linux恢復誤刪除檔案，有時候執行rm -rf * 是一件很危險的事；如果萬一不小心刪除了檔案，該如何恢復？

注意：該工具支援ext3檔案系統，不支援ext4檔案系統

1. 安裝rpm包
[[email protected]_test_26_74 /]# rpm -ivh ext3grep-0.10.2-1.el4.rf.x86_64.rpm
warning: ext3grep-0.10.2-1.el4.rf.x86_64.rpm: Header V3 DSA/SHA1 Signature, key ID 6b8d79e6: NOKEY
Preparing...                ########################################### [100%]
   1:ext3grep               ########################################### [100%]

2.檢視工具版本
[[email protected]_test_26_74 /]# ext3grep -v
Running ext3grep version 0.10.2
ext3grep v0.10.2, Copyright (C) 2008 Carlo Wood.
ext3grep comes with ABSOLUTELY NO WARRANTY;
This program is free software; your freedom to use, change
and distribute this program is protected by the GPL.

3.建立一個檔案系統：
[

4.掛載檔案系統
[[email protected]_test_26_74 /]# mount /dev/sdb1  /test

5.複製幾個檔案到/test

[[email protected]_test_26_74 test]# ll -ssh
total 65M
4.0K -rw-r--r-- 1 root root   56 Dec 30 11:19 aaa.txt
 16K drwx------ 2 root root  16K Dec 30 11:17 lost+found
872K -rw-r--r-- 1 root root 865K Dec 30 11:19 nginx-1.9.7.tar.gz
 64M -rw-r--r-- 1 root root  64M Dec 30 11:19 software.tar
 

6.刪除/test下所有檔案

[[email protected]_test_26_74 test]# rm -rf *
[[email protected]_test_26_74 test]# ll
total 0
[[email protected]_test_26_74 test]#

到此/test目錄下沒有檔案和目錄，下面我們就開始恢復所有檔案和目錄。

7. 解除安裝/dev/sdb1分割槽,防止磁碟有更多的讀寫操作，覆蓋了刪除的檔案
[[email protected] ~]# umount /test

8. 查詢恢復資料資訊

[[email protected] ~]# ext3grep /dev/sdb1 --ls --inode 2
主要用於掃描當前檔案系統下所有檔案的資訊，包括存在的和已刪除的檔案，其中含有D表示就是已經刪除的檔案，如果不記得被刪除的檔案的名稱，

[[email protected]_test_26_74 /]# ext3grep /dev/sdb1 --ls --inode 2
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 9
Loading group metadata... done
Minimum / maximum journal block: 131535 / 139736
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1451445526 = Wed Dec 30 11:18:46 2015
Number of descriptors in journal: 36; min / max sequence numbers: 2 / 5
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.

Searching group 0: DD
Searching group 1:
Searching group 2:
Searching group 3:
Searching group 4: ++
Searching group 5:
Searching group 6:
Searching group 7:
Searching group 8:
Writing analysis so far to 'sdb1.ext3grep.stage1'. Delete that file if you want to do this stage again.
Result of stage one:
  2 inodes are referenced by one or more directory blocks, 1 of those inodes is still allocated.
  1 inodes are referenced by more than one directory block, 1 of those inodes is still allocated.
  0 blocks contain an extended directory.
Result of stage two:
  1 of those inodes could be resolved because it is still allocated.
All directory inodes are accounted for!

Writing analysis so far to 'sdb1.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 529.
Inode 2 is directory "".
Directory block 529:
          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d       2                                         drwxr-xr-x  .
   1  end d       2                                         drwxr-xr-x  ..
   2    3 d      11  D 1451445637 Wed Dec 30 11:20:37 2015  drwx------  lost+found
   3    4 r      12  D 1451445637 Wed Dec 30 11:20:37 2015  rrw-r--r--  nginx-1.9.7.tar.gz
   4  end r      13  D 1451445637 Wed Dec 30 11:20:37 2015  rrw-r--r--  software.tar
   5  end r      14  D 1451445636 Wed Dec 30 11:20:36 2015  rrw-r--r--  aaa.txt
  

9. 恢復單個檔案
註明：要恢復被刪除的某個檔案，操作如下：

[[email protected]_test_26_74 /]# ext3grep /dev/sdb1 --restore-file nginx-1.9.7.tar.gz
Running ext3grep version 0.10.2
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 9
Minimum / maximum journal block: 131535 / 139736
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1451445526 = Wed Dec 30 11:18:46 2015
Number of descriptors in journal: 36; min / max sequence numbers: 2 / 5
Loading sdb1.ext3grep.stage2... done
Restoring nginx-1.9.7.tar.gz

10. 檢視是否恢復成功，在當前目錄會生成一個目錄RESTORED_FILES

[[email protected]_test_26_74 /]# cd /RESTORED_FILES/
[[email protected]_test_26_74 RESTORED_FILES]# # ll -ssh
total 66M
4.0K -rw-r--r-- 1 root root   56 Dec 30 11:37 aaa.txt
4.0K drwx------ 2 root root 4.0K Dec 30 11:35 lost+found
872K -rw-r--r-- 1 root root 865K Dec 30 11:35 nginx-1.9.7.tar.gz
 64M -rw-r--r-- 1 root root  64M Dec 30 11:35 software.tar
 
 可以看到已經恢復回來了！
 
11. 重新掛載分割槽
[[email protected]_test_26_74 test]# mount /dev/sdb1 /test

將恢復的檔案和目錄移動到原來的目錄中
[[email protected]_test_26_74 RESTORED_FILES]# cp * /test -R

可以看到都恢復了，到此資料恢復完成。
[[email protected]_test_26_74 test]# ll -ssh
total 66M
4.0K -rw-r--r-- 1 root root   56 Dec 30 11:37 aaa.txt
4.0K drwx------ 2 root root 4.0K Dec 30 11:35 lost+found
872K -rw-r--r-- 1 root root 865K Dec 30 11:35 nginx-1.9.7.tar.gz
 64M -rw-r--r-- 1 root root  64M Dec 30 11:35 software.tar

二、恢復所有檔案和目錄
[[email protected]_test_26_74 /]# ext3grep /dev/sdb2 --restore-all

註明：“--restore-all”引數將指定儲存裝置中可以恢復的檔案都恢復出來並放到了“RESTORED_FILES”目錄中;
“--restore-all”引數對恢復大量資料檔案時非常有用。