Shulou(Shulou.com)06/01 Report--

This article shows you the Linux system to restore mistakenly deleted files what is the specific solution, the content is concise and easy to understand, absolutely can make your eyes bright, through the detailed introduction of this article, I hope you can get something.

Linux system does not have the mechanism of recycle bin like windows system. Is there really no way to reply when we accidentally use rm rf to delete files or directories?

The following examples illustrate the following two different ways to restore erroneous deletions:

Mistakenly delete file process is still there: this is generally an active process there is continuous standard input or output, when the file is deleted, the process PID still exists. This is why some servers delete some files but do not release the disk.

Open a terminal to append a test file with cat:

[root@docking] # echo "This is DeleteFile test." > deletefile.txt [root@docking ~] # ls deletefile.txt [root@docking ~] # cat > > deletefile.txt Add SomeLine into deletefile for fun. Open another terminal to view this file and you can see the contents clearly:

[root@docking] # ls deletefile.txt [root@docking ~] # cat deletefile.txt This is DeleteFile test. Add SomeLine into deletefile for fun. At this point, delete the file rm-f deletefile.txt

The [root@docking ~] # rm-f deletefile.txt [root@docking ~] # ls # command looks at this directory and the file no longer exists, so let's restore it now. Lsof checks to see if the deleted file process still exists.

If it is not installed, please yum install lsof or apt-get install lsof 1. In a case like this, we can first lsof to see if the deleted file is still there.

[root@docking] # lsof | grep deletefile cat 21796 root 1w REG 253 1.63 138860 / root/deletefile.txt (deleted) 2. Restore cp / proc/pid/fd/1 / specified directory / file name to enter the process directory. Generally, enter / proc/pid/fd/, according to the current situation:

[root@docking ~] # cd / proc/21796/fd [root@docking fd] # ll Total usage 0 lrwx- 1 root root 64 January 18 22:21 0-> / dev/pts/0 llywx-1 root root 64 January 18 22:21 1-> / root/deletefile.txt (deleted) lrwx- 1 root root 64 January 18 22:21 2-> / dev/pts/0 resume operation:

[root@docking fd] # cp 1 ~ / deletefile.txt.backup [root@docking fd] # cat ~ / deletefile.txt.backup This is DeleteFile test. Add SomeLine into deletefile for fun.3. Recovery complete.

The process of mistakenly deleted files no longer exists. Restore and prepare some file directories with the help of tools.

# prepare a mounted disk mkdir backuptest cd backuptest mkdir deletetest mkdir deletetest/innerfolder echo "Delete a folder test." > deletetest/innerfolder/deletefile.txt echo "tcpdump:x:172:72::/:/sbin/nologin" > tmppasswd. The final directory structure is as follows:

Taroballs@taroballs-PC:/media/taroballs/taroballs/backuptest$ cd.. Taroballs@taroballs-PC:/media/taroballs/taroballs$ tree backuptest/ backuptest/ ├── deletetest │ └── innerfolder │ └── deletefile.txt └── tmppasswd 2 directories, 2 files now starts to delete this directory rm-rf backuptest/

The total amount of taroballs@taroballs-PC:/media/taroballs/taroballs$ rm-rf backuptest/ taroballs@taroballs-PC:/media/taroballs/taroballs$ ls- l is 0, which is usually done without a daemon or continuously entered by the background process, so the deletion is really deleted. Lsof can't see it either, so you need to use a tool for recovery.

Now start the recovery of mistakenly deleted files.

The tool we use is the extundelete third-party tool. The recovery steps and considerations are as follows:

Stop doing anything on the current partition to prevent inode from being overwritten. Inode was overwritten and basically said goodbye to recovery.

To exaggerate, for example, stop the service of the partition, uninstall the device where the directory is located, and disconnect the network if necessary.

Backup the current partition through the dd command to prevent data loss caused by the failure of third-party software recovery.

