Recover data: Restore deleted files in Linux

Recover data: Restore deleted files in Linux
GuideHave you ever encountered such a thing? When you find out, you have deleted the key or used
The "rm" command mistakenly deletes an object that should not be deleted.

In the first case, you can go to the garbage bin, search for the file, and restore it to the original location. But what should I do in the second case? You may know that the Linux Command Line does not move the deleted files to any location, but directly removes them, biu ~, They no longer exist.

In this article, we will share a useful technique to avoid this. At the same time, we will share a tool that may be useful when accidentally deleting objects that should not be deleted.

Procedure

When the-I option is used with the rm command (including other file processing commands such as cp or mv), a prompt is displayed before deleting the file.

This can also be used when copying, moving, or renaming a file, when there is already a file with the same name as the target file.

This prompt will give you a second chance to consider whether you really want to delete the file-if you choose to confirm on this prompt, the file will be deleted. In this case, I am sorry, this technique cannot prevent your carelessness.

To replace rm with the rm-I alias, do the following:

alias rm='rm -i'

Run the alias command to confirm that rm is now alias:

Add an alias to rm

However, this is only valid on the Current shell of the current user. To change permanently, you must save it to ~ as shown below ~ /. Bashrc (some versions of Linux systems may be ~ /. Profile ).

Add aliases permanently in Linux

To make ~ /. Bashrc (or ~ /. Profile), and the changes take effect immediately. Run the file from the current shell:

. ~/.bashrc

Activate aliases in Linux

Forensic tool-Foremost

If you want to recover lost files from an external disk or USB device, you only need to use this tool.
However, when you realize that you accidentally deleted a file in the system and are panic-don't worry. Let's take a look at foremost, a forensic tool for processing this situation.

To install Foremost in CentOS/RHEL 7, you must first enable Repoforge:

# rpm -Uvh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm# yum install foremost

However, In Debian and its derivative systems, we need to do this:

# aptitude install foremost

After the installation is complete, let's perform a simple test. First, delete an image file named nosdos.jpg in the/boot/imagesdirectory:

# cd images# rm nosdos.jpg

To restore this file, use foremost as follows (you must first confirm the partition where it is located-in this example,/boot is located in the/dev/sda1 partition ).

# foremost -t jpg -i /dev/sda1 -o /home/gacanepa/rescued

Among them,/home/gacanepa/rescued is the directory in another disk-remember, it is not wise to restore the file to the disk where the deleted file is located.

If the disk partition of the deleted file is occupied during the restoration process, the file may not be restored. In addition, do not perform any other operations before the file recovery operation.

After foremost is executed, the recovered files (if possible) will be stored in the directory/Home/gacanepa/rescue/jpg.

Summary

In this article, we explain how to avoid accidental deletion of a file that should not be deleted, and how to restore the file in case of such incidents. Note that foremost may run for a long time, depending on the partition size.

From: https://linux.cn: 443/article-7974-1.html

Address: http://www.linuxprobe.com/rm-on-linux.html