Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to solve the problem of erroneous deletion in linux, which has a certain reference value, and interested friends can refer to it. I hope you will gain a lot after reading this article.

Delete a file. What exactly do you delete?

Clear the directory entry and set the inode number to 0 in inode's mapping table.

Block mapping table (bit table bitmap) sets block to 0

In a general delete file operation, Linux does not immediately empty the block contents of the file, but only releases the inode and data block,Linux occupied by the file

The process of rm is actually the process of setting the corresponding identities in inode bitmap and data block bitmap to idle state, and does not involve real data, which is why large files are deleted so quickly under Linux, because the disk occupied by large files is not empty at all. So, if we can find the corresponding inode of the file, and then find the corresponding data block, it is possible to recover the deleted file from the disk, as many file / disk recovery tools do.

Linux orthodox file systems (such as ext2, 3, etc.) partition the hard disk into directory blocks, inode Table blocks, and data block data areas. A file consists of a directory entry, an inode, and a data area block. Inode contains the attributes of the file (such as read-write attributes, owner, and so on, and pointers to data blocks), while data area blocks are the contents of the file. When viewing a file, the file attributes and data store points are first found in the inode table, and then the data is read from the data block.

The system finds the inode number through the file name, obtains the inode information through the inode number, and finally finds the BLOCK where the file data is located according to the inode information to read the data.

Directory entry: includes file name and inode node number.

The directory entry is structured as follows (the directory entry for each file is stored in the file contents of the directory to which the file belongs (in the block block)

Inode: also known as file index node, is the storage place of basic file information (type, size, permissions, time, number of links, etc.) and data block pointer storage.

One file takes up one inode

What if I delete it by mistake?

Stop writing after deleting a file

Grep-a-B 10-A 100 'keyword' / dev/sda1 > tmp.txt

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.