-2.6.32-279.el6.x86_64.gz
initramfs-2.6.32-279.el6.x86_64.img System.map-2.6.32-279.el6.x86_64
lost+found vmlinuz-2.6.32-279.el6.x86_64
passwd
[root@jiankong afc]# rm -rf *
[root@jiankong afc]# ls
[root@jiankong afc]# cd /opt/
[root@jiankong opt]# ls
[root@jiankong opt]#
[root@jiankong opt]# ext3grep /data/afh --ls --inode 2
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 2
Loading group metadata... done
Minimum / maximum journal block: 218 / 1247
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1361608793 = Sat Feb 23 16:39:53 2013
Number of descriptors in journal: 198; min / max sequence numbers: 2 / 27
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DD++++D+++
Searching group 1: +
Writing analysis so far to 'disk1.ext3grep.stage1'. Delete that file if you want to do this stage again.
Result of stage one:
3 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.
2 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.
0 blocks contain an extended directory.
Result of stage two:
1 of those inodes could be resolved because it is still allocated.
1 inodes could be resolved because all refering blocks but one were journal blocks.
All directory inodes are accounted for!
Writing analysis so far to 'disk1.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 204.
Inode 2 is directory "".
Directory block 204:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 end d 2 drwxr-xr-x ..
2 3 d 11 D 1361608866 Sat Feb 23 16:41:06 2013 drwx------ lost+found
3 7 r 12 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- profile
4 6 r 13 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- hosts
5 6 r 14 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- config-2.6.32-279.el6.x86_64
6 7 r 15 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- initramfs-2.6.32-279.el6.x86_64.img
7 8 r 1281 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- symvers-2.6.32-279.el6.x86_64.gz
8 9 r 1282 D 1361608866 Sat Feb 23 16:41:06 2013 rrw-r--r-- System.map-2.6.32-279.el6.x86_64
9 end r 1283 D 1361608866 Sat Feb 23 16:41:06 2013 rrwxr-xr-x vmlinuz-2.6.32-279.el6.x86_64
10 end
：执行命令就开始搜索可以恢复的数据文件信息（包括已删除的和存在的），其中包含D标志的是已被删除的文件，如果不记得被删除的文件名，可以通过下面命令获得。 d 1284 D 1361608866 Sat Feb 23 16:41:06 2013 drwxr-xr-x ext3grep
[root@jiankong opt]# ext3grep /data/afh --dump-names
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 2
Minimum / maximum journal block: 218 / 1247
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1361608793 = Sat Feb 23 16:39:53 2013
Number of descriptors in journal: 198; min / max sequence numbers: 2 / 27
Loading disk1.ext3grep.stage2... done
System.map-2.6.32-279.el6.x86_64
config-2.6.32-279.el6.x86_64
ext3grep
ext3grep/hosts
hosts
initramfs-2.6.32-279.el6.x86_64.img
lost+found
profile
symvers-2.6.32-279.el6.x86_64.gz
vmlinuz-2.6.32-279.el6.x86_64
[root@jiankong opt]# ext3grep /data/afh --restore-file ext3grep/hosts
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 2
Minimum / maximum journal block: 218 / 1247
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013
Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27
Writing output to directory RESTORED_FILES/
Loading afh.ext3grep.stage2... done
Cannot find an inode number for file "ext3grep/hosts".
[root@jiankong opt]# ls
afh.ext3grep.stage1 RESTORED_FILES
afh.ext3grep.stage2
[root@jiankong opt]# cd RESTORED_FILES/
[root@jiankong RESTORED_FILES]# ls
[root@jiankong RESTORED_FILES]# cd ..
[root@jiankong opt]# ext3grep /data/afh --restore-inode 12
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 2
Minimum / maximum journal block: 218 / 1247
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013
Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27
Restoring inode.12
[root@jiankong opt]# ls
afh.ext3grep.stage1 RESTORED_FILES
afh.ext3grep.stage2
[root@jiankong opt]# cd RESTORED_FILES/
[root@jiankong RESTORED_FILES]# ls
inode.12
[root@jiankong RESTORED_FILES]# ext3grep /data/afh --restore-all
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.
Number of groups: 2
Minimum / maximum journal block: 218 / 1247
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1361610467 = Sat Feb 23 17:07:47 2013
Number of descriptors in journal: 193; min / max sequence numbers: 2 / 27
Writing output to directory RESTORED_FILES/
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DD++++++
Searching group 1:
Writing analysis so far to 'afh.ext3grep.stage1'. Delete that file if you want to do this stage again.
Result of stage one:
2 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.
1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.
0 blocks contain an extended directory.
Result of stage two:
1 of those inodes could be resolved because it is still allocated.
All directory inodes are accounted for!
Writing analysis so far to 'afh.ext3grep.stage2'. Delete that file if you want to do this stage again.
Restoring System.map-2.6.32-279.el6.x86_64
Restoring config-2.6.32-279.el6.x86_64
Restoring initramfs-2.6.32-279.el6.x86_64.img
Restoring passwd
Restoring symvers-2.6.32-279.el6.x86_64.gz
Restoring vmlinuz-2.6.32-279.el6.x86_64
[root@jiankong RESTORED_FILES]# ls
afh.ext3grep.stage1 afh.ext3grep.stage2 inode.12 RESTORED_FILES
[root@jiankong RESTORED_FILES]# cd RESTORED_FILES/
[root@jiankong RESTORED_FILES]# ls
config-2.6.32-279.el6.x86_64 symvers-2.6.32-279.el6.x86_64.gz
initramfs-2.6.32-279.el6.x86_64.img System.map-2.6.32-279.el6.x86_64
lost+found vmlinuz-2.6.32-279.el6.x86_64
passwd
恢复完毕 亲们这是相互学习，不对的地方大家指教。
（免责声明：文章内容如涉及作品内容、版权和其它问题，请及时与我们联系，我们将在第一时间删除内容，文章内容仅供参考）
相关知识
-
linux一键安装web环境全攻略 在linux系统中怎么一键安装web环境方法
-
Linux网络基本网络配置方法介绍 如何配置Linux系统的网络方法
-
Linux下DNS服务器搭建详解 Linux下搭建DNS服务器和配置文件
-
对Linux进行详细的性能监控的方法 Linux 系统性能监控命令详解
-
linux系统root密码忘了怎么办 linux忘记root密码后找回密码的方法
-
Linux基本命令有哪些 Linux系统常用操作命令有哪些
-
Linux必学的网络操作命令 linux网络操作相关命令汇总
-
linux系统从入侵到提权的详细过程 linux入侵提权服务器方法技巧
-
linux系统怎么用命令切换用户登录 Linux切换用户的命令是什么
-
在linux中添加普通新用户登录 如何在Linux中添加一个新的用户
软件推荐
更多 >
-
1
专为国人订制！Linux Deepin新版发布2012-07-10
-
2
CentOS 6.3安装(详细图解教程)
-
3
Linux怎么查看网卡驱动?Linux下查看网卡的驱动程序
-
4
centos修改主机名命令
-
5
Ubuntu或UbuntuKyKin14.04Unity桌面风格与Gnome桌面风格的切换
-
6
FEDORA 17中设置TIGERVNC远程访问
-
7
StartOS 5.0相关介绍，新型的Linux系统！
-
8
解决vSphere Client登录linux版vCenter失败
-
9
LINUX最新提权 Exploits Linux Kernel <= 2.6.37
-
10
nginx在网站中的7层转发功能
