Shulou(Shulou.com)06/02 Report--

In this issue, Xiaobian will bring you about what is the recovery method for Linux system error deletion files. The article is rich in content and analyzes and narrates from a professional perspective. After reading this article, I hope you can gain something.

background information

In daily use, data is sometimes deleted by mistake. How to recover data quickly and effectively? There are many ways to recover data on Alibaba Cloud, such as:

Rollback created snapshots, restore custom mirrors, etc. through ECS Management Console.

Purchase multiple ECS to achieve Load Balancer and High Availability for your business.

Under Linux, there are many data recovery tools based on open source, such as debugfs, R-Linux, ext3grep, extundelete, etc., and ext3grep and extundelete are more commonly used. The recovery principle of these two tools is basically the same, but the function of extundelete is more powerful. When using Alibaba Cloud's Cloud Virtual Machine, if you accidentally delete data, and Linux system does not have similar functions as Recycle Bin under Windows system, you can easily install extundelete tool quickly.

The extundelete tool can use inode information in conjunction with logs to query the block location of the inode to find and recover the required data. One of the most powerful points of this tool is that it supports ext3/ext4 dual-format partition recovery, and the recovery function based on the entire disk is more powerful.

After data is deleted by mistake, the first thing to do is unmount the disk or disk partition where the deleted data is located. Because after deleting the file, only the sector pointer in the inode node of the file is cleared, and the actual file is still stored on the disk, if the disk is mounted in read-write mode, the data blocks of these deleted files may be redistributed by the operating system, and after these data blocks are overwritten by new data, the data deleted by mistake cannot be recovered. Therefore, mounting the disk in read-only mode minimizes the risk of overwriting the data in the data block and improves the probability of successful recovery of the data.

Note: In the actual online recovery process, do not install extundelete to the hard disk where the file you deleted by mistake is located, so there is a certain chance that the data to be recovered will be completely overwritten. Remember to make a snapshot backup before the operation.

This tutorial applies to:

Users who delete files from disk by mistake and have not written to disk

Users with low website traffic and few ECS instances

Software and version to be installed: e2fsprogs-devel, e2fsprogs, gcc-c++, make (compiler, etc.), Extendelete-0.2.4.

extundelete requires liext 2fs version 1.39 or later to run, but for ext4 support, make sure you have e2fsprogs version 1.41 or later (you can do this by running the command dumpe2fs and logging the version of its output).

The above version is the software version at the time of writing the document. The version you downloaded may be different.

operation steps

The steps to quickly recover deleted data using Extendelete are as follows:

Step 1: Deploy the extundelete tool

Run the following command to deploy the extundelete tool:

wget http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2yum -y install bzip2 e2fsprogs-devel e2fsprogs gcc-c++ make #install dependencies and libraries tar -xvjf extundelete-0.2.4.tar.bz2cd extundelete-0.2.4 #Enter program directory./ configure #As shown below, the installation is successful

make && make install At this time, the src directory will appear. Under this directory, there is an extundelete executable file and the corresponding path. In fact, the default file installation path is usr/local/bin. The following simulated operation to recover data after deletion is carried out under the usr/local/bin directory.

Step 2: Use extundelete to simulate the recovery process after data deletion

Complete the following operations to simulate the recovery process after accidental deletion using extundelete:

Check ECS for existing disks and available partitions and partition and format/dev/vdb.

fdisk -l

Mount the partitioned disk to/zhuyun directory, and then create a new test file hello under/zhuyun, and write the content test.

mkdir /zhuyun The requested URL/dev/was not found on this server. #Mount the disk to zhuyun directory echo test > hello #Write test file

Record the md5 value of the file hello. The md5sum command generates and verifies the md5 values of both files before deletion and after recovery.

md5sum hello

Simulate deleting hello files.

rm -rf hellocd ~fuser -k /zhuyun #End the process tree using a partition (skip this step if you are sure there are no resources)

Unload the data disk.

umount /dev/vdb1 #Any file recovery tool must be uninstalled or mounted as read-only before use to prevent data from being overwritten

Recover files using extundelete tool.

extundelete --inode 2 /dev/vdb1 #In order to find the contents of a certain i node, use 2 to describe the search for the entire partition. If you need to enter the directory search, just specify the directory I node. This is where you can see deleted filenames and inode

/usr/local/bin/extundelete --restore-inode 12 /dev/vdb1 #Recover deleted files

At this point, the RECOVERED_FILES directory appears in the sibling directory where the command was executed.

View the md5 value of the recovered RECOVERED_FILES file with the md5sum command.

md5sum RECOVERED_FILES

Check whether the md5 values of hello before deletion and RECOVERED_FILES after recovery are consistent. If they are consistent, data recovery is successful.

The above is what is the recovery method of the Linux system mistakenly deleted files shared by everyone. If there is a similar doubt, please refer to the above analysis for understanding. If you want to know more about it, please pay attention to the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.