1、extundelete
http://zhumeng8337797.blog.163.com/blog/static/100768914201212354523149/
[root@yznvm1 yzn]# df
文件系统 1K-块 已用 可用 已用% 挂载点
/dev/sda3 18129292 2651744 14541764 16% /
/dev/sda1 194442 12197 172206 7% /boot
tmpfs 254804 0 254804 0% /dev/shm
/dev/hdc 4149676 4149676 0 100% /mnt/cdrom
[root@yznvm1 yzn]# extundelete /dev/sda3 --restore-file /home/yzn/helloworld/Makefile.am
WARNING: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 143 groups loaded.
Loading journal descriptors ... 29535 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Restored inode 4223596 to file RECOVERED_FILES/home/yzn/helloworld/Makefile.am
ok,这样就恢复成功了。
2、ntfsundelete
http://pbraun.nethence.com/unix/filesystems/ntfsundelete.html
NTFS undelete from a Linux system
Requirements
Make sure you've got ntfsundelete available,
Note. it comes with ntfs-3g
Usage
Unmount the volume,
Look for fully recoverable files, then for last two monthes only,
Either undelete the precise files you need,
all the fully recoverable files, for last two monthes, ending with the mp3 extension,
all the fully recoverable files, for last two monthes, for last two monthes,
References
http://www.tuxera.com/community/ntfs-3g-download/