Recovery strategy of deleted files in Unix system

Unlike Dos/windows, UNIX files are difficult to recover after being deleted, as determined by the unique UNIX file system architecture. The Unix file directory is not the same as dos/windows, the file is still saved after the deletion of the full file name, file length, the initial cluster number (that is, the file occupies the first disk block number) and other important information, on the contrary, its file information depends on a kind of data structure called I node to describe The I node is emptied after the corresponding file is deleted, so it is almost impossible to recover the deleted file directly, and you have to do something differently. This paper discusses several file recovery strategies and the concrete realization of the key steps.

First, UNIX File system structure

As we know, UNIX is stored in file volumes as its file system, and different UNIX systems, file volume formats vary, and even in different versions of the same UNIX operating system, their file systems may not be exactly the same, for example: SCO UNIX The 4.1 and 5.0 file system structures are significantly different, but as long as it is a UNIX system, the basic structure of the file volume is consistent. The analysis is as follows:

Regardless of what Unix system, regardless of version, its file volume includes at least the boot block, super block, I node table, data area and so on several parts. In addition, different UNIX versions may have different differences. For example: SCO Unix System Bitmap index block and bitmap block Aix logical Volume table, and so on. The specificity of these systems does not affect the recovery strategy below, so this is not discussed here, only the standard UNIX file volume structure.

1. Guide block

The first sector at the beginning of the file volume, which is the boot code for the file system, is unique to the root file system, and the other file systems are 512 bytes empty.

2. Super Block

is located in the second sector of the filesystem, immediately after the boot block, to describe the structure of the file system. such as I node length, file system size, and so on, its structure is stored in the/USR/INCLUDE/SYS/FILSYS.H, its structure is as follows:

struct filsys

{

ushort s_isize; /*磁盘索引节点区所占用的数据块数*/

daddr_t s_fsize; /*整个文件系统的数据块数*/

short s_nfree; /*在空闲块登录表中当前登记的空闲块数目*/

daddr_t s_free[NICFREE]; /*空闲块登记表*/

short s_ninode; /*空闲索引节点数*/

ino_t s_inode[NICINOD]; /*空闲节点登记表*/

char s_flock; /*加锁标志位*/

char s_ilock; /*节点加锁标志位*/

char s_fmod; /*超级块修改标志*/

char s_ronly; /*文件系统只读标志*/

time_t s_time; /*超级块上次修改的时间*/

short s_dinfo[4]; /*设备信息*/

daddr_t s_tfree; /*空闲块总数*/

ino_t s_tinode; /*空闲节点总数*/

char s_fname[6]; /*文件系统名称*/

char s_fpack[6];

long s_fill[13]; /*填空位*/

long s_magic; /*指示文件系统的幻数*/

long s_type; /*新文件系统类型*/

};