Environment : CentOS 5.3 x86_64, /dev/sdb1 is the data segment /data0. EXT3 file system.
Problem : /data0/tcsql/cankao/phpcws-1.5.0/httpcws.cpp is deleted mistakenly and httpcws.cpp is not backed up. It will take much time to rewrite this program again. So we must recover it back.
debugfs is feasible in EXT2 file system, but in EXT3 file system, it's not very useful. There is one open source software called ext3grep which can help us recover deleted file in EXT3 file system. The recovery steps are:
1. Install ext3grep.
wget http://ext3grep.googlecode.com/files/ext3grep-0.10.1.tar.gz tar zxvf ext3grep-0.10.1.tar.gz cd ext3grep-0.10.1 ./configure make make install
2. unmount /data0 segement
umount /data0
if it promts it's busy, please kill the process which is accessing this directory now, then unmount it:
fuser -k /data0 umount /data0
3. Check all Inode,this process may take a few minutes.
ext3grep /dev/sdb1 --ls --inode 2
4. Check Inode recursively to see whether we can find the httpcws.cpp
5. Recover /data0/tcsql/cankao/phpcws-1.5.0/httpcws.cpp
ext3grep /dev/sdb1 --restore-file tcsql/cankao/phpcws-1.5.0/httpcws.cpp
If you see below message, it means the recovery is successful:
Restoring tcsql/cankao/phpcws-1.5.0/httpcws.cpp
the current directory where the ext3grep command is executed will have a new generated directory named RESTORED_FILES. You can find tcsql/cankao/phpcws-1.5.0/httpcws.cpp in this directory.
6 mount /data0
mount /dev/sdb1 /data0
