Shulou(Shulou.com)06/02 Report--

Hello, everyone. I'm history. As a liunx system administrator, do you often use rm commands? Have you ever felt speechless after making a rm command?

Let's see the lesson of my blood!

If you really feel that the egg hurts, you want to cry without tears! After writing the results for a whole day, I wanted to delete the files I had backed up before, but I deleted what I had just written.

There is such a rule in the famous foreign linx administrator code: "be careful with the rm-rf command, unless you know what the consequences of this command will be." It can be seen that the importance of this order, ah, the sentence seen in the book is indeed very correct.

Having said so, teach everyone to do this after the implementation of the rm command, there is a way to reply, I just confirmed that google has an open source package called ext3grep tool, he can reply deleted files, and even drop database xcy;, that is, mistakenly deleted databases can be replied.

First talk about how he works, and then I am sharing the experiment with you, the working principle is not difficult, this tool needs to be implemented on ext3 or ext4 file system, because ext3 file system is a log file system, ext3 file system stores information by inode number and block block.

What? Don't know what the inode is? And block blocks? Well, in the explanation point, for example: a partition such as a book, then the block block is the content of each page of the book, and the inode number is the book's directory. When the system looks for files, find the inode number first and then find the block fast information on the hard disk according to the inode number. See?

Let's talk about the principle of deletion. When a file on the hard disk is deleted, it is not erased on the hard disk as it really thought. He disconnected the chain of the inode number and the block block, but the real data is still on the hard disk. Do you feel that deleting on the windos is so fast? do you not think about it? when you re-copy the new file where you delete the file, you will overwrite the previous file. In other words, it doesn't matter if you delete it, don't put the file in that location.

Source package download location: http://down.51cto.com/data/709491

When the principle is over, let's start the actual combat.

Environment introduction: system version: CentOS release 5.4 (Final)

1 check whether the package is available before installation: rpm-qa | grep e2fsprogs

2 ext4grep is a source code package, which needs to be compiled and installed

Check to see if the e2fsprogs package is complete, but mine is a-devel package, so first yum install e2fsprogs * I've been lazy.

Decompress ext3 source code packet

Enter the source package, and then start checking the integrity of the package execution:. / configure if there is an error at the end of the process, then check to see if your e2fsprogs-devel is missing

In the process of make & & make install (compilation, compilation and installation), there is usually no problem here. If there is a mistake here, check whether your system is missing gcc gcc-c++. You can install all the packages of yum install gcc*.

Wait for the complete completion, after the installation is finished. You can first check whether one has been completed successfully, and use the: ext3grep-v command to view the version information of ext3 as follows:

Of course, if you don't know how to use the command, you can enter: ext3grep-- help view

Then I need to manually create a partition, create the command: fdisk / dev/sda this because there is no way to save all the images I display directly after the creation is complete. If you don't know how to create it, you can check out my linx basic commands (file system section).

Then format the partition y in ext3 partition format and mount it to the mnt directory.

Then I went into the mounted directory, created the xcy directory, copied the / etc/passwrd and / etc/my.cnf files into the / mnt/xcy directory, and renamed the two files for my identification. Finally, I executed rm-rf / xcy/* to delete all the files in the xcy file.

Ahem, then the first thing I do is uninstall the mounted partition, because I am afraid that someone will touch my folder and copy something in it, I will not be able to recover it. I will execute: ext3grep / dev/sda5-- ls-- inode 2 to explain to you.

Ext3grep deletes the partition of the file-- ls-- innode inode number

Why do we write 2 in the end because I don't know the inode number of my deleted file, all I write is the largest inode / inode number can be used: ls-id / view

After the execution, you will see that he is brushing to help you find the deleted files.

Keep going, scan to the end, the inode number of the folder we want to know is 2099, and then we continue to execute the scanning command: ext3grep / dev/sda5/-- ls-- lnode 2009, he will scan all the files in the xcy directory (including the inode number of deleted or not deleted files), and then we can sweep it. The my.cnf.xcy innode number is 2011 and the inode number of the passwd.xcy file is 2010.

Now that our goal is about to be achieved, knowing the inode numbers of the two files can be restored.

Then we execute ext3grep / dev/sda5-- restore-inode 2011 (restore the my.cnf.xcy file)

We are executing ext3grep / dev/sda5-- restore-inode 2010 (restore passwrd.xcy files)

Then we mount the unmounted file system again.

Restored, the file will not be in the original location, he will automatically create a directory called RESTORED_FILES under /, all the recovered files will be saved here in the future, and the name of the file is named after the inode number. You need to manually modify the original name, don't be afraid not to know which file is that, remember us-- when ls scanned, he had the corresponding file and inode number.

File recovery, is not very excited, ah, to solve the liunx can not restore the problem, so that you can greatly save costs do not need to find hard disk recovery tools do not need to spend money, by the way, this can also restore the mysql database misoperation delete the database or tables can restore the principle, in fact, is to restore the corresponding mysql database files, try it yourself

By the way, I circled it in the screenshot is the correct command, many others have operation errors, because after all, the first experiment. I'm glad to be successful. I hope I can help my friends who have the same experience.

Finally, a summary of shortcomings: my experiment found that there are some shortcomings in this feature:

1 the condition must be the ext3 ext4 journaling file system to do it, but I don't know anything else.

2 this is my own partition / dev/sda5, that is to say, I know that the deleted file is on that partition, if you delete the file and know where it is in the partition, then you need to try it all from sda1. SdaN.

If you have any questions, you can leave a message and contact me. I can help you solve it.

The author's words:-> this article can also be reached in 51cto, yes, that is me, but also my original, the future transfer to the database industry, intend to be resident in this forum, I carry forward the original, this is not plagiarism!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.