Shulou(Shulou.com)06/02 Report--

Preface: inode (file node) and block (data block) hard link and soft connection restore mistakenly deleted files (that is, the operation of rm-rf, you can first perform backup operations, and then you can restore both ext4 and xfs file systems) classified user logs and program logs 1: inode and block Overview 1.1 Overview of file data including meta-information and actual data files stored on the hard disk The smallest storage unit of a hard disk is "sector". Each sector stores 512 bytes of block (block) eight consecutive sectors to form a block, and one block unit is 4k is the smallest unit of file access inode (index node) Chinese translation "index node", also known as I node to store file meta-information

Meta information > inode

Data > block

A file must occupy one inode, but at least one block

For a disk, the physical level of a unit is represented by a sector.

At the logical level of ​, the representation of a cell is a cell.

Deleting a file deletes inode, not block. When a new file is rewritten to disk and overwrites to the block of the deleted file, it means that the file is actually deleted. So when you delete a file by mistake, the first thing to do is not to write the file on disk again. It is possible to find the deleted file through data recovery.

1.2 contents of inode

Inode contains the meta information of the file

The number of bytes of the file the owner (owner) of the UID file GID file read and write execution permissions file timestamp note: does not include the file name with the stat command to view the inode information of a file; ls-I can also view meta information example: stat aa.txt

Three main time attributes of file timestamp in linux system

Ctime (change time): time when the file or directory (attribute is inode) was last changed atime (access time): time when the file or directory was last accessed mtime (modify time): the time directory file structure directory of the file or directory was last modified (content is block) the structure of the file directory file is also a file directory file structure a file name corresponds to an inode number, two fields become one line A line is called a directory entry each inode has a number, the operating system uses the inode number to identify different files within the linux system, but uses the inode number to identify the file. For the user, the file name is just a nickname for the inode number to be easily identified, that is, the inode number for the system to identify the file. When the user identifies the file name of the file user opens the file through the file name, the process within the system steps: 1. Does the system find the inode corresponding to this file very high? 2. Get the inode information through the inode number, that is, meta-information 3. According to the inode information, find the block where the file data is located, read the data and view the inode number ls-I command: view the inode number corresponding to the file name ls-I AA.txtstat command: view the file inode information The information contains the inode number stat AA.txt [root@localhost ~] # cd / opt [root@localhost opt] # lsrh [root@localhost opt] # touch abc.txt [root@localhost opt] # vim abc.txt [root@localhost opt] # ls-I 'View Meta Information' 35889299 abc.txt 1420654 rh [root@localhost opt] # stat abc.txt''View File details File: "abc.txt" size: 13: 8 IO block: 4096 ordinary file device: fd00h/64768d Inode:35889299 hard link: 1 permission: (0644Universe: Uid: (0 / root) Gid: (0 / root) Environment: unconfined_u:object_r:usr_t:s0 recent visit: 2019-11-16 1717VV 53.373111661 + 0800 recent changes: 2019-11-16 1757RV 53.373111661 + 0800 recently modified: 2019-11-16 17 Inode 57 dev/mapper/centos-root 53.375111659 + 0800 creation time:-[root@localhost opt] # mount-I 'View mount point meta-information' file system Inode is available (I) used (I)% mount point / dev/mapper/centos-root 10485760 10360463,2% / devtmpfs 250006 386 2496201 1% / devtmpfs 253986 1 253985 1 per cent / dev/shmtmpfs 253986 620 253366 1 per cent / runtmpfs 253986 16 253970 1 per cent / sys/fs/cgroup/dev/sda1 3145728 328 3145400 1 per cent / boot/dev/mapper/centos-home 5242880 286 5242594 1 / hometmpfs 253986 9 253977 1 per cent / run/user/42tmpfs 253986 16 253970 1 per cent / run/user/0/dev/sr0 2000-/ run/media/root/CentOS 7 x86_64tmpfs 253986 16 253970 per cent / run/user/1000//192.168.254.10/linuxs 000-/ aaa

In a sense, innode can represent how many files there are.

The principle of full data recovery: that is, to scan block information directly in the absence of inode

1.3 File storage summary

The meaning of refusal of permission denied permission

1.4 inode size inode also consumes hard disk space, the size of each inode, generally 128byte or 256byte format the file system to determine the total number of inode using the df-I command you can see the total number of inode per hard disk partition and the number used 1.5 inode special function due to the separation of inode numbers and file names, resulting in some Unix/Linux systems have the following phenomenon when the file name contains special characters It may not be possible to delete the file normally, delete the inode directly, or delete the file when moving or renaming the file, only change the file name, without affecting the inode number. After opening a file, the system recognizes the file by the inode number. Do not consider file name 1.6 link file establish link file type soft link (symbolic link) hard link delete the original file is still available applicable to the file or directory can only be used for file save location and the original file can be located in a different file system must be in the same file system as the original file system (xfs system, or ext4, etc.) Such as a Linux partition hard link command ln source file destination location soft connection command ln-s source file or directory.. Link file or target location-s that is softII, file recovery 2.1 restore EXT type file compilation installation extundelete package installation dependency package e2fsprogs-libs-1.41.12-18.el6.x86_64.rpme2fsprogs-devel-1.41.12-18.el6.x86_64.rpm configuration, compilation and installation extundelete-0.2.4.tar.bz2 simulation delete and perform reply operation

The extundelete package can only be used in centos-6 or centos-5 because the default file system type for centos-6 is ext4,centos-5 and the default file type is ext3

2.2 restore files of type XFS xfsump command format xfsdump- f backup location path or device file xfsdump backup level (default is 0) 0: full backup 1-9: incremental backup xfsdump common options: xfsdump-- helpxfsdump-- help xfsdump: version 3.1.4 (dump format 3.0) xfsdump: version 3.1.4 (dump format 3.0) xfsdump: usage: xfsdump [- a ( Dump DMF dualstate files as offline)] xfsdump: usage: xfsdump [- (dump DMF dual status file is offline)] [- b] [- b] [- c] [- c] [- d] [- d] [- e (allow files to be excluded)] [- e (allow files to be excluded)] [- f. [- f...] [- h (help)] [- h (help)] [- l] [- l] [- m (force usage of minimal rmt)] [- m (minimum rmt use of force)] [- o (overwrite tape)] [- o (overwrite tape)] [- p] [- p]

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.