Shulou(Shulou.com)06/01 Report--

This article focuses on "how to restore deleted files in Linux". Interested friends may wish to have a look at it. The method introduced in this paper is simple, fast and practical. Let's let the editor take you to learn how to restore deleted files in Linux.

In many cases, deleted files can be restored, such as when the file has an active process operating on it and is currently being used by single or multiple users. In a Linux system, every currently running process gets an ID, which is called the process identifier "PID", and stores them in the / proc directory. This is exactly what we need to restore deleted files in a process that is still running (with PID). This is how we do this.

Suppose you open a compressed file, and then you delete it. For demonstration purposes, the compressed file is called "opengapps.zip", which will be the file we will open and delete later.

Calculate the MD5 hash of the original file

We will calculate the MD5 of the file before deleting it. This allows us to compare the original MD5 hash with the MD5 hash of the recovered file. This process will ensure that the integrity of the compressed file we recovered is the same and that it is not broken.

Md5sum opengapps.zip > > md5-opengapps.txt

To display the contents of the text file.

Cat md5-opengapps.txt 86489b68b40d144f0e00a0ea8407f7c0 opengapps.zip

After checking the MD5 hash value of the compressed file. We keep the compressed file open (LCTT translation: here the decompressor using the file-roller graphical interface keeps the compressed file open, which is built into the GNOME environment; in the desktop environment, using desktop tools to open a compressed package can also have the same effect. In addition, the example in this article is not appropriate, if you delete an open configuration file for a service process, then this recovery makes sense) and delete it. After that, we will start with the recovery process of the file, as follows:

Rm opengapps.zip

The recovery process of deleting files

As we mentioned earlier, the running process is in the / proc directory. We can search for the required processes in this directory using the following command:

Since we already know that the file name includes the .zip extension, we can use the .zip extension to search. It restricts the output and displays the required processes.

Ps-axu | grep .zip m 13119 0.8 1.0 121788 30788? Sl 06:17 0:00 file-roller / home/m/Downloads/Compressed/opengapps.zip m 13164 0.0 5108 832 pts/20 S+ 06:18 0:00 grep-- color=auto .zip

Then we will go to the directory that contains PID 13119 and open the fd subdirectory.

Cd / proc/13119/fd

The fd (file descriptor) directory contains multiple files, including the files we need to recover. The file is hard-linked to the original file. All files in the fd directory are digitally linked to the File name. So to determine which of these files is linked to the original file, we will list the / fd directory with the detailed list option.

Ls-l total 0 lr-x- 1 mm 64 Jul 14 06:17 0-> / dev/null lrwx- 1 mm 64 Jul 14 06:17 1-> socket: [26161] lrwx- 1 mm 64 Jul 14 06:17 10-> anon_inode: [eventfd] lr-x- 1 mm 64 Jul 14 06:17 11-> anon_inode:inotify lrwx- 1 mm 64 Jul 14 06 : 17 12-> socket: [5752671] lr-x- 1 mm 64 Jul 14 06:17 13-> / home/m/Downloads/Compressed/opengapps.zip (deleted) lrwx- 1 mm 64 Jul 14 06:17 2-> socket: [26161] lrwx- 1 mm 64 Jul 14 06:17 3-> anon_inode: [eventfd] lrwx- 1 mm 64 Jul 14 06:17 4-> anon_inode: [ Eventfd] lrwx- 1 mm 64 Jul 14 06:17 5-> socket: [5751361] lrwx- 1 mm 64 Jul 14 06:17 6-> anon_inode: [eventfd] lrwx- 1 mm 64 Jul 14 06:17 7-> anon_inode: [eventfd] lrwx- 1 m 64 Jul 14 06:17 8-> socket: [5751363] lrwx- 1 m 64 Jul 14 06:17 9-> socket: [5751365]

As you can see in the terminal output, the original file "opengapps.zip" has been deleted, but it is still linked to a file name 13, its process PID 13119. However, we can still restore the linked file by copying it to a safe place.

Cp 13 / home/m/Downloads/Compressed

After the file is copied. We will return to the directory that contains the recovery file and rename it using the following command.

Mv 13 opengapps-recovered.zip

Calculate the MD5 hash of the recovered file

Since we have recovered the file. Let's check the integrity of the file, just to make sure that the file is not corrupted and remains the same. Earlier we saved the MD5 hash value of the original file.

Md5sum opengapps-recovered.zip > > md5-opengapps.txt

This command checks the MD5 hash value of the file and appends the MD5 hash value of the newly recovered file to the file to easily compare the two MD5 hash values.

You can display the contents of a text file to compare the MD5 hash values of the original file and the recovered file.

Cat md5-opengapps.txt 86489b68b40d144f0e00a0ea8407f7c0 opengapps.zip 86489b68b40d144f0e00a0ea8407f7c0 opengapps-recovered.zip

The MD5 hash for the recovery file is the same. Therefore, we successfully recovered the files we deleted before, and the integrity of the files was consistent and worked properly after the restore.

Note: in some cases, some files cannot be seen through the ps-axu command. So, try to check the running program and recover the files from it.

Suppose we have a video with the .avi extension in the Totem media player. All you need to do is check the PID of Totem and follow the same instructions mentioned in this example.

To find the PID of a running program, use the following command, followed by the name of the program.

The name of the pidof program has come to this. I believe you have a deeper understanding of "how to restore deleted files in Linux". You might as well do it in practice. Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.