linux上使用ext3grep恢复误删除的文件
误删除了ESQL文件：/data/ase157/OCS-15_0/sample/esqlc/readdevice.cp，此为背景。
本文介绍使用ext3grep恢复ext3类型分区上误删除文件的过程。
误删除文件readdevice.cp所在分区名为：/data。
1、先安装ext3grep软件
wget http://ext3grep.googlecode.com/files/ext3grep-0.10.1.tar.gz 如果google无法下载的话，本站下载地址：https://www.dbainfo.net/wp-content/uploads/file/ext3grep-0.10.1.tar.gz。
tar zxvf ext3grep-0.10.1.tar.gz
cd ext3grep-0.10.1
./configure
make
make install
2、umount /data分区
执行：umount /data
如果提示busy，先kill正在使用这个目录的进程，再umount：
fuser -k /data
umount /data
因为/data上存在swapfile，无法成功umount /data
3、查询所有Inode，（执行需要几分钟～十多分钟）
ext3grep /dev/xvdb1 --ls --inode 2
Inode 2 is directory "".
Directory block 1536:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 2 drwxr-xr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 11 drwx------ lost+found
3 4 d 1840545 drwxr-xrwx www
4 5 d 846977 drwxr-x--- ase1503
5 6 d 1123873 drwxrwxr-x ase157
6 7 d 1433345 drwxrwx--- download
7 8 r 48865 rrw-r--r-- swapfile
8 9 d 293185 drwxrwx--- sybasecncom
9 10 d 1254177 drwxr-xr-x sybiq127
10 11 d 1205318 drwxrwx--- db_dump
11 12 d 1824258 drwxr-xr-x syb64bit
12 14 d 2150017 drwxr-x--- tpch_test
14 16 d 1726577 drwxr-x--- rsync_backup
15 16 r 81448 D 1388112263 Fri Dec 27 10:44:23 2013 rrw-r--r-- dbainfo.net
16 end d 1693991 drwxr-xr-x sybcentral
18 20 r 48871 D 1379508179 Wed Sep 18 20:42:59 2013 rrw-r--r-- sybase-central4.3.rar
19 20 r 48870 D 1379508179 Wed Sep 18 20:42:59 2013 rrw-r--r-- Sybase ASE12.5附带的Sybase Central免安装版.part1.rar
21 end r 48872 D 1379508179 Wed Sep 18 20:42:59 2013 rrw-r--r-- Sybase ASE12.5附带的Sybase Central免安装版.part2.rar
4、逐级查找Inode，看是否能找到readdevice.cp文件（此步骤也可省略）
ext3grep /dev/xvdb1 --ls --inode 1123873
Inode 1123873 is directory "ase157".
Directory block 2265088:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1123873 drwxrwxr-x .
1 2 d 2 drwxr-xr-x ..
2 3 d 1123874 drwxrwxr-x jConnect-7_0
3 4 d 1124105 drwxrwxr-x jutils-3_0
4 5 d 1124110 drwxrwxr-x OCS-15_0
5 6 r 1124330 rrwxr-xr-x SYBASE.sh.save
6 7 r 1124331 rrwxrwxr-x .bash_history
7 8 d 1156557 drwxrwxr-x DataAccess
8 9 d 1156624 drwxrwxr-x DataAccess64
9 10 r 1140313 rrwxrwxr-x .viminfo
10 11 d 1172746 drwxrwxr-x Sybase_Install_Registry
11 12 d 1172748 drwxrwxr-x .fontconfig
12 13 d 1336433 drwxrwxr-x SCC-3_2
13 14 r 1124333 rrwxrwxr-x .bash_logout
14 15 d 1172992 drwxrwxr-x data
15 16 r 1124476 rrwxr-xr-x SYBASE.sh
16 17 r 1124335 rrwxrwxr-x .com.zerog.registry.xml
17 18 r 1124350 rrwxrwxr-x .bashrc
18 19 d 1172994 drwxrwxr-x jre32
19 20 d 1173016 drwxrwxr-x ASE-15_0
20 21 d 1156685 drwxrwxr-x SYBDIAG
21 22 r 1124337 rrwxr-xr-x SYBASE.csh.save
22 23 r 1124338 rrwxr-xr-x SYBASE.csh
23 24 d 1319467 drwxrwxr-x charsets
24 25 r 1124339 rrwxr-xr-x SYBASE.env.save
25 26 d 1320043 drwxrwxr-x .InstallAnywhere
26 27 r 1124340 rrwxrwxr-x .bash_profile
27 28 d 1320044 drwxrwxr-x .mozilla
28 29 d 1320045 drwxrwxr-x log
29 30 d 1320163 drwxrwxr-x collate
30 31 d 1320176 drwxrwxr-x SYSAM-2_0
31 32 d 1335663 drwxrwxr-x DBISQL
32 33 r 1124472 rrwxrwxr-x interfaces
33 34 d 1335698 drwxrwxr-x shared
34 35 d 1156693 drwxrwxr-x locales
35 36 d 1320219 drwxrwxr-x sybuninstall
36 37 r 1124342 rrw-r--r-- SYBASE.env
37 38 d 1156776 drwxrwxr-x config
38 39 d 1156781 drwxrwxr-x WS-15_0
39 40 d 1140280 drwxrwxr-x .sybase
40 41 r 1124332 rrwxrwxr-x interf.old
41 42 d 1156829 drwxrwxr-x .sqlanywhere11
42 43 r 1124344 rrw------- .lesshst
43 44 r 1108160 rrw-rw-r-x sybdiag-ase157xen-20130219175145.zip
44 46 d 1547361 drwxr-xr-x jre64
45 46 r 1124336 D 1392799959 Wed Feb 19 16:52:39 2014 rrw-r--r-- errorlog
46 47 r 1124341 rrwxr--r-- install.sh
47 48 r 1124381 rrw-rw-r-- sp_mda.sql
48 49 r 1124346 rrw-r--r-- accounts.zip
49 50 r 1124473 rrw-rw-r-- 123.txt
50 51 r 1124467 rrw-rw-r-- update_idx.sh
51 52 r 1124469 rrw-rw-r-- accounts.txt
52 53 d 1140283 drwxrwxr-x .java
53 55 r 1124470 rrw------- bulk_insert_sp110.log
55 end r 1124471 rrw-rw-r-- .jlogon11
56 end r 1140282 D 1392800192 Wed Feb 19 16:56:32 2014 rrwxrwxr-x .errorlog.swp
60 end r 1124479 D 1392456470 Sat Feb 15 17:27:50 2014 rrwxr-x--- .megaphone_telco_facts.sql.swp
ext3grep /dev/xvdb1 --ls --inode 1124110
Inode 1124110 is directory "ase157/OCS-15_0".
Directory block 2267769:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1124110 drwxrwxr-x .
1 2 d 1123873 drwxrwxr-x ..
2 3 d 1124111 drwxrwxr-x lib3p64
3 4 d 1124122 drwxrwxr-x python
4 5 d 1124133 drwxrwxr-x php
5 6 d 1124139 drwxrwxr-x xappdefaults
6 7 d 1124142 drwxrwxr-x sample
7 8 d 1124286 drwxrwxr-x include
8 9 d 1124305 drwxrwxr-x bin
9 10 d 1140161 drwxrwxr-x devlib
10 11 d 1156449 drwxrwxr-x scripts
11 12 d 1156452 drwxrwxr-x sybhelp
12 13 d 1156460 drwxrwxr-x lib
13 14 d 1156517 drwxrwxr-x config
14 15 d 1156526 drwxrwxr-x perl
15 end d 1156546 drwxrwxr-x lib3p
ext3grep /dev/xvdb1 --ls --inode 1124142
Inode 1124142 is directory "ase157/OCS-15_0/sample".
Directory block 2269701:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1124142 drwxrwxr-x .
1 2 d 1124110 drwxrwxr-x ..
2 3 d 1124143 drwxrwxr-x python
3 4 d 1124147 drwxrwxr-x php
4 5 d 1124150 drwxrwxr-x esqlcob
5 6 d 1124161 drwxrwxr-x esqlc
6 7 d 1124177 drwxrwxr-x ctlibrary
7 8 d 1124234 drwxrwxr-x db2ct
8 9 d 1124261 drwxrwxr-x perl
9 end d 1124264 drwxrwxr-x dblibrary
ext3grep /dev/xvdb1 --ls --inode 1124161
Inode 1124161 is directory "ase157/OCS-15_0/sample/esqlc".
