Shulou(Shulou.com)05/31 Report--

This article mainly explains "how to restore the Fedora proc file system", the content of the article is simple and clear, easy to learn and understand, the following please follow the editor's ideas slowly in depth, together to study and learn "how to restore the Fedora proc file system"!

First introduce some basic concepts of the file, the file is actually a link to inode, the inode link contains all the attributes of the file, such as permissions and owner, block address (the file is stored in these blocks on disk). When you rm a file, you actually delete the link to inode, not the contents of inode. The process may still be in use. Only when all links to the inode are completely removed, then these data blocks can be written to new data.

The proc file system can help us recover data from the Fedora proc file system. Each process on the system has a directory in / proc and its own name: it contains a fd (file descriptor) subdirectory (the process needs to open all links to the file). If you delete a file from the file system, there is also a reference to inode:

/ proc/ process number / fd/ file descriptor Fedora proc file system

Next, you need to know the process number (pid) and file descriptor (fd) to open the file. These are easily available through the lsof tool, which means "list open files, list open files." Then you will be able to copy data from / proc that needs to be recovered by the Fedora proc file system.

The following describes the use of lsof to recover mistakenly deleted files on Fedora Core 5 systems:

Environment

Host: the use of micro-harmony independent host, a virtual independent host based on vmware.

System: Fedora Core 5

Kernel: 2.6.16-1.2122_FC5

Lsof version:

[zhaoke@fedora5] $/ usr/sbin/lsof-v

Lsof version information:

Revision: 4.77

Preparatory work:

If you don't have lsof installed on your system, you can get it from the author's website or pbone.

Author's website: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/

Pbone: http://rpm.pbone.net/

Fedora proc file system recovery process:

First, we need to create a text file, delete it, and then restore:

[zhaoke@fedora5 ~] $man lsof | col-b > myfile

Then take a look at the contents of the file:

[zhaoke@fedora5 ~] $less myfile

You can see all the text help messages from lsof.

Now press Ctrl-Z to exit the less command, and then view the file attribute information at the shell prompt:

[zhaoke@fedora5 ~] $stat myfile

File: `myfile'

Size: 116549 Blocks: 240 IO Block: 4096 regular file

Device: fd00h/64768d Inode: 492686 Links: 1

Access: (0664) Uid: (505 / zhaoke) Gid: (505 / zhaoke)

Access: 2006-11-20 12 purl 59 purl 38.000000000 + 0800

Modify: 2006-11-20 12 purl 59 purl 34.000000000 + 0800

Change: 2006-11-20 12 purl 59 purl 34.000000000 + 0800

No problem, continue with the following work:

[zhaoke@fedora5 ~] $rm myfile

[zhaoke@fedora5 ~] $ls-l myfile

Ls: myfile: No such file or directory

[zhaoke@fedora5 ~] $stat myfile

Stat: cannot stat `myfile': No such file or directory

The myfile file was deleted.

At this point, you should not terminate the process that is still using files. Because once terminated, the file will be difficult to recover from the Fedora proc file system.

Now let's start to retrieve the data, first take a look at it using lsof:

[zhaoke@fedora5 ~] $lsof | grep myfile

Less 9104 zhaoke 4r REG 253 REG 0 116549 492686 / home/zhaoke/myfile (deleted)

The * vertical line is the name of the process (command name), the second vertical line is the process number (PID), and the fourth vertical line is the file descriptor (r means normal file). Now you know that 9104 processes still have open files, and the file descriptor is 4. So let's start copying data from / proc. You might consider using cp-a, but it doesn't really work. You'll copy a symbolic link to the deleted file:

[zhaoke@fedora5 ~] $ls-l / proc/9104/fd/4

Lr-x-- 1 zhaoke zhaoke 64 Nov 20 13:00 / proc/9104/fd/4-> / home/zhaoke/myfile (deleted)

[zhaoke@fedora5] $cp-a / proc/9104/fd/4 myfile.wrong

[zhaoke@fedora5 ~] $ls-l myfile.wrong

Lrwxrwxrwx 1 zhaoke zhaoke 29 Nov 20 13:02 myfile.wrong-> / home/zhaoke/myfile (deleted)

[zhaoke@fedora5 ~] $file myfile.wrong

Myfile.wrong: broken symbolic link to `/ home/zhaoke/myfile (deleted)'

[zhaoke@fedora5 ~] $file / proc/9104/fd/4

/ proc/9104/fd/4: broken symbolic link to `/ home/zhaoke/myfile (deleted)'

Then, use cp to copy out the data:

[zhaoke@fedora5 ~] $cp / proc/9104/fd/4 myfile.saved

* confirm the file:

[zhaoke@fedora5 ~] $ls-l myfile.saved

-rw-rw-r- 1 zhaoke zhaoke 116549 Nov 20 13:03 myfile.saved

[zhaoke@fedora5 ~] $man lsof | col-b > myfile.new

[zhaoke@fedora5 ~] $cmp myfile.saved myfile.new

Thank you for reading, the above is the content of "how to restore the Fedora proc file system", after the study of this article, I believe you have a deeper understanding of how to restore the Fedora proc file system, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.