Delete and restore CentOS files by mistake

As a multi-user, multi-task operating system, once the files in Linux are deleted, it is difficult to restore. Although the DELETE command only marks the deletion in the file node and does not actually clear the file content, other users and some processes with disk write operations will soon overwrite the data. However, you can recover a Linux instance that is used by a single machine in your home, or rectify the file by mistake.

Recovery steps

1. Run SecureCRT to remotely view the current system version number and file system format on the operating system.

2. To facilitate this experiment, we create a new file.

3. Perform the delete operation

Iv. Use and debugfs as a system auto-return tool to fix

5. Open the partition where the deleted file is located

6. Use ls and the-d parameter to display the directory of the file you just deleted.

7. <> the angle brackets indicate the Inode Number of the file we are looking for. Execute logdump-I <393289>

8. After executing the command, a screen is displayed. We need the following line and remember the following values.

9. Exit debugfs.

10. Execute the following command:

11. The above results indicate that the restoration is successful. Let's check whether the/tmp directory exists.

12. In the tmp directory, We can display the following information,