Skip to content


AIX:Odzyskanie plików ze skasowanego katalogu

Ten post dedykuję moim dzieciom: Tomkowi, Hani i Małgosi.

Poprzednio pokazałem jak jest możliwe odzyskanie w AIX skasowanego pliku. Obecny post pokazuje jak odzyskać pliki ze skasowanego katalogu. W tym przypadku musimy pierw zidentyfikować położenie wymazanego katalogu, po czym przesuwając się to tej inode lokalizujemy przebywające w nim „wymazane” foldery i przywracamy je do życia zmieniając wartość parametru [5] di_nlink: z 0 na 1.

Może ktoś kto czyta ten post pracuje z poleceniem fsdb jako ”software developer” i może się ze mną skontaktować? Mam kilka pytań o użytkowaniu. Mam nadzieję, że ten materiał komuś się przyda – jeszcze raz; wczoraj były 40 urodziny „UNIXa”.

MarcoPolo:/mark>ls -Ri
32 dir1 4 dir3
64 dir2 3 lost+found

./dir1:
33 inittab 35 resolv.conf
34 netsvc.conf

./dir2:
65 5300-08-03-0831_enqtorap1
66 CheckMirrors.ksh
67 ChkPrim.ksh
68 MakeSnapVG.ksh
69 RunSnapBackup.ksh
70 SplitVg.ksh
71 SplitVgBackup.ksh
72 chhome
73 dead.letter
74 duszyk@entorap1
75 enqorap1
76 inove.1.2.3.zip
77 lsvpcfg
78 nmap.3.78.tar
79 nohup.out
80 screen-3.9.10-2.aix4.3.ppc.rpm
81 sleepy
82 smit.script
83 smit.transaction
84 systems_p_advantages_ha_downloads_printserver.tar
85 top10
86 top10.txt
87 vioscan.ksh
88 wmd
89 wmd.log

./dir3:
5 hosts

./lost+found:
MarcoPolo:/mark>
MarcoPolo:/mark>rm -rf ./dir1
MarcoPolo:/mark>cd /
MarcoPolo:/>umount /mark
MarcoPolo:/>fsdb /mark
File System: /mark
File System Size: 648784 (512 byte blocks)
Aggregate Block Size: 4096
Allocation Group Size: 8192 (aggregate blocks)
>
i 2
Inode 2 at block 35, offset 0x400:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 2 [19] di_gen: 1
[3] di_size: 0x0000000000000100 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000000 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 5 [22] di_ixpxd.addr2: 0x00000023
[6] di_mode: 0x000141ed di_ixpxd.address: 35
0040755 drwxr-xr-x [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x1a7f1912 [26] di_atime.tj_sec:0x000000004a8eb6c3
[10] di_ctime.tj_nsec: 0x063f9d16 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x063f9d16 [28] di_mtime.tj_sec:0x000000004a8eb6e7
[12] di_otime.tj_nsec: 0x00000000 [29] di_otime.tj_sec:0x000000004a8eb67c
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it >
x


> display 35 a
Block: 35 Real Address 0x23000
….......
000004ca: 00000000 00000000 00000000 00000000 |................|
000004da: 00000000 00000000 00000000 00020000 |................|
000004ea: 00000000 00008303 05020000 00000304 |................|
000004fa: 01010000 00000000 00000000 0003FF0A |................|
-hit enter for more-
0000050a: 6C6F7374 2B666F75 6E640000 00000000 |lost+found......|
0000051a: 00000000 00000501 00000000 0020FF04 |............. ..|
0000052a: 64697231 00000000 00000000 00000000 |dir1............|
0000053a: 00000000 00000000 00000000 0040FF04 |.............@..|
0000054a: 64697232 00000000 00000000 00000000 |dir2............|
0000055a: 00000000 00000000 00000000 0004FF04 |................|
0000056a: 64697233 00000000 00000000 00000000 |dir3............|
0000057a: 00000000 00000601 00000000 00000000 |................|
0000058a: 00000000 00000000 00000000 00000000 |................|
0000059a: 00000000 00000701 00000000 00000000 |................|
000005aa: 00000000 00000000 00000000 00000000 |................|

zamień 20hex to 32dec

000005ea: 00000000 00000000 00000000 00000000 |................|
000005fa: 00000000 00000000 00000000 00030000 |................|
-hit enter for more-
> i 32
Inode 32 at block 44, offset 0x0:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 32 [19] di_gen: 3062024408
[3] di_size: 0x0000000000000100 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000000 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000141ed di_ixpxd.address: 44
0040755 drwxr-xr-x [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x063f9d17 [26] di_atime.tj_sec:0x000000004a8eb6e7
[10] di_ctime.tj_nsec: 0x063f9d19 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x063f9d18 [28] di_mtime.tj_sec:0x000000004a8eb6e7
[12] di_otime.tj_nsec: 0x1e0f739f [29] di_otime.tj_sec:0x000000004a8eb68c
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it >
x
> display 44 a

