Restore deleted rm files in Linux

Some important files were accidentally deleted yesterday. after about one day of recovery, rm was successfully restored. Here we will summarize the methods. Of course, it is the most important to prevent this situation. you can refer to the Linux RM Security recovery conditions and some preparations previously written: 1. data protection. Common sense: after a file is deleted, the file content is not cleared,

Some important files were accidentally deleted yesterday. after about one day of recovery, rm was successfully restored. Here we will summarize the methods. Of course, preventing this situation is the most important. you can refer to the previously written linux rm security

Recovery conditions and preparation:
1. protect data.
Common sense: after a file is deleted, the file content is not cleared, but the storage space occupied by the file is allowed to be written. therefore, to restore the file, make sure that you do not want to write data to the partition where the file is located. I am using a virtual machine and kill the process directly. non-virtual machines can use umount partitions. if it is a primary partition, the power is cut off directly. For the primary partition, use livecd to read-only mount the hard disk for security. If it is a virtual machine, even if you want to restore the root partition, you can use livecd to generate multiple copies of the hard disk by copying the hard disk image. Add the copied hard disk to the virtual system so that the system has two hard disks. However, I found that although I can correctly identify the disk as a and disk B, the boot information may be faulty if I talk about which system to start is loaded from a hard disk.

II. linux LVM file system
This is logical volume management. it is not a file system like ntfs or ext3, so it cannot be directly mounted because multiple logical partitions may exist under an lmv, we can only mount one of them at a time. Therefore, you need to find logical partitions based on lvm.
1. "fdisk-l"
Check whether the connected hard disk is lvm. if not, skip this part.

Fdisk-l
Device Boot Start End Blocks Id System
/Dev/sda1*1 13 104391 83 Linux
/Dev/sda2 14 1044 8281507 + 8e Linux LVM
2. if yes, install lvm2
Automatic installation: "apt-get installlvm2" (packages may not be provided) or "yum install package name" (packages may not be provided)
Download: http://sources.redhat.com/lvm2/
3. "vgscan" to scan logical partitions

Root @ ubuntu :~ # Vgscan
Reading all physical volumes. This may take a while...
Found volume group "VolGroup00" using metadata type lvm2
4."LvsCan, view the logical partition, the status is not activated

Root @ ubuntu :~ # Lvscan
Inactive '/dev/VolGroup00/logvol00' [6.88 GiB] inherit
Inactive '/dev/VolGroup00/LogVol01' [1.00 GiB] inherit
5. "vgchange-a y" activated
6. "lvscan" to view the status

Root @ ubuntu :~ # Lvscan
ACTIVE '/dev/VolGroup00/logvol00' [6.88 GiB] inherit
ACTIVE '/dev/VolGroup00/logvol01' [1.00 GiB] inherit

Now you can mount the specified partition.
III. installation of linux source code
1./configure if the dependency Library is missing, download and install the required Library.
2. make compilation
3. install make install

Recovery Method
Method 1: Use debugfs (not applicable to me, not strictly tested for recovery, only the node values are listed)
Debugfs is used to debug the file system. you can view the node value of the file, locate the data block based on the Journal log of the file system, and store the specified block.
Applicability: after deletion, it is not shut down because Journal will be lost after shutdown.
1. "Umount device descriptor file" to uninstall the specified partition
2. "Debugfs device descriptor file" to start debugfs
3. "Cd directory" to go to the specified directory where the file is deleted
4. "Ls-ld" to view the node value of the file. If there is no file you want, it is a pity that it has been damaged.
5. "Dumplog-I Obtain the log information and find the block information. for example, Blocks: (0 + 1): 10234
6. Save the Block Data. for example, dd if =/dev/sda5 of =/tmp/test.txt bs = 4096 count = 1 skip = 10234
Method 2: Use ext3grep

Note: The usage method is available online, but I did not succeed when using it because it does not recognize the logical partitions of lvm.
Applicable: I failed to divide lmv into two partitions, so I think it should be applicable if I didn't use lmv to divide multiple logical partitions. Directory cannot be restored, only to restore files
Tip: in the directory operation for saving the recovery file, make sure that the space is sufficient. if the inode value is 2, the overall partition data will be saved, not only the deleted
1. Download and install ext3grep
Http://code.google.com/p/ext3grep/
2. If it is lvm, activate the logical partition as mentioned above.
3. Ext3grep -- ls -- inodenode value (the node value is the node value in the directory where the file to be restored is located. you can use debugfs to view the value, and 2 is the root directory of the partition)
3. Restore a file in the directory
Ext3grep/home/sheng/file -- restore-file del/1 (note: del is in the root directory of the partition)
Restore all files
Ext3grep/home/sheng/file -- restore-all
Method 3: Use extundelete (the most effective method)

Extundelete is a software based on ext3grep. It provides convenient commands to restore files and is also effective for lmv logical partitions. I use this method to restore the data.
Applicable: delete data that has not been damaged
Tip: in the directory operation for saving the recovery file, make sure that the space is sufficient. if the inode value is 2, the overall partition data will be saved, not only the deleted
1. Download and install extundelete
Http://extundelete.sourceforge.net/
2. For lvm, use the method mentioned above to activate logical partitions.
3. Extundelete partition device parameters
Common parameters: -- restore-all is restored to the current directory.
-- Restore-inode value is restored by inode
-- Restore-files filename
-- Restore-directory path/of/directory