|
|
dump/restore of a fs with 100 of millions hardlinks
|
|
EXT3GREP(8) recover files on ext3 filesystems EXT3GREP(8) NAME
ext3grep - ext3 file recovery tool SYNOPSIS
ext3grep [OPTIONS] FILE ... DESCRIPTION
ext3grep is a simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem, only to find that they wanted it shortly thereafter. OPTIONS
--superblock Print contents of superblock in addition to the rest. If no action is specified then this option is implied. --print Print contents of block or inode, if any. --ls Print directories, one line per entry. See the FILTERS section for details on filtering this output. --accept FILE Accepts 'file' as a legal filename. Can be used multiple times. If you change any --accept you must remove BOTH stage* files! --journal Prints the contents of the journal. --show-path-inodes Show the inode of each directory component in paths. Filters: --group gid Only show/process files owned by process group gid. --directory Only show/process process directory inodes. --after dtime Only show/process entries deleted on or after dtime. --before dtime Only show/process entries deleted before dtime. --deleted Only show/process deleted entries. --allocated Only show/process allocated inodes/blocks. --unallocated Only show/process unallocated inodes/blocks. --reallocated Do not suppress entries with reallocated inodes. Inodes are considered 'reallocated' if the entry is deleted but the inode is allo- cated, but also when the file type in the dir entry and the inode are different. --zeroed-inodes Do not suppress entries with zeroed inodes. Linked entries are always shown, regardless of this option. --depth depth Process directories recursively up till a depth of 'depth'. Actions: --inode-to-block inode_num Print the block that contains inode inode_num. --inode inode_num Show info on inode inode_num. If --ls is used and the inode is a directory, then the filters apply to the entries of the directory. If you do not use --ls then --print is implied. --block block_num Show info on block block_num. If --ls is used and the block is the first block of a directory, then the filters apply to entries of the directory. If you do not use --ls then --print is implied. --histogram=[atime|ctime|mtime|dtime|group] Generate a histogram based on the given specs. Using atime, ctime or mtime will change the meaning of --after and --before to those times. --journal-block block_num Show info on journal block block_num. --journal-transaction seq Show info on transaction with sequence number seq. --dump-names Write the paths of files to stdout. This implies --ls but suppresses its output. --search-start str Find blocks that start with the fixed string str. --search str Find blocks that contain the fixed string str. --search-inode block_num Find inodes that refer to block block_num. --search-zeroed-inodes Return allocated inode table entries that are zeroed. --inode-dirblock-table dir Print a table for directory path dir of directory block numbers found and the inodes used for each file. --show-journal-inodes inode_num Show copies of inode inode_num still in the journal. --restore-file path Will restore file path. path is relative to root of the partition and does not start with a '/' (it must be one of the paths returned by --dump-names). The restored directory, file or symbolic link is created in the current directory as ./path. --restore-all As --restore-file but attempts to restore everything. The use of --after is highly recommended because the attempt to restore very old files will only result in them being hard linked to a more recently deleted file and as such pollute the output. --show-hardlinks Show all inodes that are shared by two or more files. --version, -[vV] Prints the version information and exits. --help, Prints a help message and exits. EXAMPLES
Restoring all files from the ext3 partition/file /backup/sda1: ext3grep --restore-all /backup/sda1 Listing the files owned by GID 1000 on /backup/sda1: ext3grep --ls --group 1000 /backup/sda1 Finding all files containing the string Critical_report in their name on /backup/sda1: ext3grep --dump-names /backup/sda1 | grep 'Critical_report' LIMITATIONS
Do not attempt to use ext3grep for recovery from a mounted filesystem. Ever. No, not even then. ext3grep sometimes runs out of memory spare on 32-bit architectures and crashes. It is highly recommended that you run ext3grep in a 64-bit environment when dealing with large filesystems, though this is seen as a bug. ext3grep cannot recover files if there are no remnants of them. Some files that ext3grep recovers may have trailing null bytes - just scrape them off like the burnt bits on toast. SEE ALSO
debugfs(8) AUTHOR
ext3grep was written by Carlo Wood <carlo@alinoe.com>. This manual page was written by Rich Ercolani <rercola@acm.jhu.edu>, for the Debian project (but may be used by others). It may be distrib- uted under the same terms as ext3grep, the GNU General Public License, either version 2 or (at your option) any later version. 0.8.0 2008-09-14 EXT3GREP(8)
