使用ext3grep恢復ext3上刪除的文件 收藏
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
是的，我知道ext3文件系統上，一旦文件被刪除(rm -rf )，就幾乎沒有恢復的可能。而且從ext3文件系統的FAQ中提到的一條也能印證這點：
引用
Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can’t! This is what one of the developers, Andreas Dilger, said about it:
In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as “deleted” and leaves the block pointers alone.
Your only hope is to “grep” for parts of your files that have been deleted and hope for the best.
Actually, you can’t! This is what one of the developers, Andreas Dilger, said about it:
In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as “deleted” and leaves the block pointers alone.
Your only hope is to “grep” for parts of your files that have been deleted and hope for the best.
但是，但是，這不是事實的全部，被刪除文件的所有信息可能都還在磁盤上，包括塊指針。ext3grep通過分析文件系統日誌，實現了恢復被刪除文件的功能。
一、原理
Carlo Wood在2008年2月7日不小心使用了rm -rf 刪除了/home目錄，損失數據超過3GB，而唯一的備份還是2007年6月份的，他不甘心他的數據就這麼丟失，於是就還是研究ext3文件系統，牛人就是牛人，他花了3個星期，寫了將近5000行代碼，他恢復了所有的文件。
ext3grep工具的恢復原理並不是依賴特定文件格式。以ext3grep爲例，他首先通過文件系統的root
inode（一般爲2）來獲得所有當前文件系統下文件的信息，包括存在的和已經刪除的，這些信息當然也包括文件名和其inode。
然後利用inode到日誌來去查詢該inode所在的block位置，包括直接塊，間接塊等信息。最後利用dd來將這些信息dump出來，而形成一個文件。
ext3grep官方網站：http://code.google.com/p/ext3grep/
二、步驟
光說不練是假把式，我們就祭出他的工具–ext3grep。如果你是debian/ubuntu用戶，那你走運了，直接sudo apt-get install ext3grep就可以了。
我們可以一步一步的從文件系統原理來告訴你如何恢復一個文件，但是我怕你還沒有看完，就走人了，所以我就先給一個快速演示給大家看看：我們先刪除/boot目錄(/dev/sda2分區)下的某一個文件（如果你不相信他能恢復，請先行備份），然後利用這個工具來恢復這個文件。
1）備份並刪除文件
root@wgzhao-nb:/boot# cp initrd.img-2.6.28-13-generic /var/tmp/
root@wgzhao-nb:/boot# mount -o rw,remount /dev/sda2 /boot
root@wgzhao-nb:/boot# rm -rf initrd.img-2.6.28-13-generic
root@wgzhao-nb:/boot# sync
root@wgzhao-nb:/boot# mount -o rw,remount /dev/sda2 /boot
root@wgzhao-nb:/boot# rm -rf initrd.img-2.6.28-13-generic
root@wgzhao-nb:/boot# sync
2）如果你爲了保險其間，可以立刻將boot分區(/dev/sda2)掛載爲只讀
root@wgzhao-nb:/boot# mount -o remount,ro /dev/sda2 /boot
3）假定你不記得你要恢復的文件的名字了（大部分情況是不會記得的），我們要列出包含刪除文件目錄下所有包含的文件，包括被刪除的文件。
引用
root@wgzhao-nb:/boot# ext3grep /dev/sda2 --dump-names
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 527 / 4641
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1246156824 = Sun Jun 28 10:40:24 2009
Number of descriptors in journal: 364; min / max sequence numbers: 310 / 883
Finding all blocks that might be directories.
[...]
