Ext3grap 是ext3文件系统下的一个开源数据恢复工具，官方下载地址http://code.google.com/p/ext3grep/downloads/detail?name=ext3grep-0.10.2.tar.gz 。

        它的恢复原理很简单：ext2/ext3 文件系统是采用 block+inode 的方式存放文件的，其中 inode 存放文件的元数据，包含文件权限、更改时间、属性等。而在带有日志功能的 ext3 文件系统中，删除一个文件，就是将该文件的 inode节点中的指针清除，其实数据还在存在block当中的。所以如果没有新的数据来占用该 block，只要恢复了inode指向，该文件就恢复了。

        接下来是安装过程和模拟误删演示：

  1: cd ext3grep-0.10.2

  2: ./configure

  3: make && make install

       1、 我现在是将 sdb5 挂载到分区 /mnt/data2 下：

  1: mount /dev/sdb5 /mnt/data2/

       分别在下面新建一个目录和一文件

  1: [root@localhost src]# cd /mnt/data2/

  2: [root@localhost data2]# ls

  3: [root@localhost data2]# echo "I Love you" > nodelete.txt

  4: [root@localhost data2]# ls

  5: nodelete.txt

  6: [root@localhost data2]# cat nodelete.txt

  7: I Love you

  8: [root@localhost data2]# mkdir nodelete

  9: [root@localhost data2]# ls

 10: nodelete  nodelete.txt

 11: 

     2、  接下来假设我误删2个数据了，

  1: [root@localhost data2]# rm -fR no*

  2: [root@localhost data2]# ls

  3: [root@localhost data2]#

  4: 

3、恢复。误删之后千万注意整个硬盘不能有任何写入操作了，我们先卸载所在分区。

  1: [root@localhost data2]# cd

  2: [root@localhost ~]# umount /mnt/data2/

#查看要恢复的数据

  1: [root@localhost ~]# ext3grep /dev/sdb5 --ls --inode 2

  2: Running ext3grep version 0.10.1

  3: WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

  4: Number of groups: 8

  5: Loading group metadata... done

  6: Minimum / maximum journal block: 583 / 4685

  7: Loading journal descriptors... sorting... done

  8: The oldest inode block that is still in the journal, appears to be from 1350471162 = Wed Oct 17 18:52:42 2012

  9: Number of descriptors in journal: 65; min / max sequence numbers: 9 / 35

 10: Inode is Allocated

 11: 

#指定恢复nodelete.txt

  1: [root@localhost ~]# ext3grep /dev/sdb5 --restore-file nodelete.txt

  2: Running ext3grep version 0.10.1

  3: WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

  4: Number of groups: 8

  5: Minimum / maximum journal block: 583 / 4685

  6: Loading journal descriptors... sorting... done

  7: The oldest inode block that is still in the journal, appears to be from 1350471162 = Wed Oct 17 18:52:42 2012

  8: 

#恢复所有数据  ext3grep /dev/sdb5 --restore-all

执行恢复后会在当前目录下生成一个 目录 “RESTORED_FILES”，你要的数据就在里面了。

  1: [root@localhost ~]# ls |grep RE

  2: RESTORED_FILES

  3: