How to retrieve files after they are deleted and consumed by process

When you do this, you should understand the principle of file deletion and the knowledge of symbolic links and hard links.

Inode/block Differences and explanations

1. In a Linux system, there are two kinds of connections, one is called hard link, the other is called symbolic connection or soft link (symbolic link).

2. The ln command creates a hard link with no parameters by default, and the LN command with the-s parameter creates a soft connection

3. The hard link is the same as the Inode node number of the source file, and the Inode node number of the soft connection is different from the source file

The 4.Ln command cannot create a hard link to a directory, but a soft connection can be created, and a soft connection to a directory is often used

5. Delete the soft connection source file, this soft connection will be invalid, ll command to see the red on the white flashing, but with readlink to see the soft connection file pointing or normal

6. Delete linked files with multiple hard links in the file, no effect on source files and hard link files

7. Delete the source file of the linked file, no impact on hard-link files, but the soft connection file will be invalid

8: Delete the source file extremely hard link file also have the file without running process, the whole file will be really deleted

9. Soft connection file can cross file system, hard link file can not cross file system

The attributes of the Inode storage file in the Linux system block the data file name is stored in the block of the previous level directory, when the file exists a hard link or process is being called only delete the source file is not deleted, if you want to delete, You must remove all hard links to the file when the file is not running, so that it is actually deleted .

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M02/82/30/wKiom1dNssfQ7guKAACxStt0kX0973.jpg-wh_500x0-wm_3 -wmp_4-s_2759214755.jpg "title="}]4y@07@t21 ' (ljrfq310jy.jpg "alt=" Wkiom1dnssfq7gukaacxstt0kx0973.jpg-wh_50 "/>

Create a test environment as follows

[[email protected]/] #touch a.txt <== Create this file simulate the environment and open a window with TAILF a.txt call process

[[email protected]/] #rm-F a.txt <== Delete the file and start testing

Find system call Process files:

[Email protected]/]# Ps-ef

Root 8389 8035 0 00:06 pts/4 00:00:00 tail-f a.txt

Root 8401 7983 0 00:08 pts/3 00:00:00 ps-ef

View files that are still in the process of being called after the file is deleted:

[Email protected]/]# Lsof|grep del

Tail 3247 root 3r REG 8,3 8427 5042/a.txt (Deleted)

Retrieve the file by locating the corresponding process number in the/PORC directory:

[Email protected]/]# ll/proc/3247/fd/

Total 0

LRWX------1 root oldboy/dev/pts/2 21:56 0

LRWX------1 Root oldboy/dev/pts/2 21:56 1

LRWX------1 root oldboy/dev/pts/2 21:55 2

lr-x------1 root oldboy 21:56 3 -/a.txt (deleted) <== Find the file just deleted;

lr-x------1 root oldboy inotify 21:56 4

Copy the files you just deleted to the/root directory with the CP command to recover files

[[email protected]/] #cp/PROC/3247/FD/3/root/a.txt

[Email protected]/]# Ll/root/a.txt

-rw-r--r--1 root oldboy 8427 June 1 00:25 a.txt

This article is from the "Walker" blog, please be sure to keep this source http://zhaoyulin.blog.51cto.com/11665101/1785034

How to retrieve files after they are deleted and consumed by process