Szukaj wymazanych plików

000000da: 00000000 00000000 00000000 00020000 |................|
000000ea: 00000000 00008300 08010000 00000303 |................|
000000fa: 03000000 00000201 00000000 0021FF07 |.............!..|
-hit enter for more-
0000010a: 696E6974 74616200 00000000 00000000 |inittab.........|
0000011a: 00000000 00000301 00000000 0022FF0B |............."..|
0000012a: 6E657473 76632E63 6F6E6600 00000000 |netsvc.conf.....|
0000013a: 00000000 00000400 00000000 0023FF0B |.............#..|
0000014a: 7265736F 6C762E63 6F6E6600 00000000 |resolv.conf.....|
0000015a: 00000000 00000500 00000000 00000000 |................|
0000016a: 00000000 00000000 00000000 00000000 |................|

Tak jak to pokazałem w poprzednim poście, odzyskaj skasowane pliki

hex dec
21 33
22 34
23 35


000000ea: 00000000 00008300 08010000 00000303 |................|
000000fa: 03000000 00000201 00000000 0021FF07 |.............!..|
-hit enter for more-
0000010a: 696E6974 74616200 00000000 00000000 |inittab.........|
0000011a: 00000000 00000301 00000000 0022FF0B |............."..|
0000012a: 6E657473 76632E63 6F6E6600 00000000 |netsvc.conf.....|
0000013a: 00000000 00000400 00000000 0023FF0B |.............#..|
0000014a: 7265736F 6C762E63 6F6E6600 00000000 |resolv.conf.....|
0000015a: 00000000 00000500 00000000 00000000 |................|
0000016a: 00000000 00000000 00000000 00000000 |................|
0000017a: 00000000 00000600 00000000 00000000 |................|
0000018a: 00000000 00000000 00000000 00000000 |................|
0000019a: 00000000 00000700 00000000 00000000 |................|
000001aa: 00000000 00000000 00000000 00000000 |................|
000001ba: 00000000 00000800 00000000 00000000 |................|
000001ca: 00000000 00000000 00000000 00000000 |................|
000001da: 00000000 0000FF00 00000000 00000000 |................|
000001ea: 00000000 00000000 00000000 00000000 |................|
000001fa: 00000000 00000000 00000000 0021B682 |.............!..|
-hit enter for more-
> i 34
Inode 34 at block 44, offset 0x400:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 34 [19] di_gen: 3062024412
[3] di_size: 0x0000000000001270 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000002 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000081a4 di_ixpxd.address: 44
0100644 -rw-r--r-- [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x2b2c61fb [26] di_atime.tj_sec:0x000000004a8eb694
[10] di_ctime.tj_nsec: 0x063f9d16 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x2bc4ffe6 [28] di_mtime.tj_sec:0x000000004a8eb694
[12] di_otime.tj_nsec: 0x2b2c61fb [29] di_otime.tj_sec:0x000000004a8eb694
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > m
Please enter: field-number value > 5 1
Inode 34 at block 44, offset 0x400:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 34 [19] di_gen: 3062024412
[3] di_size: 0x0000000000001270 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000002 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 1 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000081a4 di_ixpxd.address: 44
0100644 -rw-r--r-- [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x2b2c61fb [26] di_atime.tj_sec:0x000000004a8eb694
[10] di_ctime.tj_nsec: 0x063f9d16 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x2bc4ffe6 [28] di_mtime.tj_sec:0x000000004a8eb694
[12] di_otime.tj_nsec: 0x2b2c61fb [29] di_otime.tj_sec:0x000000004a8eb694
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > t
[1] flag 0x83 BT_ROOT BT_LEAF
[2] nextindex 3
[3] maxentry 18
[4] self.len 0
[5] self.addr1 0x00
[6] self.addr2 0x00000000
self.address 0
[7] next 0x0
[8] prev 0x0
xtree: Hit enter to see entries, [h]ex dump, [u]p, [m]odify, [n]ext, [p]rev, or e[x]it: n
No next entry.
[1] flag 0x83 BT_ROOT BT_LEAF
[2] nextindex 3
[3] maxentry 18
[4] self.len 0
[5] self.addr1 0x00
[6] self.addr2 0x00000000
self.address 0
[7] next 0x0
[8] prev 0x0
xtree: Hit enter to see entries, [h]ex dump, [u]p, [m]odify, [n]ext, [p]rev, or e[x]it: x
> i 32
Inode 32 at block 44, offset 0x0:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 32 [19] di_gen: 3062024408
[3] di_size: 0x0000000000000100 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000000 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000141ed di_ixpxd.address: 44
0040755 drwxr-xr-x [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x063f9d17 [26] di_atime.tj_sec:0x000000004a8eb6e7
[10] di_ctime.tj_nsec: 0x063f9d19 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x063f9d18 [28] di_mtime.tj_sec:0x000000004a8eb6e7
