EXT3文件系统中误删文件的恢复方法

之前的文章中说明了当用rm -rf误删除文件后的恢复方法,使用这种方法是有前提条件的,必须保证Oracle实例没有关闭,Oracle的相关进程还在运行。而当Oracle进程已经关闭后,就无法再通过利用ora_进程跟踪文件句柄进行恢复了,那么还有办法对误删除的文件进行恢复吗?

rm-rf 误操作的恢复过程

Linux EXT3文件系统下成功恢复误删的文件
 
下面介绍一种用第三方软件进行恢复的方法:
 
--首先确保已经安装了e2fsprogs包
 [root@ora10g ext3grep-0.10.2]# rpm -qa | grep e2fsprogs
 e2fsprogs-1.39-20.el5
 e2fsprogs-devel-1.39-20.el5
 e2fsprogs-libs-1.39-20.el5
 

--软件下载:
 
 

--用Xshell复制到/opt目录后解压并编译安装
 
[root@ora10g ~]# cd /opt/
 
[root@ora10g opt]# tar -zxvf ext3grep-0.10.2.tar.gz
 

[root@ora10g opt]# ll
 total 500
 drwxr-xr-x 3  1000    1000  4096 Aug 26 09:09 ext3grep-0.10.2
 -rw-r--r-- 1 root  root    236364 Aug 26 09:08 ext3grep-0.10.2.tar.gz
 drwxr-xr-x 3 root  root      4096 Aug 22 16:44 ORCLfmap
 drwxrwxr-x 8 oracle oinstall  4096 Aug 25 11:39 rlwrap-0.37
 -rw-r--r-- 1 root  root    251438 Aug 25 11:37 rlwrap-0.37.tar.gz
 [root@ora10g opt]# cd ext3grep-0.10.2
 [root@ora10g ext3grep-0.10.2]# ./configure&&make&&make install
 编译过程略……
 

--查看软件命令使用方法
 [root@ora10g ext3grep-0.10.2]# ext3grep --help
 Running ext3grep version 0.10.2
 Usage: ext3grep [options] [--] device-file
 Options:
  --version, -[vV]      Print version and exit successfully.
  --help,                Print this help and exit successfully.
  --superblock          Print contents of superblock in addition to the rest.
                          If no action is specified then this option is implied.
  --print                Print content of block or inode, if any.
  --ls                  Print directories with only one line per entry.
                          This option is often needed to turn on filtering.
  --accept filen        Accept 'filen' as a legal filename. Can be used multi-
                          ple times. If you change any --accept you must remove
                          BOTH stage* files!
  --accept-all          Simply accept everything as filename.
  --journal              Show content of journal.
  --show-path-inodes    Show the inode of each directory component in paths.
 Filters:
  --group grp            Only process group 'grp'.
  --directory            Only process directory inodes.
  --after dtime          Only entries deleted on or after 'dtime'.
  --before dtime        Only entries deleted before 'dtime'.
  --deleted              Only show/process deleted entries.
  --allocated            Only show/process allocated inodes/blocks.
  --unallocated          Only show/process unallocated inodes/blocks.
  --reallocated          Do not suppress entries with reallocated inodes.
                          Inodes are considered 'reallocated' if the entry
                          is deleted but the inode is allocated, but also when
                          the file type in the dir entry and the inode are
                          different.
  --zeroed-inodes        Do not suppress entries with zeroed inodes. Linked
                          entries are always shown, regardless of this option.
  --depth depth          Process directories recursively up till a depth
                          of 'depth'.
 Actions:
  --inode-to-block ino  Print the block that contains inode 'ino'.
  --inode ino            Show info on inode 'ino'.
                          If --ls is used and the inode is a directory, then
                          the filters apply to the entries of the directory.
                          If you do not use --ls then --print is implied.
  --block blk            Show info on block 'blk'.
                          If --ls is used and the block is the first block
                          of a directory, then the filters apply to entries
                          of the directory.
                          If you do not use --ls then --print is implied.
  --histogram=[atime|ctime|mtime|dtime|group]
                          Generate a histogram based on the given specs.
                          Using atime, ctime or mtime will change the
                          meaning of --after and --before to those times.
  --journal-block jblk  Show info on journal block 'jblk'.
  --journal-transaction seq
                          Show info on transaction with sequence number 'seq'.
  --dump-names          Write the path of files to stdout.
                          This implies --ls but suppresses it's output.
  --search-start str    Find blocks that start with the fixed string 'str'.
  --search str          Find blocks that contain the fixed string 'str'.
  --search-inode blk    Find inodes that refer to block 'blk'.
  --search-zeroed-inodes Return allocated inode table entries that are zeroed.
  --inode-dirblock-table dir
                          Print a table for directory path 'dir' of directory
                          block numbers found and the inodes used for each file.
  --show-journal-inodes ino
                          Show copies of inode 'ino' still in the journal.
  --restore-inode ino[@seqnr][,ino[@seqnr],...]
                          Restore the file(s) with known inode number 'ino'.
                          The restored files are created in ./RESTORED_FILES/
                          with their inode number as extension (ie, inode.12345).
                          If '@seqnr' is provided then (only) the journal entry
                          with that sequence number is used, otherwise the latest
                          entry is used (if any). You can use that in the case a
                          a file was overwritten or truncated, rather than deleted.
  --restore-file 'path' [--restore-file 'path' ...]
                          Will restore file 'path'. 'path' is relative to the
                          root of the partition and does not start with a '/' (it
                          must be one of the paths returned by --dump-names).
                          The restored directory, file or symbolic link is
                          created in the current directory as 'RESTORED_FILES/path'.
  --restore-all          As --restore-file but attempts to restore everything.
                          The use of --after is highly recommended because the
                          attempt to restore very old files will only result in
                          them being hard linked to a more recently deleted file
                          and as such polute the output.
  --show-hardlinks      Show all inodes that are shared by two or more files.
 

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/05aad6cf88ef063d9412909a830a476f.html