Suitable for situations where data is very important, here is an example, so there is no backup. For example, backup can be considered in the following ways: dd if=/path/filename of=/dev/vdc1

Uninstall the current device partition through the umount command. Or the fuser command umount / dev/vdb1

If you prompt the device busy, you can use the fuser command to force uninstall: fuser-m-v-I-k. /

Download the third-party tool extundelete installation, search for mistakenly deleted files to restore

Extundelete tool installation

Extundelete download address: http://extundelete.sourceforge.net/

Wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 unzips the file tar jxvf extundelete-0.2.4.tar.bz2

If you report this kind of error

[root@docking ~] # tar jxvf extundelete-0.2.4.tar.bz2 tar (child): bzip2: cannot exec: without that file or directory tar (child): Error is not recoverable: exiting now tar: Child returned status 2 tar: Error is not recoverable: exiting now, use yum-y install bzip2 to solve the problem

[root@docking] # tar jxvf extundelete-0.2.4.tar.bz2 extundelete-0.2.4/ extundelete-0.2.4/acinclude.m4 extundelete-0.2.4/missing extundelete-0.2.4/autogen.sh extundelete-0.2.4/aclocal.m4 extundelete-0.2.4/configure extundelete-0.2.4/LICENSE extundelete-0.2.4/README... .. Cd extundelete-0.2.4. / configure if this step reports an error

[root@docking extundelete-0.2.4] #. / configure Configuring extundelete 0.2.4 configure: error: in `/ root/extundelete-0.2.4': configure: error: C++ compiler cannot create executables See `config.log' for more details uses yum-y install gcc-c++.

If you still report an error if you perform the previous step

[root@docking extundelete-0.2.4] #. / configure Configuring extundelete 0.2.4 configure: error: Can't find ext2fs library uses yum-y install e2fsprogs e2fsprogs-devel to solve. # the solution to Ubuntu is sudo apt-get install e2fslibs-dev e2fslibs-dev

If nothing happens, configure should be able to finish it here.

[root@docking extundelete-0.2.4] #. / configure Configuring extundelete 0.2.4 Writing generated files to disk [root@docking extundelete-0.2.4] # Last make and then make install

[root@docking extundelete-0.2.4] # make make-s all-recursive Making all in src extundelete.cc: in the function 'ext2_ino_t find_inode (ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)': extundelete.cc:1272:29: warning: convert 'search_flags' from' int' to narrower type 'ext2_ino_t {aka unsigned int}' [- Wnarrowing] buf, match_name2, priv, 0} within {} ^ [root@docking extundelete-0.2.4] # make install Making install in src / usr/bin/install-c extundelete'/ usr/local/bin'extundelete installation completed.

Scan for mistakenly deleted files:

Use df-lh to view the mount:

Taroballs@taroballs-PC:~$ df-lh file system capacity used available mount point udev 1.9G 0 1.9G 0 / dev tmpfs 387M 1.8m 385m 1% / run / dev/sda2 92G 61G 26G 71% / tmpfs 1.9G 49M 1.9G 3 / dev/shm tmpfs 5.0m 4.0K 5.0M1% / run/lock tmpfs 1.9G 0 1.9G 0% / sys/fs/cgroup / dev/sda3 104G 56G 44G 57% / home tmpfs 387M 40K 387m 1% / run/user/1000 / dev/sda4 70G 20G 47G 30% / media/taroballs/d8423f8c-d687-4c03-a7c8-06a7fb57f96d / dev/sdb1 6.8G 4.1g 2.8g 60% / media/taroballs/taroballs/ dev/sr0 4.0G 4.0G 0.0100% / media/taroballs/2018-01-16-12-36-00-00 taroballs@taroballs-PC:~$ cd / media/taroballs/taroballs/ taroballs@taroballs-PC:/media/taroballs/taroballs$ Our directory / media/taroballs/taroballs is mounted to the file system / dev/sdb1.

Umount our mount disk such as:

Taroballs@taroballs-PC:~$ df-lh | grep / dev/sdb1 / dev/sdb1 6.8g 4.1g 2.8g 60% / media/taroballs/taroballsumount this directory

Taroballs@taroballs-PC:~$ umount / media/taroballs/taroballs taroballs@taroballs-PC:~$ df-lh | grep / dev/sdb1 taroballs@taroballs-PC:~$ # remember to umount after deletion, otherwise no one can help you with the second write. Restore through inode nod

Taroballs@taroballs-PC:~$ mkdir recovertest taroballs@taroballs-PC:~$ cd recovertest/ taroballs@taroballs-PC:~/recovertest$ performs recovery extundelete / dev/sdb1-- inode 2

