Shulou(Shulou.com)06/02 Report--

Preface: inode (file node) and block (data block) hard link and soft connection restore mistakenly deleted files (that is, the operation of rm-rf, you can first perform backup operations, and then you can restore both ext4 and xfs file systems) classified user logs and program logs 1: inode and block Overview 1.1 Overview of file data including meta-information and actual data files stored on the hard disk The smallest storage unit of a hard disk is "sector". Each sector stores 512 bytes of block (block) eight consecutive sectors to form a block, and one block unit is 4k is the smallest unit of file access inode (index node) Chinese translation "index node", also known as I node to store file meta-information

Meta information > inode

Data > block

A file must occupy one inode, but at least one block

For a disk, the physical level of a unit is represented by a sector.

At the logical level of ​, the representation of a cell is a cell.

Deleting a file deletes a file name instead of block and inode, and a file name corresponds to an inode;. When a new file is rewritten to disk and overwritten to the block of the deleted file, it means that the file is actually deleted. So when deleting a file by mistake, the first thing is not to write the file on disk again. It is possible to find the deleted file through data recovery.

1.2 contents of inode

Inode contains the meta information of the file

The number of bytes of the file the owner (owner) of the UID file GID file read and write execution permissions file timestamp note: does not include the file name with the stat command to view the inode information of a file; ls-I can also view the inode number example: stat aa.txt

Three main time attributes of file timestamp in linux system

Ctime (change time): time when the file or directory was last changed (attribute is inode) atime (access time): time when the file or directory was last accessed mtime (modify time): time when the file or directory was last modified (content is block)

The structure of the directory file

A directory is also a structure of a file directory file. A file name corresponds to an inode number, two fields form a line, and a line is called a directory entry.

Each inode has a number, and the operating system uses inode numbers to identify different files

File names are not used internally in the linux system, but inode numbers are used to identify files

For the user, the file name is just an alias for the inode number to be easily identified, that is, the inode number for the system to identify the file and the file name for the user to identify the file.

1.3 the user opens the file through the file name, and the system executes the process internally

When a user opens a file with a file name, the process steps within the system (this process is more important):

1. The system finds the corresponding inode number 2. Get the inode information through the inode number, that is, meta-information 3. According to the inode information, find the block where the file data is located, read the data and view the inode number ls-I command: view the inode number corresponding to the file name ls-I AA.txtstat command: view the file inode information The information contains the inode number stat AA.txt [root@localhost ~] # cd / opt [root@localhost opt] # lsrh [root@localhost opt] # touch abc.txt [root@localhost opt] # vim abc.txt [root@localhost opt] # ls-I 'View Meta Information' 35889299 abc.txt 1420654 rh [root@localhost opt] # stat abc.txt''View File details File: "abc.txt" size: 13: 8 IO block: 4096 ordinary file device: fd00h/64768d Inode:35889299 hard link: 1 permission: (0644Universe: Uid: (0 / root) Gid: (0 / root) Environment: unconfined_u:object_r:usr_t:s0 recent visit: 2019-11-16 1717VV 53.373111661 + 0800 recent changes: 2019-11-16 1757RV 53.373111661 + 0800 recently modified: 2019-11-16 17 Inode 57 dev/mapper/centos-root 53.375111659 + 0800 creation time:-[root@localhost opt] # mount-I 'View mount point meta-information' file system Inode is available (I) used (I)% mount point / dev/mapper/centos-root 10485760 10360463,2% / devtmpfs 250006 386 2496201 1% / devtmpfs 253986 1 253985 1 per cent / dev/shmtmpfs 253986 620 253366 1 per cent / runtmpfs 253986 16 253970 1 per cent / sys/fs/cgroup/dev/sda1 3145728 328 3145400 1 per cent / boot/dev/mapper/centos-home 5242880 286 5242594 1 / hometmpfs 253986 9 253977 1 per cent / run/user/42tmpfs 253986 16 253970 1 per cent / run/user/0/dev/sr0 2000-/ run/media/root/CentOS 7 x86_64tmpfs 253986 16 253970 per cent / run/user/1000//192.168.254.10/linuxs 000-/ aaa

In a sense, innode can represent how many files there are.

The principle of overall data recovery: that is, when the file name is mistakenly deleted, scan the inode and block information directly

1.4 inode size inode also consumes hard disk space, the size of each inode, generally 128byte or 256byte format the file system to determine the total number of inode using the df-I command you can see the total number of inode per hard disk partition and the number of used 1.5 inode special function due to the separation of inode numbers and file names, some Unix/Linux systems have the following phenomena when the file name contains special characters It may not be possible to delete the file normally, delete the inode directly, or delete the file when moving or renaming the file, only change the file name, without affecting the inode number. After opening a file, the system recognizes the file by the inode number. Do not consider file name 1.6 link file establish link file type soft link (symbolic link) hard link delete the original file (that is, the file name) is still available applicable to the file or directory can only be used for file save location and the original file can be located in a different file system must be in the same file system as the original file system (xfs system, or ext4, etc.) Such as a Linux partition hard link command ln source file destination location soft connection command ln-s source file or directory.. Link file or target location-s that is softII, file recovery 2.1 restore EXT type file compilation installation extundelete package installation dependency package e2fsprogs-libs-1.41.12-18.el6.x86_64.rpme2fsprogs-devel-1.41.12-18.el6.x86_64.rpm configuration, compilation and installation extundelete-0.2.4.tar.bz2 simulation delete and perform restore operation

The extundelete package can only be used in centos-6 or centos-5 because the default file system type for centos-6 is ext4,centos-5 and the default file type is ext3

2.2 restore files of type XFS xfsdump command format xfsdump- f backup location path or device file xfsdump backup level (default is 0) 0: full backup 1-9: incremental backup xfsdump common options: xfsdump-- helpxfsdump-- help xfsdump: version 3.1.4 (dump format 3.0) xfsdump: version 3.1.4 (dump format 3.0) xfsdump: usage: xfsdump [- a ( Dump DMF dualstate files as offline)] xfsdump: usage: xfsdump [- (dump DMF dual status file is offline)] [- b] [- b] [- c] [- c] [- d] [- d] [- e (allow files to be excluded)] [- e (allow files to be excluded)] [- f. [- f...] [- h (help)] [- h (help)] [- l] [- l] [- m (force usage of minimal rmt)] [- m (minimum rmt use of force)] [- o (overwrite tape)] [- o (overwrite tape)] [- p] [- p]

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.