How to restore objects deleted by using rm in linux

How to restore files deleted by using rm in linux-general Linux technology-Linux technology and application information. For more information, see the following. Many people have had a painful lesson about rm. I also met a program that was written one afternoon and rm was dropped. Fortunately, it was just a file and I wrote it again the next day. But many may not be as lucky as me. This article collects some methods to restore deleted rm files for your reference.

First, the best way is to avoid this problem. The following are some suggestions:

1. The consequences of rm-rf misoperations are terrible. rm-f should also be considered and cannot be used easily.

2. Back up data.

3. Use some policies to avoid errors:

We recommend that you use tabs to complete tasks in shell and execute tasks in scripts to reduce the chance of errors. You can also write a script named rm, change the real rm to mv in the script, and delete all the deleted music videos to a specified directory and clean them regularly.

Can the deleted rm file be restored?

Rm man has the following statement:
Note that if you use rm to delete a file, you can restore it to its original state. If you want to ensure that the content of this file cannot be restored, consider using shred.

Therefore, theoretically, the files deleted by rm can still be recovered. Deleting a file only releases the index point (information nodes) pointing to the data block. As long as the data is not overwritten, it is still on the hard disk. The key is to find the index point, capture the data in the data block it refers to and save it to another partition. After you accidentally delete a file with rm, the first thing we need to do is ensure that data is no longer written to the partition where the file is accidentally deleted.

Generally, we can have the following options:

1. Use tools.

2. Write your own program. You need to program and understand the corresponding file system.

3. If the data is useful, you may be able to seek help from a professional company.

Tools
1. The Sleuth Kit http://www.sleuthkit.org/sleuthkit/ (Autopsy is one of its graphics front ends)

2. Foremost http://foremost.sourceforge.net

3. a versatile tool, Finaldata, can restore files accidentally deleted under unix/linux/dos. For unix, these products are supported: Solaris, AIX, and HP-UX. For linux, EXT2 file systems are supported. For dos, the file system supports FAT 12/16/32, NTFS 4/5/5.1.

4. If the file system is ext2 (invalid for ext3 ):
The deletion mechanism of ext3 directly deletes inode data, so ext3 cannot be deleted (ext3 is designed to be unable to restore deleted files ).

Unrm
Ext2ed
Debugfs (undel lsdel)
Recover
Midnight Commander (mc)
E2undel
Tct

5. If the file system is FAT32 or NTFS:
EasyRecovery
Finaldata

6. If freebsd uses rm, try the undelete command.

7. When a process opens a file, as long as the process keeps opening the file, lsof can be used to restore and delete the file.