Shulou(Shulou.com)06/01 Report--

This article mainly introduces "how to restore mistakenly deleted files or directories on Linux". In daily operation, I believe many people have doubts about how to restore mistakenly deleted files or directories on Linux. Xiaobian consulted all kinds of materials and sorted out simple and easy-to-use methods of operation. I hope it will be helpful to answer the questions of "how to restore mistakenly deleted files or directories on Linux". Next, please follow the editor to study!

Linux doesn't have a conspicuous recycle bin like windows, so it's not just a simple restore. Linux delete file restore can be divided into two cases, one is deleted after the existence of delete information in the process, the other is deleted after the process can not be found, only with the help of tools to restore, here respectively check the introduction.

First, the situation where the process of mistakenly deleting files is still there.

This is generally the existence of continuous standard input or output in an active process, and the process PID still exists after the file is deleted. This is why some servers delete some files but do not release the disk. For example, the current example is to append cat to a test file through a shell terminal:

[root@21yunwei_backup ~] # echo "hello py" > testdelete.py [root@21yunwei_backup ~] # cat > > testdelete.py hello delete

Another terminal looks at this file and you can see the contents clearly:

[root@21yunwei_backup ~] # cat testdelete.py hello py hello delete

At this point, delete the file rm-f. / testdelete.py on the current server

Command to check this directory, the file no longer exists, so now we will restore it.

1. Lsof to see if the deleted file process still exists.

Here is a command lsof, if not installed, please yum or apt-get. In a case like this, we can first lsof to see if the deleted file is still there:

[root@21yunwei_backup ~] # lsof | grep deleted mysqld 1512 mysql 5u REG 252 3 6312397 / tmp/ibzW3Lot (deleted) cat 20464 root 1w REG 252 3 23 1310722 / root/testdelete.py (deleted)

Fortunately, the process of this situation still exists, so the restore operation begins.

two。 Restore.

Restore command:

Cp / proc/pid/fd/1 / specify directory / file name

Enter the process directory and generally enter / proc/pid/fd/, according to the current situation:

[root@21yunwei_backup ~] # cd / proc/20464/fd [root@21yunwei_backup fd] # ll total 0 lrwx- 1 root root 64 Nov 15 18:12 0 > / dev/pts/1 lmurwx-1 root root 64 Nov 15 18:12 1 > / root/testdelete.py (deleted) lrwx- 1 root root 64 Nov 15 18:12 2 > / dev/pts/1

Restore operation:

Cp 1 / tmp/testdelete.py

View the file:

[root@21yunwei_backup fd] # cat / tmp/testdelete.py hello py hello delete

Recovery complete.

Second, the process of mistakenly deleted files no longer exists and can be restored with the help of tools.

Create a directory to delete and echo a file with contents:

[root@21yunwei_backup 21yunwei] # tree. ├── deletetest │ └── mail │ └── test.py ├── lost+found └── passwd 3 directories, 2 files [root@21yunwei_backup 21yunwei] # cat / 21yunwei/deletetest/mail/test.py hello Dj [root@21yunwei_backup 21yunwei] # tail-2 passwd haproxy:x:500:502::/home/haproxy:/bin/bash tcpdump:x:72:72::/:/sbin/nologin

Perform the delete operation:

[root@21yunwei_backup 21yunwei] # rm-rf. / * [root@21yunwei_backup 21yunwei] # ll total 0

Now start the recovery of mistakenly deleted files. In this case, there is usually no daemon or background process continuously entering it, so the deletion is deleted and the lsof cannot see it. With the help of tools. The tool we use here is the extundelete third-party tool. The recovery steps are as follows:

1. Stop doing anything on the current partition to prevent inode from being overwritten. Inode was overwritten and basically said goodbye to recovery. For example, stop the service of the partition, uninstall the device where the directory is located, and disconnect the network if necessary.

two。 Backup the current partition through the dd command to prevent data loss caused by the failure of third-party software recovery. It is suitable for situations where data is very important. If you test here, there will be no backup. For example, you can consider the following ways:

Dd if=/path/filename of=/dev/vdc1

3. Uninstall the current device partition through the umount command. Or the fuser command.

Umount / dev/vdb1

Or

Umount / 21yunwei

If you prompt the device busy, you can use the fuser command to force the uninstall:

Fuser-m-v-I-k / 21yunwei

4. Download the third-party tool extundelete installation, search for mistakenly deleted files to restore.

Wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar jxvf extundelete-0.2.4.tar.bz2 cd extundelete-0.2.4. / configure make make install

Scan for mistakenly deleted files:

[root@21yunwei_backup extundelete-0.2.4] # extundelete--inode 2 / dev/vdb1 NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Group: 0 Contents of inode 2:. . Omit N line File name | Inode number | Deleted status. 2.. 2 lost+found 11 Deleted deletetest 12 Deleted passwd 14 Deleted

The folder we deleted was found through the scan, and the restore operation is now performed.

1. Restore a single file passwd

[root@21yunwei_backup /] # extundelete / dev/vdb1-restore-file passwd NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Successfully restored file passwd

The recovery file is placed in the current directory RECOVERED_FILES. View the recovered files:

[root@21yunwei_backup /] # tail-5 RECOVERED_FILES/passwd mysql:x:497:500::/home/mysql:/bin/false nginx:x:496:501::/home/nginx:/sbin/nologin zabbix:x:495:497:Zabbix Monitoring System:/var/lib/zabbix:/sbin/nologin haproxy:x:500:502::/home/haproxy:/bin/bash tcpdump:x:72:72::/:/sbin/nologin

two。 Restore directory deletetest

[root@21yunwei_backup /] # extundelete / dev/vdb1-restore-directory deletetest NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Searching for recoverable inodes in directory deletetest... 5 recoverable inodes found. Looking through the directory structure for deleted files... [root@21yunwei_backup /] # cat RECOVERED_FILES/deletetest/mail/test.py hello Dj

3. Restore all

[root@21yunwei_backup /] # extundelete / dev/vdb1-restore-all NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. Searching for recoverable inodes in directory /... 5 recoverable inodes found. Looking through the directory structure for deleted files... 0 recoverable inodes still lost. [root@21yunwei_backup /] # cd RECOVERED_FILES/ [root@21yunwei_backup RECOVERED_FILES] # tree. ├── deletetest │ └── mail │ └── test.py └── passwd 2 directories, 2 files

4. Restores the specified inode

[root@21yunwei_backup /] # extundelete / dev/vdb1-restore-inode 14 NOTICE: Extended attributes are not restored. Loading filesystem metadata... 8 groups loaded. Loading journal descriptors... 46 descriptors loaded. [root@21yunwei_backup /] # tail-5 / RECOVERED_FILES/file.14 mysql:x:497:500::/home/mysql:/bin/false nginx:x:496:501::/home/nginx:/sbin/nologin zabbix:x:495:497:Zabbix Monitoring System:/var/lib/zabbix:/sbin/nologin haproxy:x:500:502::/home/haproxy:/bin/bash tcpdump:x:72:72::/:/sbin/nologin

Note that when restoring inode, the recovered file name is not the same as before and needs to be renamed separately. There is no problem with the content.

For more extundelete usage, please refer to the extundelete-help option parameter description. All current recovery operations are completed.

At this point, the study on "how to restore mistakenly deleted files or directories on Linux" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.