Linux恢复误删的数据

时间：2010-09-01 来源：qqmengxue

如果由于某些原因误删了linux的数据文件，可以恢复的途径很多，现在介绍一个Linux本身自带的工具：debugfs，这里只是简单的介绍一下，debugfs实现的功能很多，大家有兴趣可以自己去研究研究：

进入debugfs模式：

debugfs /dev/sdb1

查找已经被删除的数据：

debugfs 1.39 (29-May-2006)
debugfs: lsdel

Inode Owner Mode Size Blocks Time deleted
229870 0 100644 1511 1/ 1 Fri Jul 30 08:55:11 2010
229871 0 100644 1625 1/ 1 Fri Jul 30 08:55:17 2010
196613 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
212993 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
212994 0 100777 2282 1/ 1 Fri Jul 30 08:55:30 2010
212995 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
229377 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
229378 0 100777 2417 1/ 1 Fri Jul 30 08:55:30 2010

196611 0 100644 4096 1/ 1 Wed Aug 18 23:21:11 2010

查看某个已经被删除的文件：

debugfs: stat <196611>
Inode: 196611 Type: regular Mode: 0644 Flags: 0x0 Generation: 2373075787
User: 0 Group: 0 Size: 4096
File ACL: 0 Directory ACL: 0
Links: 0 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4c6bfa67 -- Wed Aug 18 23:21:11 2010
atime: 0x4c6bfa64 -- Wed Aug 18 23:21:08 2010
mtime: 0x4c6bfa64 -- Wed Aug 18 23:21:08 2010
dtime: 0x4c6bfa67 -- Wed Aug 18 23:21:11 2010
BLOCKS:
(0):423936
TOTAL: 1

开始恢复：

这里以196611删除的数据为例：

debugfs: dump <196611> /tmp/196611.bak

可以看到已经恢复了方法二：可以通过手动修改已经被删除的inode结构来达到恢复的目的： debugfs: mi <196611>
mi: Filesystem opened read/only 以上是因为我们将文件系统以read/only的模式进行的挂载 debugfs: close
debugfs: open -w /dev/MIDDER/weblogic 修改为可以修改的。 debugfs: mi <196611>
Mode [0100644]
User ID [0]
Group ID [0]
Size [4096]
Creation time [1282144871]
Modification time [1282144868]
Access time [1282144868]
Deletion time [1282144871] 0
Link count [0] 1
Block count [8]
File flags [0x0]
Generation [0x8d72434b]
File acl [0]
High 32bits of size [0]
Fragment address [0]
Fragment number [0]
Fragment size [0]
Direct Block #0 [423936]
Direct Block #1 [0]
Direct Block #2 [0]
Direct Block #3 [0]
Direct Block #4 [0]
Direct Block #5 [0]
Direct Block #6 [0]
Direct Block #7 [0]
Direct Block #8 [0]
Direct Block #9 [0]
Direct Block #10 [0]
Direct Block #11 [0]
Indirect Block [0]
Double Indirect Block [0]
Triple Indirect Block [0] 修改红色标示的部分最后退出：quit 最后，使用fsck 对修改的文件系统进行扫描 [root@localhost tmp]# fsck.ext3 /dev/MIDDER/weblogic
e2fsck 1.39 (29-May-2006)
/dev/MIDDER/weblogic is mounted.

WARNING!!! Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? yes

/dev/MIDDER/weblogic was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached inode 196611
Connect to /lost+found<y>? yes

Inode 196611 ref count is 2, should be 1. Fix<y>? yes

Pass 5: Checking group summary information
Block bitmap differences: +423936
Fix<y>? yes

Free blocks count wrong for group #12 (32252, counted=32251).
Fix<y>? yes

Free blocks count wrong (206716, counted=206715).
Fix<y>? yes

Inode bitmap differences: +196611
Fix<y>? yes

Free inodes count wrong for group #12 (16382, counted=16381).
Fix<y>? yes

Free inodes count wrong (494680, counted=494679).
Fix<y>? yes

相关阅读更多 +