System.map-2.6.18-128.1.14.el5
System.map-2.6.18-53.11AXS3
System.map-2.6.28-13-generic
System.map-2.6.28-14-generic
System.map-2.6.30-10-generic
System.map-2.6.30-10-generic.dpkg-new
System.map-2.6.30-10-generic.dpkg-tmp
[...]
lost+found
module-info
symvers-2.6.18-128.1.14.el5.gz
symvers-2.6.18-53.11AXS3.gz
vmcoreinfo-2.6.28-13-generic
vmcoreinfo-2.6.28-14-generic
vmcoreinfo-2.6.30-10-generic
vmcoreinfo-2.6.30-10-generic.dpkg-new
vmcoreinfo-2.6.30-10-generic.dpkg-tmp
vmlinuz
vmlinuz-2.6.18-128.1.14.el5
vmlinuz-2.6.18-53.11AXS3
vmlinuz-2.6.28-13-generic
vmlinuz-2.6.28-14-generic
vmlinuz-2.6.30-10-generic
vmlinuz-2.6.30-10-generic.dpkg-tmp
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Minimum / maximum journal block: 527 / 4641
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1246156824 = Sun Jun 28 10:40:24 2009
Number of descriptors in journal: 364; min / max sequence numbers: 310 / 883
Finding all blocks that might be directories.
[...]
System.map-2.6.18-128.1.14.el5
System.map-2.6.18-53.11AXS3
System.map-2.6.28-13-generic
System.map-2.6.28-14-generic
System.map-2.6.30-10-generic
System.map-2.6.30-10-generic.dpkg-new
System.map-2.6.30-10-generic.dpkg-tmp
[...]
lost+found
module-info
symvers-2.6.18-128.1.14.el5.gz
symvers-2.6.18-53.11AXS3.gz
vmcoreinfo-2.6.28-13-generic
vmcoreinfo-2.6.28-14-generic
vmcoreinfo-2.6.30-10-generic
vmcoreinfo-2.6.30-10-generic.dpkg-new
vmcoreinfo-2.6.30-10-generic.dpkg-tmp
vmlinuz
vmlinuz-2.6.18-128.1.14.el5
vmlinuz-2.6.18-53.11AXS3
vmlinuz-2.6.28-13-generic
vmlinuz-2.6.28-14-generic
vmlinuz-2.6.30-10-generic
vmlinuz-2.6.30-10-generic.dpkg-tmp
4）看了這個列表你總知道你要恢復的文件名字了吧，我們這裏是initrd.img-2.6.28-13-generic，如果你還是不記得，唉，好人做到底，給你必殺技，使用下面的指令：
引用
root@wgzhao-nb:/boot# ext3grep /dev/sda2 --ls --inode $(ls -id /boot |awk '{print $1}')
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Loading group metadata... done
Minimum / maximum journal block: 527 / 4641
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1246156824 = Sun Jun 28 10:40:24 2009
Number of descriptors in journal: 364; min / max sequence numbers: 310 / 883
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Writing analysis so far to 'sda2.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 513.
Inode 2 is directory "".
Directory block 513:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 end d 2 drwxr-xr-x ..
6 7 r 14 D 1248245870 Wed Jul 22 14:57:50 2009 rrw-r--r-- symvers-2.6.18-53.11AXS3.gz
15 16 r 6058 D 1248086531 Mon Jul 20 18:42:11 2009 rrw-r--r-- vmlinuz-2.6.28-13-generic
16 17 r 6063 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- System.map-2.6.28-13-generic
17 18 r 6054 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- initrd.img-2.6.28-13-generic
18 19 r 6059 D 1248086557 Mon Jul 20 18:42:37 2009 rrw-r--r-- config-2.6.28-13-generic
19 20 r 6064 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- vmcoreinfo-2.6.28-13-generic
22 23 r 6057 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- abi-2.6.28-13-generic.dpkg-tmp
24 26 r 6056 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- config-2.6.28-13-generic.dpkg-tmp
[...]
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 13
Loading group metadata... done
Minimum / maximum journal block: 527 / 4641
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1246156824 = Sun Jun 28 10:40:24 2009
Number of descriptors in journal: 364; min / max sequence numbers: 310 / 883
Inode is Allocated
Finding all blocks that might be directories.
D: block containing directory start, d: block containing more directory entries.
Each plus represents a directory start that references the same inode as a directory start that we found previously.
Writing analysis so far to 'sda2.ext3grep.stage2'. Delete that file if you want to do this stage again.
The first block of the directory is 513.
Inode 2 is directory "".
Directory block 513:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 end d 2 drwxr-xr-x ..
