Unix File Deletion Retrieval Method

Unix File Deletion retrieval method we know that the process of deleting a file in Unix is very simple, that is, releasing the data blocks occupied by index node tables and files and clearing the index nodes occupied by files, but the file content is not cleared. However, the process of deleting files is different from that of deleting directories, and the process of deleting files by different commands is also different. The specific steps for deleting a file on www.2cto.com Unix are as follows: Release the disk data blocks occupied by the file one by one according to the address table of the file I node, then clear the corresponding nodes, and finally release the I node. The process of deleting a directory is: first delete all the files in the directory one by one, and then delete the directory. The directory itself is also a file, so the Unix Delete method is the same as the delete file. To restore the deleted file, you can only post the deleted file based on the items left behind. What does Unix leave after deleting a file? From the above analysis, we can see that: first, the content of the file is left; second, the "Site" is left ". The file recovery policy can only be analyzed from these two aspects. 1. recovery based on the disk site if the file is deleted, the site is not damaged (that is, the hard disk has not been written after the file is deleted), and assume that only one file is deleted in Unix, the system can be restored based on the distribution algorithm. When a file is created, the system determines the location of the data block occupied by the file based on a specific allocation algorithm. After Unix deletes the file, the data blocks it occupies are released and returned to the system's allocation table. If a file is re-created, the data block allocated by the system based on the original allocation algorithm must be consistent with the original data block occupied by the file. In addition, we know that all the extra bytes at the end of the last data block of a Unix file are set to 0. Therefore, we only need to call the system's data allocation algorithm to apply for data blocks one by one in the system, as long as the end of an allocated data block is all 0, the end of the file can be considered as the end, so that the file length and content can be determined to achieve recovery. The method is as follows: ● apply for an index node, that is, apply to the system to create a new file name without writing any content. For example, #>/tmp/xx. ● Call the system-assigned data block algorithm getnextfreeblock () to obtain a data block number, which is recorded in an address table variable. ● Read the data block and determine whether all the data blocks at the end are consecutively 0. If not, return to step 2. If not, proceed to step 4. ● First use the system function fstat to get the I node number of/tmp/xx, and then write the address table obtained in step 2 to the address table of the index node (pay attention to inter-address issues ), calculate the file size based on the number of data blocks and the valid data length in the last part, and write the di_size field of the I node. ● Write back the index node table of the system. Note: first, the algorithms used to allocate data blocks vary with Unix versions. Second, Some Unix versions, such as SCO Unix 5.0, the allocation and recycling of idle data blocks are implemented using a dynamic linked list data structure, and their file recovery is easier, as long as they are searched at the end of the table in the idle linked list.