Restoration of Linux erroneous deletion of files
Preface
Whenever we execute rm commands on the production environment server, we are always worried, because accidentally deleted, and then we are ready to run away, after all, people are not machines, not to mention the machine also has bug, hehe.
So what if you do delete files that should not have been deleted, such as databases, logs, or execution files?
Simulation scenario 1. Delete
Mistakenly delete the MySql.Data.dll file under the server directory / root/selenium/Spider:
Rm-f / root/selenium/Spider/MySql.Data.dll
Ll / root/selenium/Spider/MySql.Data.dll
Ls: cannot access / root/selenium/Spider/MySql.Data.dll: No such file or directory
two。 Restore
(1) use the lsof command to check whether a process is currently opening the / root/selenium/Spider/MySql.Data.dll file:
Lsof | grep / root/selenium/Spider/MySql.Data.dll
As you can see from above, the current file status is deleted (deleted).
(2) check to see if there is recovery data:
/ proc/13067/fd: the directory of file descriptors for the process operation.
86: file descriptor.
Cat / proc/13067/fd/86
(3) restore files using Iram O redirection
Cat / proc/23778/fd/86 > / root/selenium/Spider/MySql.Data.dll
Ls-l / root/selenium/Spider/MySql.Data.dll
-rw-r--r-- 1 root root 702464 Feb 10 12:03 / root/selenium/Spider/MySql.Data.dll
Rerun the program:
Indicates that there is nothing wrong with the recovered files.
Analysis
The entire process of restoring a file is demonstrated through the previous simulation scenario, so what is the principle and under what circumstances is the file recoverable?
In the Linux system, each running program has a host process isolated from each other, represented by the / proc/ process number (Linux is essentially a file system), for example: ls-l / proc/13067 to view the process information with a PID of 13067 When the program runs, the operating system will specially open up a memory area for the current process to use. For dependent files, the operating system will issue a file descriptor to read and write the file. When we execute rm-f to delete the file, it only deletes the directory index node of the file, which is not visible to the file system, but is still visible to the process that opened it. That is, you can still use the previously issued file descriptor to read and write the file, which is based on this principle, so we can use the Imap O redirection to restore the file.
Summary
If you accidentally delete a file, don't worry, first use lsof to view the process that opened the file, then use the cat / proc/ process number / fd/ file descriptor to view the recovery data, and finally use Imax O redirection to restore the file.
Ruijiangyun official website link: https://www.eflycloud.com/home?from=RJ0035
