Today's Question:  What does your personal desk look like?        GIVE A SHOUT

Recover deleted file in Linux EXT3 file system

  sonic0002        2013-08-16 07:06:45       7,854        0    

Environment : CentOS 5.3 x86_64, /dev/sdb1 is the data segment /data0. EXT3 file system.

Problem : /data0/tcsql/cankao/phpcws-1.5.0/httpcws.cpp is deleted mistakenly and httpcws.cpp is not backed up. It will take much time to rewrite this program again. So we must recover it back.

debugfs is feasible in EXT2 file system, but in EXT3 file system, it's not very useful. There is one open source software called ext3grep which can help us recover deleted file in EXT3 file system. The recovery steps are:

1. Install ext3grep.

wget http://ext3grep.googlecode.com/files/ext3grep-0.10.1.tar.gz
tar zxvf ext3grep-0.10.1.tar.gz
cd ext3grep-0.10.1
./configure
make
make install

2. unmount /data0 segement

umount /data0

if it promts it's busy, please kill the process which is accessing this directory now, then unmount it:

fuser -k /data0
umount /data0

3. Check all Inode,this process may take a few minutes.

ext3grep /dev/sdb1 --ls --inode 2

点击在新窗口中浏览此图片

4. Check Inode recursively to see whether we can find the httpcws.cpp

点击在新窗口中浏览此图片

点击在新窗口中浏览此图片

5. Recover /data0/tcsql/cankao/phpcws-1.5.0/httpcws.cpp

ext3grep /dev/sdb1 --restore-file tcsql/cankao/phpcws-1.5.0/httpcws.cpp

点击在新窗口中浏览此图片

If you see below message, it means the recovery is successful:

Restoring tcsql/cankao/phpcws-1.5.0/httpcws.cpp

the current directory where the ext3grep command is executed will have a new generated directory named RESTORED_FILES. You can find tcsql/cankao/phpcws-1.5.0/httpcws.cpp in this directory.

6 mount /data0

mount /dev/sdb1 /data0

Source : http://blog.s135.com/linux_ext3_undelete/

LINUX  EXT3  FILE RECOVERY 

Share on Facebook  Share on Twitter  Share on Weibo  Share on Reddit 

  RELATED


  0 COMMENT


No comment for this article.