Shulou(Shulou.com)06/02 Report--

Preface

Whenever we execute rm commands on the production environment server, we are always worried, because accidentally deleted, and then we are ready to run away, after all, people are not machines, not to mention the machine also has bug, hehe.

So what if you do delete files that should not have been deleted, such as databases, logs, or execution files?

Simulation scenario 1. Delete

Mistakenly delete the MySql.Data.dll file under the server directory / root/selenium/Spider:

Rm-f / root/selenium/Spider/MySql.Data.dll

Ll / root/selenium/Spider/MySql.Data.dll

Ls: cannot access / root/selenium/Spider/MySql.Data.dll: No such file or directory

two。 Restore

(1) use the lsof command to check whether a process is currently opening the / root/selenium/Spider/MySql.Data.dll file:

Lsof | grep / root/selenium/Spider/MySql.Data.dll

As you can see from above, the current file status is deleted (deleted).

(2) check to see if there is recovery data:

/ proc/13067/fd: the directory of file descriptors for the process operation.

86: file descriptor.

Cat / proc/13067/fd/86

(3) restore files using Iram O redirection

Cat / proc/23778/fd/86 > / root/selenium/Spider/MySql.Data.dll

Ls-l / root/selenium/Spider/MySql.Data.dll

-rw-r--r-- 1 root root 702464 Feb 10 12:03 / root/selenium/Spider/MySql.Data.dll

Rerun the program:

Indicates that there is nothing wrong with the recovered files.

Analysis

The entire process of restoring a file is demonstrated through the previous simulation scenario, so what is the principle and under what circumstances is the file recoverable?

In the Linux system, each running program has a host process isolated from each other, represented by the / proc/ process number (Linux is essentially a file system), for example: ls-l / proc/13067 to view the process information with a PID of 13067 When the program runs, the operating system will specially open up a memory area for the current process to use. For dependent files, the operating system will issue a file descriptor to read and write the file. When we execute rm-f to delete the file, it only deletes the directory index node of the file, which is not visible to the file system, but is still visible to the process that opened it. That is, you can still use the previously issued file descriptor to read and write the file, which is based on this principle, so we can use the Imap O redirection to restore the file.

Summary

If you accidentally delete a file, don't worry, first use lsof to view the process that opened the file, then use the cat / proc/ process number / fd/ file descriptor to view the recovery data, and finally use Imax O redirection to restore the file.

Ruijiangyun official website link: https://www.eflycloud.com/home?from=RJ0035

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.