6 7 r 14 D 1248245870 Wed Jul 22 14:57:50 2009 rrw-r--r-- symvers-2.6.18-53.11AXS3.gz
15 16 r 6058 D 1248086531 Mon Jul 20 18:42:11 2009 rrw-r--r-- vmlinuz-2.6.28-13-generic
16 17 r 6063 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- System.map-2.6.28-13-generic
17 18 r 6054 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- initrd.img-2.6.28-13-generic
18 19 r 6059 D 1248086557 Mon Jul 20 18:42:37 2009 rrw-r--r-- config-2.6.28-13-generic
19 20 r 6064 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- vmcoreinfo-2.6.28-13-generic
22 23 r 6057 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- abi-2.6.28-13-generic.dpkg-tmp
24 26 r 6056 D 1248086910 Mon Jul 20 18:48:30 2009 rrw-r--r-- config-2.6.28-13-generic.dpkg-tmp
[...]
以上你看到的D標誌的，就是被刪除的文件，這你總知道了吧，還是不知道，那就再往後看，最後有一個必必殺計。
5）接着我們恢復文件，這是關鍵：
引用
root@wgzhao-nb:~# cd /tmp
root@wgzhao-nb:/tmp# ext3grep $IMAGE --restore-file initrd.img-2.6.28-13-generic
[...]
Restoring initrd.img-2.6.28-13-generic
root@wgzhao-nb:/tmp# md5sum RESTORED_FILES/initrd.img-2.6.28-13-generic
22092b1719a7601674fc59ff4a534dc9 RESTORED_FILES/initrd.img-2.6.28-13-generic
root@wgzhao-nb:/tmp# md5sum /var/tmp/initrd.img-2.6.28-13-generic
22092b1719a7601674fc59ff4a534dc9 /var/tmp/initrd.img-2.6.28-13-generic
root@wgzhao-nb:/tmp# ext3grep $IMAGE --restore-file initrd.img-2.6.28-13-generic
[...]
Restoring initrd.img-2.6.28-13-generic
root@wgzhao-nb:/tmp# md5sum RESTORED_FILES/initrd.img-2.6.28-13-generic
22092b1719a7601674fc59ff4a534dc9 RESTORED_FILES/initrd.img-2.6.28-13-generic
root@wgzhao-nb:/tmp# md5sum /var/tmp/initrd.img-2.6.28-13-generic
22092b1719a7601674fc59ff4a534dc9 /var/tmp/initrd.img-2.6.28-13-generic
由此我們知道恢復出來的文件是完整的。這裏要注意的是–restore-file 的文件參數，文件參數應該包括文件相對路徑，相對路徑指的是相對你指定的設備，比如/dev/sda2就是/boot的根目錄，而initrd.img-2.6.28-13-generic在/boot目錄下，因此這裏直接給出文件名就好了，如果是需要恢復/boot/grub/grub.conf文件的話，那麼指定的參數就應該像下面這樣：
root@wgzhao-nb:#ext3grep /dev/sda2 –restore-file grub/grub.conf
細心的你，你可能知道了，他指定文件的方式就和grub一樣，比如(hd0,1)/grub/grub.conf這樣。
以上是恢復一個文件的簡單步驟，如果你想從ext3文件系統原理着手來看如何逐步恢復一個文件的話，請看ext3grep的作者自己寫的howto ，那裏給出了一個非常詳細的步驟，使得你對ext3文件系統一定有更深入的瞭解。
如果你有N個文件需要恢復（N>100)，那麼用上面的方法看就比較惱火了，所以作者給ext3grep增加了一個–restore-all的參數。它能把指定設備的所有看你能恢復的文件都恢復出來，寫入一個RESTORED_FILES目錄裏。作者建議使用–restore-all的參數時，同時指定–after參數，表示指定恢復什麼時間之後被刪除的文件，這是爲了防止用恢復過多的舊文件，算是一種過濾方式。參數爲時間戳格式，比如：
ext3grep –restore-all –after 1245676061
表示恢復自2009-06-22 21:07以後刪除的文件。
OK，更詳細更強大的功能，自己去看作者的howto 吧。
三、在紅旗上使用
紅旗 Linux上也可以使用該工具，具體的使用方法，請參考：
http://blog.chinaunix.net/u2/85323/showart_2002696.html