Shulou(Shulou.com)06/02 Report--

In this issue, the editor will bring you about the recovery method of the rm-rf command deletion file in linux. The article is rich in content and analyzes and describes for you from a professional point of view. I hope you can get something after reading this article.

Rm-rf is a very photographable command in the Linux command, as long as the command file is deleted as soon as it is executed, so be very careful when using this command. So is it true that deleted files will never be recovered? Today, I'll talk to you about three recovery methods after rm-rf deletes files.

No matter which method is used, the mainstream ones found on the Internet are all based on inode, so immediately after the file is deleted, hanging the mount disk only allows read operation, and rejecting write operation is the first priority.

The first process of mistakenly deleting files is still in place.

This method is relatively simple, and there are more restrictions on the files that can be restored. If the process of the deleted file still exists, the process PID can be found. Find the process id through the command lsof | grep (deletefile). Then go to the process directory cd / proc/PID/fd. You can then view the specific file information through the ll command, and copy the files that have soft connections to the deleted files and restore them.

The second uses inode-based tools such as extundelete

For the ext file system under Linux, the commonly used Linux file deletion and recovery workers include debugfs, ext3grep, extundelete and so on. Extundelete is an open source data recovery tool that supports ext3 and ext4 file systems. Its official site is located in http://extundelete.sourceforce.net/. The latest stable version is 0.2.0.

This tool and other similar recovery tools are based on inode to restore files, that is, the inode that needs to be deleted is still there and has not been overwritten, that is, there is no read and write input after the file is deleted. So the first thing to do is to suspend the partition where the file is located. But the problem with this operation is that if the system has only one mount disk and it is an online service, it is not realistic to hang. And even if there are not many reads and writes, the system itself does not install these recovery tools, and the reads and writes when you install and compile these recovery tools are likely to overwrite the deleted files inode.

However, if the system has more than one mount disk and the file disk on which the deleted file partition is located is not impressed, you can still try this method. Or the system itself has to install this tool, not a long time from the file deletion, you can also try, maybe inode is still there.

Specific usage is not said here, a lot of tutorials on the Internet, casually search is.

The third testdisk tool

Testdisk is an open source free tool for partition table recovery, raid recovery, and partition recovery (testdisk supports the following file systems: FAT12/FAT16/FAT32/NTFS/ext2/ext3/ext4). Testdisk supports functions: repair partition table, restore deleted partitions, restore boot sector with FAT32 backup table, rebuild FAT12/FAT16/FAT32 boot sector, repair FAT table, rebuild NTFS boot sector, restore NTFS boot sector with backup table, repair mft table with mft image table (mft mirror), find superblock backed up by ext2/ext3, restore deleted files from FAT,NTFS and ext2 file system, copy files from deleted FAT,NTFS and ext2/ext3 partitions.

Therefore, this tool is not based on inode, immediately after the file, no partition is suspended, read and write operations have been going on, or for a long time in the past, there is a chance to recover files.

But it's not 100% successful. Take Chestnut, the folder that was deleted is / usr/local/mytest. Then you back up some of the files under this folder, in order to restore part of the online business in time, then you mkdir / usr/local/mytest and then copy some of the backups into it. Then testdisk can't save and recover. Also, when testdisk recovers files, you also need to pay attention to the file size. If the file size is shown as 0, then even if you choose to restore the file, you will get a 0kb file.

So this applies to some files where inode has been overwritten, but the physical storage block of the file has not been overwritten, you can try this method, and you may be able to recover some of the missing files.

Be careful when using the rm-rf command, otherwise the consequences will be very serious, so remind everyone to keep a clear head when using this command again.

This is what the recovery method of the rm-rf command delete file in linux shared by Xiaobian is. If you happen to have similar doubts, you might as well refer to the above analysis to understand. If you want to know more about it, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.