江淼的Blog

就在1小时前，不小心删除了linux的一个文件夹，里面有5个php文件。网上google下。

Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best. (出自 http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html )

开发人员都这么说了，一时找不到北。突然灵感一现，若我直接从硬盘中搜索再复制，文件不多只有5个，且都是文本文件，可能有用。我立刻从网上下了个winhex，winhex是我用到现在最好的hex文件编辑器，看了看那个硬盘文件debian.vdi，不大只有3.9G。

我想，这几个文件都是这两天新建的，那么逆向搜索应该更有效。于是回忆每个文件中的几个函数名function xxx( 逆向搜，发现了不少残本。也不管新旧，都复制过来。就这么不一会，5个文件都原原本本的找了回来。

真是有惊无险。