Taroballs@taroballs-PC:/media/taroballs/taroballs$ sudo extundelete / dev/sdb1-inode 2 NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Group: 0 Contents of inode 2:. . Omit N line File name | Inode number | Deleted status. 2.. 2 deletetest 12 Deleted tmppasswd 14 Deleted found the folder we deleted by scanning, and now perform a restore operation. (1) restore a single file tmppasswd

Taroballs@taroballs-PC:~/recovertest$ extundelete / dev/sdb1-restore-file passwd NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. The Successfully restored file tmppasswd recovery file is placed in the current directory RECOVERED_FILES. View the recovered files:

Taroballs@taroballs-PC:~/recovertest$ cat tmppasswd tcpdump:x:172:72::/:/sbin/nologin (2) restore directory deletetest

Extundelete / dev/sdb1-restore-directory deletetest NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Searching for recoverable inodes in directory deletetest... 5 recoverable inodes found. Looking through the directory structure for deleted files. (3) restore all

Taroballs@taroballs-PC:~/recovertest$ extundelete / dev/sdb1-restore-all NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Searching for recoverable inodes in directory /... 5 recoverable inodes found. Looking through the directory structure for deleted files... 0 recoverable inodes still lost. Taroballs@taroballs-PC:~/recovertest$ tree backuptest/ ├── deletetest │ └── innerfolder │ └── deletefile.txt └── tmppasswd 2 directories, 2 files (4) restore the specified inode

Taroballs@taroballs-PC:~/recovertest$ extundelete / dev/sdb1-restore-inode 14 NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Taroballs@taroballs-PC:~/recovertest$ cat file.14 tcpdump:x:172:72::/:/sbin/nologin # Note when restoring inode, the recovered file name is not the same as before, and needs to be renamed separately. Finally, the usage of extundelete is attached:

Extundelete-- helpUsage: extundelete [options] [- -] device-fileOptions:-- version,-[vV] Print version and exit successfully. -- help, Print this help and exit successfully. -- superblock Print contents of superblock in addition to the rest. If no action is specified then this option is implied. -- journal Show content of journal. -- after dtime Only process entries deleted on or after 'dtime'. -- before dtime Only process entries deleted before 'dtime'.Actions:-- inode ino Show info on inode' ino'. -- block blk Show info on block 'blk'. -- restore-inode ino [, ino,...] Restore the file (s) with known inode number 'ino'. The restored files are created in. / RECOVERED_FILES with their inode number as extension (ie, file.12345). -- restore-file 'path' Will restore file' path'. 'path' is relative to root of the partition and does not start with a' / 'The restored file is created in the current directory as' RECOVERED_FILES/path'. -- restore-files' path' Will restore files which are listed in the file 'path'. Each filename should be in the same format as an option to-restore-file, and there should be one per line. -- restore-directory 'path' Will restore directory' path'. 'path' is relative to the root directory of the file system. The restored directory is created in the output directory as' path'. -- restore-all Attempts to restore everything. -j journal Reads an external journal from the named file. -b blocknumber Uses the backup superblock at blocknumber when opening the file system. -B blocksize Uses blocksize as the blocksize when opening the file system. The number should be the number of bytes. -- log 0 Make the program silent. -- log filename Logs all messages to filename.--log D1 filename Custom control of log messages with comma-separated Examples below: list of options. Dn must be one of info, warn, or-log info,error error. Omission of the'= name' results in messages-- log warn=0 with the specified level to be logged to the console. -- log error=filename If the parameter is'= zero, logging for the specified level will be turned off. If the parameter is'= filename', messages with that level will be written to filename. -o directory Save the recovered files to the named directory. What are the versions of The restored files are created in a directory named 'RECOVERED_FILES/' by default.Linux? the versions of Linux are Deepin, UbuntuKylin, Manjaro, LinuxMint, Ubuntu and so on. Among them, Deepin is one of the best-developed Linux distributions in China; UbuntuKylin is a derivative release based on Ubuntu; Manjaro is a Linux release based on Arch; LinuxMint's default Cinnamon desktop is similar to Windows XP's easy-to-use; Ubuntu is the Linux operating system based on desktop applications.

The above content is what is the specific solution for Linux system to restore mistakenly deleted files? have you learned the knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.