如果由於某些原因誤刪了linux的資料檔案，可以恢復的途徑很多，現在介紹一個Linux本身自帶的工具：debugfs，這裡只是簡單的介紹一下，debugfs實現的功能很多，大家有興趣可以自己去研究研究：

[@more@]

進入debugfs模式：

debugfs /dev/sdb1

查詢已經被刪除的資料：

debugfs 1.39 (29-May-2006)
debugfs: lsdel

Inode Owner Mode Size Blocks Time deleted
229870 0 100644 1511 1/ 1 Fri Jul 30 08:55:11 2010
229871 0 100644 1625 1/ 1 Fri Jul 30 08:55:17 2010
196613 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
212993 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
212994 0 100777 2282 1/ 1 Fri Jul 30 08:55:30 2010
212995 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
229377 0 40700 0 1/ 1 Fri Jul 30 08:55:30 2010
229378 0 100777 2417 1/ 1 Fri Jul 30 08:55:30 2010

196611 0 100644 4096 1/ 1 Wed Aug 18 23:21:11 2010

檢視某個已經被刪除的檔案：

debugfs: stat <196611>
Inode: 196611 Type: regular Mode: 0644 Flags: 0x0 Generation: 2373075787
User: 0 Group: 0 Size: 4096
File ACL: 0 Directory ACL: 0
Links: 0 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4c6bfa67 -- Wed Aug 18 23:21:11 2010
atime: 0x4c6bfa64 -- Wed Aug 18 23:21:08 2010
mtime: 0x4c6bfa64 -- Wed Aug 18 23:21:08 2010
dtime: 0x4c6bfa67 -- Wed Aug 18 23:21:11 2010
BLOCKS:
(0):423936
TOTAL: 1

開始恢復：

這裡以196611刪除的資料為例：

debugfs: dump <196611> /tmp/196611.bak

可以看到已經恢復了

方法二：

可以透過手動修改已經被刪除的inode結構來達到恢復的目的：

debugfs: mi <196611>
mi: Filesystem opened read/only

以上是因為我們將檔案系統以read/only的模式進行的掛載

debugfs: close
debugfs: open -w /dev/MIDDER/weblogic

修改為可以修改的。

debugfs: mi <196611>
Mode [0100644]
User ID [0]
Group ID [0]
Size [4096]
Creation time [1282144871]
Modification time [1282144868]
Access time [1282144868]
Deletion time [1282144871] 0
Link count [0] 1
Block count [8]
File flags [0x0]
Generation [0x8d72434b]
File acl [0]
High 32bits of size [0]
Fragment address [0]
Fragment number [0]
Fragment size [0]
Direct Block #0 [423936]
Direct Block #1 [0]
Direct Block #2 [0]
Direct Block #3 [0]
Direct Block #4 [0]
Direct Block #5 [0]
Direct Block #6 [0]
Direct Block #7 [0]
Direct Block #8 [0]
Direct Block #9 [0]
Direct Block #10 [0]
Direct Block #11 [0]
Indirect Block [0]
Double Indirect Block [0]
Triple Indirect Block [0]

修改紅色標示的部分

最後退出：quit

最後，使用fsck 對修改的檔案系統進行掃描

[root@localhost tmp]# fsck.ext3 /dev/MIDDER/weblogic
e2fsck 1.39 (29-May-2006)
/dev/MIDDER/weblogic is mounted.

WARNING!!! Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? yes

/dev/MIDDER/weblogic was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached inode 196611
Connect to /lost+found? yes

Inode 196611 ref count is 2, should be 1. Fix? yes

Pass 5: Checking group summary information
Block bitmap differences: +423936
Fix? yes

Free blocks count wrong for group #12 (32252, counted=32251).
Fix? yes

Free blocks count wrong (206716, counted=206715).
Fix? yes

Inode bitmap differences: +196611
Fix? yes

Free inodes count wrong for group #12 (16382, counted=16381).
Fix? yes

Free inodes count wrong (494680, counted=494679).
Fix? yes

Linux恢復誤刪的資料

相關文章