Recover deleted files from Linux

Recover deleted files from Linux

As a multi-user, multi-tasking Linux operating system, there will be no backup in the case of some user files mistakenly deleted, Linux files under the once deleted, it is difficult to recover. Although the delete command only deletes the file nodes, it does not really erase the contents of the file, but other users and some processes that have write actions will soon overwrite the data. In the timely detection of the situation after the accidental deletion of some recovery work, to a certain extent, it is possible to retrieve data.

Case 1: Without any action, simply delete a file

Principle: In the Linux system, any file into the hard disk is divided into storage file Inode number and block, the real data is the block of files. When doing a delete operation, it is actually reducing the disk reference count I_nlink just, if no other link i_nlink is 0. In other words, the link to the inode is deleted, but the file block remains. The contents of the original file will not be overwritten until the data is re-written to the hard disk, before it is possible to recover by means.

1. Configuring EPEL's Software Warehouse, EPEL (Extra Packages for Enterprise Linux) is a fedora-based project that provides additional packages for "Red Hat system" operating systems for Rhel, CentOS and scientific Linux. First execute the command Yum repolist checks if the source of Epel is installed, is installed here, and if it is not installed, execute the command yum install Epel-release–y to configure the warehouse.

2. Install extundelete recovery software yum Install Extundelete–y

3, in advance know the name of the deleted file, you can use the name of the file to recover.

3.1 Simulation Environment: View the existing files in the current directory, delete the Install.log

3.2 Execute command extundelete--restore-file '/root/install.log '/dev/sda2 for recovery, confirm Y, will prompt after successful recovery. and automatically generates a directory named Recovered_files in the current directory

3.3 Go to the Recovered_files directory and view the files in the directory, you can find that Install.log has been restored successfully

4, if you do not know which files are deleted, that is, you do not know the name of the deleted file, you can recover through the inode of the file.

4.1 Simulation Environment: Delete install.log.syslog files

4.2 Execute command ls-ild. View the inode number of the current directory, the home directory of the root user

4.3 Execute command extundelete/dev/sda2--inode 1048577 scan from the current directory, according to the scan results, found that the deleted file Install.log.syslog inode number 1048579

4.4 extundelete/dev/sda2--restore-inode 1048579 for recovery

4.5 Also in the current directory to automatically generate a directory named Recovered_files, go to the Recovered_files directory and view the files in the directory, you can find that Install.log has been successfully restored

It is important to note that this recovery method has contingency, usually need to unload the corresponding disk mounted to avoid data rewriting, because there are many processes in the background of the system is running, it is possible to overwrite the contents of the message, prompting an error. Recovery failed

Case 2: Multiple users log on to the Linux system through a terminal, and when a user is executing or editing a file, exactly when another user deletes the file

Rationale: The user who is executing or editing a file is in the operation of the file, the system is to transfer the file into memory for related operations, but the user who deleted the file only deleted the files on the hard disk, you can use the lsof command to recover from memory and back to the hard disk.

1. Simulate the environment and log in to the Linux system with the same user via two terminals (1 and 2)

In the Terminal 1 view the current directory of files, select any one to execute (here selected an installation of the log file, the use of the tail command to track the contents of the file in real time, without the operation of the premise will be tracking, equivalent to execution)

Execute the Delete install.log command in Terminal 2

1. Use the command lsof|grep–i Delete to view the deleted file information

1. by locating the corresponding PID directory under the proc directory (the/proc directory contains a number of digitally named subdirectories that represent the process number that the system is currently running, containing multiple information files related to the corresponding process, and the/proc/of the corresponding process $pid/fd directory where all open fd,fd of this process are stored as file descriptors), you can see the deleted install.log file tags

4, through the CP will be in the FD 3rd copy back to the original path, and view, this time can be found to recover successfully

Recovery does not necessarily succeed, so you need to be very cautious about deleting files

Reference Source:

41494547

Https://www.linuxidc.com/Linux/2018-03/151199.htm

Recover deleted files from Linux