[12] di_otime.tj_nsec: 0x1e0f739f [29] di_otime.tj_sec:0x000000004a8eb68c
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > x
> display 44 a
Block: 44 Real Address 0x2c000
0000000a: C8D80000 00104A8E B67C0000 00000000 |......J..|......|
0000001a: 04000000 002C0000 00000000 01000000 |.....,..........|
0000002a: 00000000 00000000 00000000 00000000 |................|
0000003a: 00000001 41ED0000 00004A8E B6E7063F |....A.....J....?|
0000004a: 9D170000 00000000 00004A8E B6E7063F |..........J....?|
0000005a: 9D190000 00000000 00004A8E B6E7063F |..........J....?|
0000006a: 9D180000 00000000 00004A8E B68C1E0F |..........J.....|
0000007a: 739F0000 00000000 00000000 00000000 |s...............|
0000008a: 00000000 00000000 36000001 3CCA0000 |........6...< ...|
0000009a: 00020000 00320000 00020000 00000000 |.....2..........|
000000aa: 00000000 00000000 00000000 00000000 |................|
000000ba: 00000000 00000000 00000000 00000000 |................|
000000ca: 00000000 00000000 00000000 00000000 |................|
000000da: 00000000 00000000 00000000 00020000 |................|
000000ea: 00000000 00008300 08010000 00000303 |................|
000000fa: 03000000 00000201 00000000 0021FF07 |.............!..|
-hit enter for more-
0000010a: 696E6974 74616200 00000000 00000000 |inittab.........|
0000011a: 00000000 00000301 00000000 0022FF0B |............."..|
0000012a: 6E657473 76632E63 6F6E6600 00000000 |netsvc.conf.....|
0000013a: 00000000 00000400 00000000 0023FF0B |.............#..|
0000014a: 7265736F 6C762E63 6F6E6600 00000000 |resolv.conf.....|
0000015a: 00000000 00000500 00000000 00000000 |................|
0000016a: 00000000 00000000 00000000 00000000 |................|
0000017a: 00000000 00000600 00000000 00000000 |................|
0000018a: 00000000 00000000 00000000 00000000 |................|
0000019a: 00000000 00000700 00000000 00000000 |................|
000001aa: 00000000 00000000 00000000 00000000 |................|
000001ba: 00000000 00000800 00000000 00000000 |................|
000001ca: 00000000 00000000 00000000 00000000 |................|
000001da: 00000000 0000FF00 00000000 00000000 |................|
000001ea: 00000000 00000000 00000000 00000000 |................|
000001fa: 00000000 00000000 00000000 0021B682 |.............!..|
-hit enter for more-
> i 35
Inode 35 at block 44, offset 0x600:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 35 [19] di_gen: 3062024413
[3] di_size: 0x0000000000000073 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 0 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000081a4 di_ixpxd.address: 44
0100644 -rw-r--r-- [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x1223b295 [26] di_atime.tj_sec:0x000000004a8eb69a
[10] di_ctime.tj_nsec: 0x063f9d16 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x1223b296 [28] di_mtime.tj_sec:0x000000004a8eb69a
[12] di_otime.tj_nsec: 0x1223b295 [29] di_otime.tj_sec:0x000000004a8eb69a
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > m
Please enter: field-number value > 5 1
Inode 35 at block 44, offset 0x600:
[1] di_fileset: 16 [18] di_inostamp: 0x4a8eb67c
[2] di_number: 35 [19] di_gen: 3062024413
[3] di_size: 0x0000000000000073 [20] di_ixpxd.len: 4
[4] di_nblocks: 0x0000000000000001 [21] di_ixpxd.addr1: 0x00
[5] di_nlink: 1 [22] di_ixpxd.addr2: 0x0000002c
[6] di_mode: 0x000081a4 di_ixpxd.address: 44
0100644 -rw-r--r-- [24] di_uid: 0
[25] di_gid: 0
[9] di_atime.tj_nsec: 0x1223b295 [26] di_atime.tj_sec:0x000000004a8eb69a
[10] di_ctime.tj_nsec: 0x063f9d16 [27] di_ctime.tj_sec:0x000000004a8eb6e7
[11] di_mtime.tj_nsec: 0x1223b296 [28] di_mtime.tj_sec:0x000000004a8eb69a
[12] di_otime.tj_nsec: 0x1223b295 [29] di_otime.tj_sec:0x000000004a8eb69a
[13] di_ea.flag: 0x00 [30] di_ea.len: 0
EAv1 [31] di_ea.addr1: 0x00
[15] di_ea.nEntry: 0x00 [32] di_ea.addr2: 0x00000000
[16] di_ea.type: 0x0000 di_ea.address: 0
[34] di_ea.nblocks: 0
change_inode: [m]odify, [e]a, [t]ree, or e[x]it > t
[1] flag 0x83 BT_ROOT BT_LEAF
[2] nextindex 3
[3] maxentry 18
[4] self.len 0
[5] self.addr1 0x00
[6] self.addr2 0x00000000
self.address 0
[7] next 0x0
[8] prev 0x0
xtree: Hit enter to see entries, [h]ex dump, [u]p, [m]odify, [n]ext, [p]rev, or e[x]it: m
Please enter: field-number value >
xtree: Hit enter to see entries, [h]ex dump, [u]p, [m]odify, [n]ext, [p]rev, or e[x]it: p
No next entry.
[1] flag 0x83 BT_ROOT BT_LEAF
[2] nextindex 3
[3] maxentry 18
[4] self.len 0
[5] self.addr1 0x00
[6] self.addr2 0x00000000
self.address 0
[7] next 0x0
[8] prev 0x0
xtree: Hit enter to see entries, [h]ex dump, [u]p, [m]odify, [n]ext, [p]rev, or e[x]it: x
>q

