会员投稿

投稿指南 本期推荐:

您的位置: Linux安全网 > Linux系统 > » 正文

使用ext3grep恢复Linux下误删除的文件实录

日期:2011-11-08 点击:129 来源: 未知分享至:

AUTHOR:吖吖个呸

DATE:2011-09-14 感谢原创作者的付出.

其实这个工具我已经知道很久了，前一段时间做试验，老是出问题。自己也解决不了。很纠结，很郁闷，很蛋疼。。。。

或许今天运气比较好，装下软件包，然后使用一下，呵呵，竟然成功了，而且删除文件的时候，使用的命令是rm -rf哦！

首先下载这个软件，下载地址：

http://code.google.com/p/ext3grep/downloads/list

目前的最新版本是：ext3grep-0.10.2.tar.gz

我系统的环境是：虚拟机

[root@localhost bin]# uname -a

Linux localhost.localdomain 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:54 EDT 2009 i686 i686 i386 GNU/Linux

[root@localhost bin]# cat /etc/issue

Red Hat Enterprise Linux Server release 5.4 (Tikanga)

下面开始安装了哦。安装很简单

tar zxvf ext3grep-0.10.2.tar.gz

cd ext3grep-0.10.2

./configure --prefix=/usr/local/ext3grep

make

make install

顺利安装完成。

然后进入么安装目录看一下，只有一个bin

[root@localhost ext3grep]# pwd

/usr/local/ext3grep

[root@localhost ext3grep]# ls

bin

进到bin里面看一下

[root@localhost ext3grep]# cd bin

[root@localhost bin]# ls

ext3grep

我们可以看一下帮助，下面是部分

[root@localhost bin]# ./ext3grep -h

Running ext3grep version 0.10.2

./ext3grep: invalid option -- h

No action specified; implying --superblock.

Usage: ./ext3grep [options] [--] device-file

Options:

--version, -[vV] Print version and exit successfully.

--help, Print this help and exit successfully.

--superblock Print contents of superblock in addition to the rest.

If no action is specified then this option is implied.

--print Print content of block or inode, if any.

--ls Print directories with only one line per entry.

This option is often needed to turn on filtering.

--accept filen Accept 'filen' as a legal filename. Can be used multi-

ple times. If you change any --accept you must remove

BOTH stage* files!

--accept-all Simply accept everything as filename.

--journal Show content of journal.

--show-path-inodes Show the inode of each directory component in paths.

Filters:

--group grp Only process group 'grp'.

--directory Only process directory inodes.

--after dtime Only entries deleted on or after 'dtime'.

--before dtime Only entries deleted before 'dtime'.

--deleted Only show/process deleted entries.

--allocated Only show/process allocated inodes/blocks.

--unallocated Only show/process unallocated inodes/blocks.

--reallocated Do not suppress entries with reallocated inodes.

Inodes are considered 'reallocated' if the entry

is deleted but the inode is allocated, but also when

the file type in the dir entry and the inode are

different.

Tags：

分享至:

最新图文资讯

1 2 3 4 5 6

相关文章列表:

推荐内容

最新文章

关于我们 - 联系我们 - 广告服务 - 友情链接 - 网站地图 - 版权声明 - 发展历史