{"id":326,"date":"2010-07-01T05:33:43","date_gmt":"2010-07-01T11:33:43","guid":{"rendered":"http:\/\/blog.supportpro.com\/?p=326"},"modified":"2020-03-30T01:54:04","modified_gmt":"2020-03-30T07:54:04","slug":"how-to-find-deleted-files-using-ext3grep","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/how-to-find-deleted-files-using-ext3grep\/","title":{"rendered":"How to find deleted files using EXT3GREP"},"content":{"rendered":"

1. Installing ext3grep
\nwget http:\/\/ext3grep.googlecode.com\/files\/ext3grep-0.7.0.tar.gz
\ntar -xvzf ext3grep-0.7.0.tar.gz
\ncd ext3grep
\n.\/configure
\nmake<\/p>\n

<\/p>\n

cd src
\n.\/ext3grep –help
\nDone, ext3grep is built and working<\/p>\n

3.Lets search for deleted folder:
\nEg: .\/ext3grep \/dev\/hda1 –search uaconsoleclientsample
\nExt3grep will find many deleted blocks, now we need to check each blocks to find exact block associated with our deleted folder.
\n4.Find exact block assosicated with our deleted folder by checking each block
\nEg: .\/ext3grep \/dev\/hda1 –ls –block 240017
\nUse this script to automate this checking process.
\n#!\/bin\/sh<\/p>\n

blocks=255079 336393 336518 336526 395434 395435 395457 737282 984250 1346129 1868670 1869273 1950436 3915933 3915935 4069411 4087953 4216611 4292193 4292196 4292275 4530219 4538370 4538371 4538372 4538376 4538378 4538382 4538385 4543743 4543750 4543752 4544514 4544517 4544528 4544539 4550683 4550707 4655509 4655533 4670417 4670423 4689385 4689746 4785120 5046823 6525842 7370457 7805912<\/p>\n

# Replace above blocks with blocks found in step 3<\/p>\n

for block in $blocks; do<\/p>\n

.\/ext3grep \/dev\/hda1 ls block $block | tee -a output.txt<\/p>\n

done
\nThis script does the same procedure for each block in the list, shows the output on console and writes it to the file output.txt using tee. This way you can recheck the result later also in vim.<\/p>\n

Analyze the output.txt and find entries like
\n“Block 1869273 is a directory. The block is Allocated” and find all inode associated with this block
\n5.Check content of the block with inode from previous step
\nEg: .\/ext3grep \/dev\/hda1 –ls –inode 656495
\n6.Now just restore the files you want using the right inode.
\nEg: .\/ext3grep \/dev\/hda1 –restore-inode 2263308<\/p>\n

If you require help, contact SupportPRO Server Admin<\/a><\/p>\n

\"Server<\/a><\/span>