作者 主題: Undelete Linux Files from an ext2 File System  (閱讀 12845 次)

0 會員 與 1 訪客 正在閱讀本文。

日京三子

  • 全區板主
  • 俺是博士!
  • *****
  • 文章數: 8830
    • 檢視個人資料
    • http://www.24online.cjb.net
Undelete Linux Files from an ext2 File System
« 於: 2003-10-20 13:06 »
原文在:http://www.stud.tu-ilmenau.de/~mojo/undelete.html, 感謝google大神, 讓我們可以看到這麼實用的東西!

原文如下:
    A few days ago, I run into big trouble as I deleted accidentally the whole home directory of an employee.
    I knew that there is no trash can in Linux like in Windows.
    So the work of 6 months seemed to be destroyed.
    While doing a long research on the web, I found some ways and tools to recover deleted files on an ext2 Linux file system.
    I tested all the tools on a second machine, while deleting files and trying to recover them, but only with more or less random success.
    Late at night I found a tool, which seemed to be the right one to help me.
    Sebastian Hetze from the company Lunetix developed a tool called: undelete.
    While testing this tool, I got the best results, specially for text files.
    Using the undelete program, I got 99% of the files back.
    Here are the steps, I did to recover the files.

    Steps to undelete files from an ext2 file system:

       1. preparations
              * prevent any write action on the partition, where the files are deleted

              * the affected partition must be unmounted to use the undelete tool
                on it
              * deleted files are on the root partition (like in my case)
                    o turn the computer off without shut down
                    o add the affected hard drive as a second hard drive in another Linux machine
                    o do no install operations like fdisk with this second hard drive
                    o Linux should detect it automatically while booting
                    o if the name of the affected partition on the second hard drive is unknown,
                      use only the read-only mount mode to figure the name out, e.g. mount -o ro /dev/hdc3

                      don't forget to unmount, before running the undelete tool on it
       2. download the undelete tool
http://www1.lunetix.de/download on another partition or machine
   3. download the e2fsprogs package http://e2fsprogs.sourceforge.net on another partition or machine (needed to re-compile the undelete tool)
   4. follow the install and compile instructions for the e2fsprogs package and the undelete tool
   5. for better results, the undelete tool should be re-compiled with the current kernel
   6. read the README file of the undelete tool
   7. open a root console
   8. copy the undelete binary to: /usr/bin
   9. create a new directory e.g. mkdir dump
  10. change to the new directory
  11. run the undelete tool on the affected partition, e.g. machine:~/dump # undelete -d /dev/hdc3 -a 10
  12. pray, or if you are faithless: stay cool
  13. follow the instructions given by the tool
  14. be happy



Helpful links about this topic
Linux Ext2fs Undeletion mini-HOWTO
Disc recovery tools for EXT2FS
Recovering Deleted Files with mc
Löschen und Restaurieren von Dateien
Holger Rath, 20. November 2001[/list]

簡單的說,  想要搶救你不小心誤刪的檔案, 請按照下面的步驟:
    1.先去
http://www1.lunetix.de/download裡面, 找到undelete檔案, 此檔案為tar.gz包裝檔.
2.再來去找http://e2fsprogs.sourceforge.net, 下載之後重新編譯(cofiguration & Make)這兩個部份的檔案, 先e2fsprogs, 再來才是undelete.
3. 建議將undelete (那個可執行檔, 不是整個目錄) 複製到/usr/bin. 沒甚麼特別理由, 純粹是方便而已.
4 建立一個"複製需要被拯救出來的檔案"的暫存目錄, 例如/tmp/undelete
5. 將被拯救的對象給umount.
6.在/tmp/undelete目錄底下, 執行undelete -d /dev/hdc3 -a 10. 這意思是說, 你要拯救的對象是在/dev/hdc3, 而且被刪除的時間為10個小時以前.
7.進入undelete的程式之後, 按?就可以看到功能解說.
[/list]
哈克不愛的多合一輸入平台----->新香草口味
過去的時間不斷流逝,抹去的眼淚已成追憶;
乾枯的雙手無力阻止,再會了我遠去的曾經。

harrier

  • 榮譽博士
  • 俺是博士!
  • *****
  • 文章數: 1856
  • 性別: 男
    • 檢視個人資料
    • 國屬武裝兵
Re: Undelete Linux Files from an ext2 File System
« 回覆 #1 於: 2007-05-07 16:19 »
引述: "日京三子"

    12. pray, or if you are faithless: stay cool

簡單的說,  想要搶救你不小心誤刪的檔案, 請按照下面的步驟:


三子 漏翻了重要的這一步:

12.祈禱,如果你沒有任何信仰:就保持冷靜

~~~XD
外國人真的有趣~
...90Net(90:1200/1203),GameNET(99:700/707),ALLNet(92:9200/3111),InfoNet(30:100/103)..MaximusCBCS(浮懷),AirNet,TenderNet,StormNet,FidoNet...
<<- www.nas.vg ->>