Shulou(Shulou.com)06/01 Report--

This article mainly introduces "how to restore Linux system mistakenly deleted files". In daily operation, I believe many people have doubts about how to restore Linux system mistakenly deleted files. The editor consulted all kinds of materials and sorted out simple and easy-to-use methods of operation. I hope it will be helpful to answer the doubts of "how to restore Linux system mistakenly deleted files". Next, please follow the editor to study!

Preface

No matter in which system, deleting files must be done with caution.

Because if you accidentally delete important documents, it will lead to significant losses to individuals or companies.

Similar to the windows system mistakenly deleted files, you can use some software to restore operations. Linux also has several software that can be deleted and restored by mistake.

Note: although there is software that can recover the mistakenly deleted data, the probability of fully recovering the data is not 100%.

Therefore, you must be careful when using the rm command to delete files; important data must be backed up; and before restoring deleted data, new things cannot be stored in the directory of deleted files, otherwise the overwritten information cannot be recovered.

The following is the recovery operation for mistakenly deleted files in Linux.

1 、 lsof

Principle:

This command cannot actually be used to restore files directly, but it can list the file information opened by various processes.

With other commands, restore the file that the file has been deleted but the process remains open from the information in the / proc directory.

The / proc directory is mounted is an area mapped in memory, and when we read and write to these files, we are actually getting the relevant information from memory.

Therefore, when we read or write to a file (that is, when a process is using the file), even if the file on the hard disk has been deleted, the file can be recovered from the information in memory.

Note:

It must be run with the privileges of the root user, because lsof requires access to core memory and various files.

Only files that have been deleted but the process remains open can only be restored.

If the directory is deleted by mistake, other files in the directory are not opened by the process, and files that are not in use will not be recovered using this method.

The significance of lsof output information:

The PID (process identifier) of the COMMAND process USER process owner FD is used to identify the file (file descriptor) DEVICE specifies the name of the disk the size of the SIZE file NODE index node (identification of the file on disk) the exact name of the NAME open file

Most commonly used parameters:

-c shows files opened by a process now-p shows which files are opened by a pid process-g shows processes belonging to a gid-d shows files opened by a process in a directory-d shows processes opened by a process using fd 4-ifd 80 shows processes with port 80 open

Restore file operation

Environment:

There are some files under / mnt, one of which train.less is being viewed, and then another terminal deletes it

[1] lsof View

View the process number that is using to delete the file

Lsof / mnt

[2] restore

Switch to / proc and delete the directory in the file descriptor under the pid of the process corresponding to the file; redirect or cp the corresponding content to another file

Focus on: PID and FD

Cd / proc/31284/fd/ cat 4 > / mnt/ferris_train.less

2 、 extundelete

Principle:

Using the information stored in the partition log, try to recover files that have been deleted from the partition of ext3 or ext4

Advantages:

Compared with ext3grep, which can only restore files of ext3 file system, it has a wider scope of application and faster recovery speed.

Official address of extundelete (official document):

Http://extundelete.sourceforge.net

Download address of extundelete:

Http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

(the latest version of extundelete is 0.2.4, released in January 2013)

Note:

After the data is deleted, uninstall the disk or partition where the deleted data is located

If the system root partition is deleted by mistake, it is necessary to enter single-user mode and mount the root partition as read-only to avoid data overwriting as much as possible.

The data cannot be recovered after being overwritten.

Recovery still has a certain probability of failure, usually important data should be backed up, careful use of rm

Installation

1. Dependent installation

Centos installation operation yum install e2fsprogs-devel e2fsprogs * gcc* ubuntu installation operation apt-get install build-essential e2fslibs-dev e2fslibs-dev

2. Compile and install

Wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar xf extundelete-0.2.4.tar.bz2 cd extundelete-0.2.4. / configure make make install

Cd / root/extundelete-0.2.4/src

Extundelete-v

Executing the make command generates the extundelete executable in the src directory, where you can directly execute the restore command.

Executing make install will install the program under / usr/local/bin/

Restore file operation

The current directory where the extundelete command is executed must be writable.

1. View the file system of the partition on which you want to restore files

Df-Th

2. Unmount the partition to recover the file

Umount / mnt

3. View the data that can be recovered

Specify the partition of the mistakenly deleted file to look up

The last column of files marked Deleted is the deleted file.

Extundelete / dev/vdb1-- inode 2 (the inode value of the root partition is 2)

4. Restore a single directory

Specify the directory name to restore

If the directory is empty, it will not be restored

Extundelete / dev/vdb1-- restore-directory ferris

When you execute the command to restore files, the RECOVERED_FILES directory is generated in the current directory where the command was executed, and the recovered files are placed in this directory. If no directory is generated, it is a failure.

5. Restore a single file

Specify the file name to restore

If a few k-sized small files, there is a good chance that the recovery will fail.

Extundelete / dev/vdb1-- restore-file openssh-7.7p1.tar.gz

6. Restore all deleted files

Restore all deleted data without specifying a file or directory name

Extundelete / dev/vdb1-- restore-all

At this point, on the "Linux system mistakenly deleted files how to restore" on the end of the study, I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.