MarcoPolo:/>
MarcoPolo:/>fsck /dev/mark_lv
The current volume is: /dev/mark_lv
Primary superblock is valid.
J2_LOGREDO:log redo processing for /dev/mark_lv
Primary superblock is valid.
*** Phase 1 - Initial inode scan
*** Phase 2 - Process remaining directories
*** Phase 3 - Process remaining files
*** Phase 4 - Check and repair inode allocation map
File system inode map is corrupt; FIX? yes
Superblock marked dirty because repairs are about to be written.
*** Phase 5 - Check and repair block allocation map
Block allocation map is corrupt; FIX? yes
Inodes not connected to the root directory
tree have been detected. Will reconnect.
File system is clean.
Superblock is marked dirty; FIX? yes
All observed inconsistencies have been repaired.
MarcoPolo:/>mount /mark
MarcoPolo:/>cd /mark/lost*
MarcoPolo:/mark/lost+found>ls -la
total 32
drwxr-xr-x 2 root system 256 Aug 21 11:00 .
drwxr-xr-x 5 root system 256 Aug 21 11:01 ..
-rw-r--r-- 1 root system 3331 Aug 21 11:00 33
-rw-r--r-- 1 root system 4720 Aug 21 11:00 34
-rw-r--r-- 1 root system 115 Aug 21 11:00 35
MarcoPolo:/mark/lost+found>

W tym momencie, wydaj mkdir do odtworzenia skasowanego katalogu po czym cat nazwaPliku w celu określenia jego zawartości i tym samym nazwy (?), i w końcu używając mv filename katalog przesuń plik do katalogu.

Możesz odzyskać skasowany katalog w ten sam sposób jak odzyskuje się wymazane pliki. Ten katalog będzie odtworzony w lost+found pod takim samym imieniem jak jego inode – czy robi to sens jeżeli to samo można osiągnąć używając do tego celu mkdir

Posted in Real life AIX.

Tagged with , , , , , , , , , , , , .


0 Responses

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.



Some HTML is OK

or, reply to this post via trackback.

WordPress Anti Spam by WP-SpamShield



Copyright © 2016 - 2017 Waldemar Mark Duszyk. All Rights Reserved. Created by Blog Copyright.