How to use ext3grep to recover files on Linux

Linux system operation, sometimes accidentally delete important files, and there are many software that can recover deleted files, ext3grep is one of them, ext3grep needs to use a lot of commands in use, the following small series will give you Introduce the way Linux uses ext3grep.

Step:

The current latest version are: environmental ext3grep-0.10.2.tar.gz

I system are: virtual machine

[root@localhost bin]# uname -a

Linux localhost.localdomain 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:54 EDT 2009 i686 i686 i386 GNU/Linux

[root@localhost bin]# cat /etc/issue

Red Hat Enterprise Linux Server release 5.4 (Tikanga)

Installation is simple

tar zxvf ext3grep -0.10.2.tar.gz

cd ext3grep-0.10.2

. /configure --prefix=/usr/local/ext3grep

make

make install

The installation is complete.

Then enter the installation directory to see, only one bin

[root@localhost ext3grep]# pwd

/usr/local/ext3grep

[ Root@localhost ext3grep]# ls

bin

Go inside bin and look at

[root@localhost ext3grep]# cd bin

[root@ Localhost bin]# ls

ext3grep

We can look at the help, here is the section

[root@localhost bin]# . /ext3grep -h

Running ext3grep version 0.10.2

. /ext3grep: invalid option -- h

No action specified; implying --superblock.

Usage: . /ext3grep [options] [--] device-file

Options:

--version, -[vV] Print version and exit successfully.

--help, Print this help and exit successfully.

--superblock Print contents of superblock in addition to the rest.

If no action is specified then this option is implied.

- -print Print content of block or inode, if any.

--ls Print directories with only one line per entry.

This option is often needed to turn on filtering.

--accept filen Accept ‘filen’ as a legal filename. Can be used multi-

ple times. If you change any --accept you must remove

BOTH stage* files !

--accept-all Simply accept everything as filename.

--journal Show content of journal.

--show-path-inodes Show the inode of each directory Component in paths.

Filters:

--group grp Only process group ‘grp’.

--directory Only process directory inodes.

--after dtime Only entries deleted on or after ‘dtime’.

--before dtime Only entries deleted before ‘dtime’.

--deleted Only show/process deleted entries.

--allocated Only show/process allocated inodes/blocks.

--unallocated Only show/process unallocated inodes/Blocks.

--reallocated Do not suppress entries with reallocated inodes.

Inodes are considered ‘reallocated’ if the entry

is deleted but the inode is allocated, but Also when

the file type in the dir entry and the inode are

different.

--zeroed-inodes Do not suppress entries with zeroed inodes. Linked

entries are always shown, regardless of this option.

--depth depth Process directories recursively up till a depth

of ‘depth’.

Actions:

--inode-to-block ino Print the block that contains inode ‘ino’.

--inode ino Show info on inode ‘ino’.

If --ls is used and the inode is a directory, then

the filters apply to the entries of the directory.

If you do not use --ls Then --print is implied.

--block blk Show info on block ‘blk’.

If --ls is used and the block is the first block

of a directory, then the filters apply to entries

of the directory.

If you do not use --ls then --print is implied.

--histogram=[atime