Directory block 2269736:
.-- File type in dir_entry (r=regular file, d=directory, l=symlink)
| .-- D: Deleted ; R: Reallocated
Indx Next | Inode | Deletion time Mode File name
==========+==========+----------------data-from-inode------+-----------+=========
0 1 d 1124161 drwxrwxr-x .
1 2 d 1124142 drwxrwxr-x ..
2 3 r 1889427 rrw-r--r-- makefile
3 4 r 1124163 rrw-r--r-- exampleHA.cp
4 6 r 1124164 rrw-r--r-- example6.cp
6 7 r 1124166 rrw-r--r-- example8.cp
7 8 r 1124167 rrw-r--r-- example7.cp
8 9 r 1124168 rrw-r--r-- example5.cp
9 10 r 1124169 rrw-r--r-- example2.cp
10 11 r 1124170 rrwxr-xr-x sybopts.sh
11 12 r 1124171 rrw-r--r-- example4.cp
12 13 r 1124172 rrw-r--r-- uni_example2.cp
13 14 r 1124173 rrw-r--r-- exampleHA2.cp
14 15 r 1124174 rrw-r--r-- example1.cp
15 16 r 1124175 rrw-r--r-- uni_example1.cp
16 18 r 1124480 rrw-r--r-- sybsqlex.h
17 18 r 1889423 D 1392800203 Wed Feb 19 16:56:43 2014 rrw-rw-r-- readdevice.cp
18 19 r 1124165 rrw-r--r-- ReadMe
19 21 r 1124478 rrw-rw-r-- config.h
20 21 r 1124162 D 1392800200 Wed Feb 19 16:56:40 2014 rrw-r--r-- readdevice.c
21 22 r 1889424 rrwxrwxr-x readdevice
22 end r 1124334 rrw-rw-r-- megaphone.readdevice.sql
23 end r 1889425 D 1392800192 Wed Feb 19 16:56:32 2014 rrw-r--r-- .makefile.swp
24 end r 1889426 D 1392800192 Wed Feb 19 16:56:32 2014 rrw-r--r-- makefile~
25 26 r 1258705 D 1392446019 Sat Feb 15 14:33:39 2014 rrwxrwxr-x example5
26 28 r 1258706 D 1392446019 Sat Feb 15 14:33:39 2014 rrw-r--r-- example6.c
27 28 r 1258707 D 1392446019 Sat Feb 15 14:33:39 2014 rrwxrwxr-x example6
28 30 r 1258708 D 1392446019 Sat Feb 15 14:33:39 2014 rrw-r--r-- example7.c
29 30 r 1258709 D 1392446019 Sat Feb 15 14:33:39 2014 rrwxrwxr-x example7
30 32 r 1258710 D 1392446019 Sat Feb 15 14:33:39 2014 rrw-r--r-- example8.c
31 32 r 1258711 D 1392446019 Sat Feb 15 14:33:39 2014 rrwxrwxr-x example8
32 34 r 1258712 D 1392446019 Sat Feb 15 14:33:39 2014 rrw-r--r-- exampleHA.c
33 34 r 1258713 D 1392446019 Sat Feb 15 14:33:39 2014 rrwxrwxr-x exampleHA
34 end r 1258714 D 1392446019 Sat Feb 15 14:33:39 2014 rrw-r--r-- exampleHA2.c
35 end r 1140282 D 1392800192 Wed Feb 19 16:56:32 2014 rrwxrwxr-x exampleHA2
5、恢复/data/ase157/OCS-15_0/sample/esqlc/readdevice.cp文件
ext3grep /dev/xvdb1 --restore-file ase157/OCS-15_0/sample/esqlc/readdevice.cp
如果提示以下信息，则表示恢复成功：
Restoring ase157/OCS-15_0/sample/esqlc/readdevice.cp
这时，执行ext3grep命令的当前目录下将会自动生成一个名为RESTORED_FILES的文件夹，文件夹下的ase157/OCS-15_0/sample/esqlc/readdevice.cp即为恢复的文件。查看了一下，和被删除前的内容一样，恢复完成！
6、重新mount /data分区：
mount /dev/xvdb1 /data
因为第二步没有umount成功，不用再mount了。
参考：Linux EXT3文件系统下成功恢复误删的文件[原创] - 张宴的博客