|
马上注册,结交更多好友,享用更多功能,让你轻松玩转社区。
您需要 登录 才可以下载或查看,没有帐号?立即注册
x
欢迎大家来到仓酷云论坛!人人都晓得Linux中,删除的文件想规复很难!并且分歧文件体系下规复的下令和工具大概还纷歧样。上面说下用debugfs,Linux中自带的下令,在ext3文件体系上规复被删除文件的一次实验.
[root]#mkdir/root/test//-->建测试文件夹
[root]#cd/root/test//-->进进该目次下
[root]#touchtest.txt//-->建测试文件名
[root]#cat/proc/meminfo>>test.txt//-->往测试文件写
[root]#cattest.txt
MemTotal:16432172kB
MemFree:7577528kB
Buffers:896832kB
Cached:5724212kB
SwapCached:0kB
Active:2737104kB
Inactive:4246932kB
HighTotal:0kB
HighFree:0kB
LowTotal:16432172kB
LowFree:7577528kB
SwapTotal:16777208kB
SwapFree:16777208kB
Dirty:1944kB
Writeback:0kB
AnonPages:362976kB
Mapped:179000kB
Slab:1756168kB
PageTables:9432kB
NFS_Unstable:0kB
Bounce:0kB
CommitLimit:24993292kB
Committed_AS:1469296kB
VmallocTotal:34359738367kB
VmallocUsed:291068kB
VmallocChunk:34359447031kB
HugePages_Total:0
HugePages_Free:0
HugePages_Rsvd:0
Hugepagesize:2048kB
[root]#rmtest.txt//-->删除此测试文件
[root]#ls-lart//-->检察是不是删除
total12
drwxr-x---6rootroot4096Aug609:51..
drwxr-xr-x2rootroot4096Aug609:52.
[root]#mount-r-n/dev/mapper/vg00-lvol1///-->从头以只读的体例挂载,避免其余历程用
[root]#df-h
FilesystemSizeUsedAvailUse%Mountedon
/dev/mapper/rootVG-root
83G7.4G72G10%/
/dev/mapper/rootVG-tmp
3.9G137M3.6G4%/tmp
/dev/mapper/rootVG-var
31G5.0G24G18%/var
/dev/cciss/c0d0p1145M26M111M19%/boot
/dev/mapper/vgglobal-lvol2
27G291M25G2%/home
/dev/mapper/vgglobal-lvol1
105G7.3G93G8%/d/oss/global
[root]#df-T
FilesystemType1K-blocksUsedAvailableUse%Mountedon
/dev/mapper/rootVG-root
ext38662318076965287445546010%/
/dev/mapper/rootVG-tmp
ext3406291213945637137444%/tmp
/dev/mapper/rootVG-var
ext33174185652225642488089218%/var
/dev/cciss/c0d0p1
ext31477642661111352419%/boot
/dev/mapper/vgglobal-lvol2
ext327447508297580257556522%/home
/dev/mapper/vgglobal-lvol1
ext31098064647579200966493328%/d/oss/global
[root]#debugfs//-->利用该下令
debugfs1.39(29-May-2006)
debugfs:open/dev/mapper/rootVG-root//-->翻开文件体系
debugfs:ls-d/root/test//-->检察被删文件
16269861(12).16269793(4084)..<16269863>(4072)test.txt
debugfs:logdump-i<16269861>//-->检察节点地点的块
Inode16269861isatgroup497,block16285700,offset512
Journalstartsatblock6182,transaction1128695
FSblock16285700loggedatsequence1128698,journalblock6330
(inodeblockforinode16269861):
Inode:16269861Type:badtypeMode:0000Flags:0x0Generation:0
User:0Group:0Size:0
FileACL:0DirectoryACL:0
Links:0Blockcount:0
Fragment:Address:0Number:0Size:0
ctime:0x00000000--ThuJan107:00:001970
atime:0x00000000--ThuJan107:00:001970
mtime:0x00000000--ThuJan107:00:001970
Blocks:
FSblock16285700loggedatsequence1128707,journalblock6860
(inodeblockforinode16269861):
Inode:16269861Type:directoryMode:0755Flags:0x0Generation:285284165
User:0Group:0Size:4096
FileACL:0DirectoryACL:0
Links:2Blockcount:8
Fragment:Address:0Number:0Size:0
ctime:0x53e18a66--WedAug609:52:382014
atime:0x53e18a44--WedAug609:52:042014
mtime:0x53e18a66--WedAug609:52:382014
Blocks:(0+1):16312328
Foundsequence1127169(not1128751)atblock9518:endofjournal
debugfs:quit//-->加入后,实行dd下令,count设置为1,skip为方才检察的值,将其放在/tmp目次。
[root]#ddif=/dev/mapper/rootVG-rootof=/tmp/test.txt.bakbs=4096count=1skip=16312328
1+0recordsin
1+0recordsout
4096bytes(4.1kB)copied,4.1e-05seconds,99.9MB/s
[root]#cat/tmp/test.txt//-->反省内容,和本来的分歧!
MemTotal:16432172kB
MemFree:7577528kB
Buffers:896832kB
Cached:5724212kB
SwapCached:0kB
Active:2737104kB
Inactive:4246932kB
HighTotal:0kB
HighFree:0kB
LowTotal:16432172kB
LowFree:7577528kB
SwapTotal:16777208kB
SwapFree:16777208kB
Dirty:1944kB
Writeback:0kB
AnonPages:362976kB
Mapped:179000kB
Slab:1756168kB
PageTables:9432kB
NFS_Unstable:0kB
Bounce:0kB
CommitLimit:24993292kB
Committed_AS:1469296kB
VmallocTotal:34359738367kB
VmallocUsed:291068kB
VmallocChunk:34359447031kB
HugePages_Total:0
HugePages_Free:0
HugePages_Rsvd:0
Hugepagesize:2048kB
如果您觉得本篇CentOSLinux教程讲得好,请记得点击右边漂浮的分享程序,把好文章分享给你的小伙伴们! |
|