这里用ext4做个例子
# create ext4 fs and copy some files there fallocate -l 16m ext4.img
losetup -f --show ext4.img
mkfs -t ext4 /dev/loop0
mount /dev/loop0 /mnt/ext4
cp /mnt/ext4/ SYNc
# delete some files rm /mnt/ext4/*
# umount the ext4 fs, this is important! umount /dev/loop0
# make a copy of the fs dd if=/dev/loop0 of=ext4-copy.img bs=4k
# run ext4magic on the image ext4magic -m -d outputdir ext4-copy.img
# some sample output from the command eguan@localhost:~/workspace/src/kernel$
sudo /home/eguan/bin/ext4
magic -m ext4.img -d testdir
Warning: Activate magic-scan or disaster-recovery function, may be some command line options igNored "testdir" accept for recoverdir Filesystem in use: ext4.img Using internal Journal at Inode 8 Activ Time after : Sun Jun 7 22:43:54 2015 Activ Time before : Sun Jun 7 23:02:18 2015 Inode 2 is allocated Unknown code ext2 45
#0 for block bitmap for ext4.img Warning: error-NR 2133571363
can not found file: / MAGIC-1 : start lost directory search MAGIC-2 : start lost file search
-------- testdir/MAGIC-2/image/jpeg/I_0000000012.jpg
-------- testdir/MAGIC-2/image/jpeg/I_0000000013.jpg
-------- testdir/MAGIC-2/image/jpeg/I_0000000014.jpg
MAGIC-2 : start lost in journal search MAGIC-3 :
start ext4-magic-scan search ext4magic : EXIT_SUCCESS
评论