Shulou(Shulou.com)06/01 Report--

In this issue, Xiaobian will bring you about how to recover deleted files in Linux. The article is rich in content and analyzes and narrates from a professional perspective. After reading this article, I hope you can gain something.

1、lsof

Principle: This command cannot actually be used to recover files directly, but it can list information about files opened by various processes.

In conjunction with other commands, restore files from the/proc directory with the message "File deleted, but the process keeps the file open."

The/proc directory is a mapped area in memory that we actually retrieve from memory when we read and write to these files.

Therefore, when we read or write to a file (that is, when a process is using the file), even if the file has been deleted from the hard disk, we can still recover the file from the information in memory.

Note:

You must run as root because lsof requires access to core memory and various files.

Only files that have been deleted, but the process keeps the file open, can be restored.

If a directory is deleted by mistake, other files in the directory are not opened by the process, and unused files cannot be recovered using this method.

Lsof output information significance:

COMMAND #PID(process identifier) USER #Process Owner FD #Used to identify the file (file descriptor) DEVICE #Specify disk name SIZE #file size NODE #Inode (ID of file on disk) NAME #Open the exact name of the file

Most common parameters:

-c #Show files that are currently open by a process-p #Show which files are open by a pid process-g #Show process status belonging to a gid-d #Show files opened by process in directory-d #Show processes using fd = 4-i:80 #Show the process of opening port 80

Recovery file operation

Environment: There are files under/mnt, one of which is train.less being viewed and then deleted by another terminal

[1] lsof View

View the process number that is using the deleted file

lsof /mnt

[2] Recovery

Switch to/proc and delete the file descriptor directory under the pid of the process corresponding to the file; redirect or cp the corresponding content to other files.

Focus: PID and FD

cd /proc/31284/fd/ cat 4 > /mnt/ferris_train.less

2、extundelete

Principle: Using information stored in the partition log, try to recover files that have been deleted from the ext3 or ext4 partition

Advantages: Compared to ext3grep, it can only recover files of ext3 file system, which is applicable to a wider range and faster recovery speed.

extundelete official address (official document): extundelete.sourceforge.net

extundelete download address: downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 (the latest version of extundelete is 0.2.4, released in January 2013)

Note:

After data deletion, unmount the disk or partition where the deleted data is located

If the root partition of the system is deleted by mistake, enter single-user mode and mount the root partition in a read-only manner to avoid data being overwritten as much as possible.

Data cannot be retrieved after being overwritten

Recovery still has a certain probability of failure, usually important data should be backed up, use rm carefully

installation

1. Dependent installation

#centos install yum install e2fsprogs-devel e2fsprogs* gcc* #ubuntu install operation apt-get install build-essential e2fslibs-dev e2fslibs-dev

2. Compile and install

wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2 tar xf extundelete-0.2.4.tar.bz2 cd extundelete-0.2.4 ./ configure make make install

cd /root/extundelete-0.2.4/src

extundelete -v

Executing the make command generates an extundelete executable file in the src directory, where the restore command can be executed directly.

Executing make install installs the program under/usr/local/bin/

Recovery file operation

The current directory in which the extundelete command is executed must be writable.

1. View the file system of the partition from which you want to recover files

df -Th

2. Unmount the partition from which you want to recover files

umount /mnt

3. View recoverable data

Specify the partition of the deleted file to search, and the last column marked as Deleted files is the deleted file.

extundelete /dev/vdb1 --inode 2 (the root partition has an inode value of 2)

4. Restore a single directory

Specifies the name of the directory to restore, if empty, it will not be restored.

extundelete /dev/vdb1 --restore-directory ferris

When the command to recover files is executed, the RECOVERED_FILES directory is generated under the current directory where the command was executed, and the recovered files are placed in this directory. Failure if no catalog is generated.

5. Restore a single file

Specify the name of the file to be recovered. If it is a small file of a few k size, there is a high probability that recovery will fail.

extundelete /dev/vdb1 --restore-file openssh-7.7p1.tar.gz

Recover all deleted files

Recover all deleted data without specifying file or directory names.

extundelete /dev/vdb1 --restore-all

The above is how to recover deleted files in Linux shared by everyone. If there is a similar doubt, please refer to the above analysis for understanding. If you want to know more about it, please pay attention to the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.