⑴开始工作之前，我们先来制作一个分区，然后来做试验
⑵［rootlocalhost bin］# mkdir /tmp/test
⑶［rootlocalhost bin］# dd if=/dev/zero of=file count=
⑷［rootlocalhost bin］#mkfs.ext file
⑸######按Y继续
⑹［rootlocalhost bin］#mount -o loop /tmp/test/file /mnt
⑺看一下有没有挂上
⑻［rootlocalhost bin］# df -HT
⑼Filesystem Type Size Used Avail Use% Mounted on
⑽/dev/mapper/VolGroup-LogVol
⑾ext G .G G % /
⑿/dev/sda ext M M M % /boot
⒀tmpfs tmpfs M M % /dev/shm
⒁/tmp/test/file
⒂ext M .M M % /mnt
⒃然后写入数据到里面
⒄［rootlocalhost bin］#cd /mnt
⒅［rootlocalhost bin］#ls
⒆lost+found
⒇［rootlocalhost mnt］# mkdir del
⒈［rootlocalhost mnt］# cd del
⒉［rootlocalhost del］# touch
⒊［rootlocalhost del］# ls
⒋ lost+found
⒌［rootlocalhost del］# cd 。。
⒍［rootlocalhost mnt］#rf -rf del
⒎［rootlocalhost bin］#ls
⒏lost+found
⒐［rootlocalhost mnt］#cd /usr/local/extgrep/bin
⒑［rootlocalhost bin］# 。/extgrep /tmp/test/file --ls --inode
⒒Running extgrep version ..
⒓Number of groups：
⒔Loading group metadata.。。 done
⒕Minimum / maximum journal block： /
⒖Loading journal descriptors.。。 sorting.。。 done
⒗The oldest inode block that is still in the journal， appears to be from = Wed Sep ::
⒘Number of descriptors in journal： ; min / max sequence numbers： /
⒙Inode is Allocated
⒚Finding all blocks that might be directories.
⒛D： block containing directory start， d： block containing more directory entries.
①Each plus represents a directory start that references the same inode as a directory start that we found previously.
②Searching group ： DD++D++
③Searching group ：
④Searching group ：
⑤Searching group ：
⑥Searching group ：
⑦Searching group ：
⑧Searching group ：
⑨Writing analysis so far to ’file.extgrep.stage‘。 Delete that file if you want to do this stage again.
⑩Result of stage one：
Ⅰ inodes are referenced by one or more directory blocks， of those inodes are still allocated.
Ⅱ inodes are referenced by more than one directory block， of those inodes is still allocated.
Ⅲ blocks contain an extended directory.
ⅣResult of stage two：
Ⅴ of those inodes could be resolved because they are still allocated.
ⅥAll directory inodes are aounted for！
ⅦWriting analysis so far to ’file.extgrep.stage‘。 Delete that file if you want to do this stage again.
ⅧThe first block of the directory is .
ⅨInode is directory “”。
ⅩDirectory block ：
㈠。-- File type in dir_entry （r=regular file， d=directory， l=symlink
㈡| 。-- D： Deleted ; R： Reallocated
㈢Indx Next | Inode | Deletion time Mode File name
㈣==========+==========+----------------data-from-inode------+-----------+=========
㈤ d drwxr-xr-x 。
㈥ d drwxr-xr-x 。。
㈦ end d drwx------ lost+found
㈧ r D Wed Sep :: rrw-r--r--
㈨ r D Wed Sep :: rrw-r--r--
㈩ r D Wed Sep :: rrw-r--r--
end d D Wed Sep :: drwxr-xr-x del
［rootlocalhost bin］# 。/extgrep /tmp/test/file --restore-file del --depth del
Running extgrep version ..
Number of groups：
Minimum / maximum journal block： /
Loading journal descriptors.。。 sorting.。。 done
The oldest inode block that is still in the journal， appears to be from = Wed Sep ::
Number of descriptors in journal： ; min / max sequence numbers： /
Writing output to directory RESTORED_FILES/
Loading file.extgrep.stage.。。 done
下面开始恢复文件
［rootlocalhost bin］# 。/extgrep /tmp/test/file --restore-all
Running extgrep version ..
Number of groups：
Minimum / maximum journal block： /
Loading journal descriptors.。。 sorting.。。 done
The oldest inode block that is still in the journal， appears to be from = Wed Sep ::
Number of descriptors in journal： ; min / max sequence numbers： /
Loading file.extgrep.stage.。。 done
Restoring
Restoring
Restoring
Restoring del/
Restoring del/
Restoring del/
这个命令是恢复所有的，当然也可以恢复指定文件的。
可以看到在当前目录下，多了一个目录
［rootlocalhost bin］# ls
RESTORED_FILES extgrep
［rootlocalhost bin］# cd RESTORED_FILES/
［rootlocalhost RESTORED_FILES］# ls
del lost+found
上面就是Linux使用extgrep恢复文件的方法介绍了，通过本文的介绍可以看出，extgrep不仅能够恢复所有被删除的文件，还能恢复指定的文件。