Shulou(Shulou.com)06/01 Report--

This article introduces the relevant knowledge of "how to restore mistakenly deleted content in Linux". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

The situation in which the process of mistakenly deleting files is still there.

This is generally the existence of continuous standard input or output in an active process, and the process PID still exists after the file is deleted. This is why some servers delete some files but do not release the disk. For example, the current example is:

Do cat append to a test file through a shell terminal:

[root@21yunwei_backup ~] # echo "hello py" > testdelete.py [root @ 21yunwei_backup ~] # cat > > testdelete.py hello delete

Another terminal looks at this file and you can see the contents clearly:

[root@21yunwei_backup ~] # cat testdelete.py hello pyhello delete

At this point, delete the file rm-f. / testdelete.py on the current server

Command to check this directory, the file no longer exists, so now we will restore it.

1Jing lsof to see if the deleted file process still exists. Here is a command lsof, if not installed, please yum or apt-get. In a case like this, we can first lsof to see if the deleted file is still there:

[root@21yunwei_backup ~] # lsof | grep deletedmysqld 1512 mysql 5u REG 252 3 6312397 / tmp/ibzW3Lot (deleted) cat 20464 root 1w REG 252 3 23 1310722 / root/testdelete.py (deleted)

Fortunately, the process of this situation still exists, so the restore operation begins.

2, recovery.

Restore command:

Cp / proc/pid/fd/1 / specify directory / file name

Enter the process directory and generally enter / proc/pid/fd/, according to the current situation:

[root@21yunwei_backup ~] # cd / proc/20464/ FD [root @ 21yunwei_backup fd] # lltotal 0lrwxx-1 root root 64 Nov 15 18:12 0 > / dev/pts/1l-wx- 1 root root 64 Nov 15 18:12 1 > / root/testdelete.py (deleted) lrwx- 1 root root 64 Nov 15 18:12 2 > / dev/pts/1

Restore operation:

Cp 1 / tmp/testdelete.py

View the file:

[root@21yunwei_backup fd] # cat / tmp/testdelete.pyhello pyhello delete

Recovery complete.

The process of mistakenly deleted files no longer exists. Restore with the help of tools.

Create a directory to delete and echo a file with contents:

[root@21yunwei_backup 21yunwei] # tree. ├── deletetest │ └── mail │ └── test.py ├── └── passwd 3 directories, 2 Files [root @ 21yunwei_backup 21yunwei] # cat / 21yunwei/deletetest/mail/test.py hello DJ [root @ 21yunwei_backup 21yunwei] # tail-2 passwd haproxy:x:500:502::/home/haproxy:/bin/bashtcpdump:x:72:72::/:/sbin/nologin

Perform the delete operation:

[root@21yunwei_backup 21yunwei] # rm-rf. / * [root@21yunwei_backup 21yunwei] # lltotal 0

Now start the recovery of mistakenly deleted files. In this case, there is usually no daemon or continuous input by the background process, so the deletion is deleted and cannot be seen by the lsof. With the help of tools. The tool we use here is the extundelete third-party tool. The recovery steps are as follows:

1. Stop doing anything to the current partition to prevent inode from being overwritten. The inode basically said goodbye to the bike when it was covered. For example, stop the service of the partition, uninstall the device where the directory is located, and disconnect the network if necessary.

2. Backup the current partition through the dd command to prevent data loss caused by the failure of third-party software recovery. It is suitable for situations where data is very important. If you test here, there will be no backup. For example, you can consider the following ways:

Dd if=/path/filename of=/dev/vdc1

3, uninstall the current device partition through the umount command. Or the fuser command.

Umount / dev/vdb1 or umount / 21yunwei

If you prompt the device busy, you can use the fuser command to force uninstall: fuser-m-v-I-k / 21yunwei

4. Download the third-party tool extundelete to install, search for mistakenly deleted files and restore them.

Wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2tar jxvf extundelete-0.2.4.tar.bz2cd extundelete-0.2.4./configure makemake install

Scan for mistakenly deleted files:

[root@21yunwei_backup extundelete-0.2.4] # extundelete--inode 2 / dev/vdb1NOTICE: Extended attributes are not restored.Loading filesystem metadata... 8 groups loaded.Group: 0Contents of inode 2:.. Omit N line File name | Inode number | Deleted status. 2.. 2lost+found 11 Deleteddeletetest 12 Deletedpasswd 14 Deleted

The folder we deleted was found through the scan, and the restore operation is now performed.

(1) restore a single file passwd

[root@21yunwei_backup /] # extundelete / dev/vdb1-- restore-file passwd NOTICE: Extended attributes are not restored.Loading filesystem metadata... 8 groups loaded.Loading journal descriptors... 46 descriptors loaded.Successfully restored file passwd

The recovery file is placed in the current directory RECOVERED_FILES.

View the recovered files:

[root@21yunwei_backup /] # tail-5 RECOVERED_FILES/passwd mysql:x:497:500::/home/mysql:/bin/falsenginx:x:496:501::/home/nginx:/sbin/nologinzabbix:x:495:497:Zabbix Monitoring System:/var/lib/zabbix:/sbin/nologinhaproxy:x:500:502::/home/haproxy:/bin/bashtcpdump:x:72:72::/:/sbin/nologin

(2) restore directory deletetest

[root@21yunwei_backup /] # extundelete / dev/vdb1-- restore-directory deletetest NOTICE: Extended attributes are not restored.Loading filesystem metadata... 8 groups loaded.Loading journal descriptors... 46 descriptors loaded.Searching for recoverable inodes in directory deletetest... 5 recoverable inodes found.Looking through the directory structure for deleted files. [root@21yunwei_backup /] # cat RECOVERED_FILES/deletetest/mail/test.py hello Dj

(3) restore all

[root@21yunwei_backup /] # extundelete / dev/vdb1-- restore-allNOTICE: Extended attributes are not restored.Loading filesystem metadata... 8 groups loaded.Loading journal descriptors... 46 descriptors loaded.Searching for recoverable inodes in directory /... 5 recoverable inodes found.Looking through the directory structure for deleted files... 0 recoverable inodes still lost. [root@21yunwei_backup /] # cd RECOVERED_FILES/ [root @ 21yunwei_backup RECOVERED_FILES] # tree. ├── deletetest │ └── passwd 2 directories, 2 files

(4) restore the specified inode.

[root@21yunwei_backup /] # extundelete / dev/vdb1-- restore-inode 14NOTICE: Extended attributes are not restored.Loading filesystem metadata... 8 groups loaded.Loading journal descriptors... 46 descriptors loaded.[ root @ 21yunwei_backup /] # tail-5 / RECOVERED_FILES/file.14 mysql:x:497:500::/home/mysql:/bin/falsenginx:x:496:501::/home/nginx:/sbin/nologinzabbix:x:495:497:Zabbix Monitoring System:/var/lib/ Zabbix:/sbin/nologinhaproxy:x:500:502::/home/haproxy:/bin/bashtcpdump:x:72:72::/:/sbin/nologin

Note that when restoring inode, the recovered file name is not the same as before and needs to be renamed separately. There is no problem with the content.

This is the end of the introduction of "how to restore mistakenly deleted content by Linux". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.