Shulou(Shulou.com)06/01 Report--

This article introduces how to analyze the deletion of files under Open Suse. The content is very detailed. Interested friends can use it for reference. I hope it will be helpful to you.

Open Suse is still quite commonly used, so I studied Open Suse and took it out here to share with you. I hope it will be useful to you. As a multi-user and multi-task operating system, once the files under Open Suse are deleted, it is difficult to recover. Although the delete command only marks the deletion in the file node and does not really erase the contents of the file, other users and some processes with write disk actions will quickly overwrite this data. However, for the family stand-alone use of Open Suse, or mistakenly deleted files after the timely remedy, or can be restored.

1. A brief introduction to the structure of Ext2 file system

In the Ext2 file system used by Linux, files are stored in blocks. By default, the size of each block is 1K, and different blocks are distinguished by block numbers. Each file also has a node, which contains information about the file owner, read and write permissions, file type, and so on. For a file with less than 12 blocks, the block number of the file block is stored directly in the node. If the file is larger than 12 blocks, the node stores the block number of an indirect block after 12 block numbers, and the block number corresponding to this indirect block number stores the block number of 256 file blocks (each block number in Ext2fs takes up 4 bytes, so the block number that can be stored in one block is 1024max 4x256). If there is a larger file, secondary indirect blocks and tertiary indirect blocks will also appear in the node.

2. The method of restoring the deleted files by mistake

Most Linux distributions provide a debugfs tool that you can use to edit the Ext2 file system. However, there is still some work to be done before using this tool.

First of all, re-mount the partition of the mistakenly deleted file in a read-only manner. Use the following command: (assuming the file is in the / usr partition)

Mount?Cr?Cn?Coremount/usr

-r means to mount read-only;-n means not to write to / etc/mtab. If you are restoring files on / etc, add this parameter. If the system says xxxpartionbusy, you can use the fuser command to see which processes are using this partition? n:

Fuser?Cv?Cm/usr

If there are no important processes, stop them with the following command:

Fuser-k?Cv?Cm/usr

These file systems can then be remounted.

If all files are installed in a large / partition, you can use linuxsingle to enter single-user mode at the boot prompt to minimize the chances of the system process writing data to the hard disk, or simply hang the hard drive on another machine. In addition, the recovered data should not be written on / above to avoid destroying the useful data. If you have dos/windows on your machine, you can write it on these partitions:

Mount?Cr?Cn/dev/hda1/mnt/had

Then you can execute debugfs: (assuming Linux is in / dev/hda5)

# debugfs/dev/hda5

The debugfs prompt debugfs appears:

Use the lsdel command to list information about many deleted files:

The following is the referenced content:

Debugfs:lsdel

Debugfs:2692deletedinodesfound.

InodeOwnerModeSizeBlocksTimedeleted

164821010060081921/1SunMay1319:22:462001

36137010064441/1TueApr2410:11:152001

196829010064414950038/38MonMay2713:52:042001

Debugfs:

On how to analyze the deletion of files under Open Suse to share here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.