How to restore accidentally deleted files in Linux

Article Title: how to restore accidentally deleted files in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

As a multi-user, multi-task operating system, once the files in Linux are deleted, it is difficult to restore. Although the DELETE command only marks the deletion in the file node and does not actually clear the file content, other users and some processes with disk write operations will soon overwrite the data. However, you can recover a Linux instance that is used by a single machine in your home, or rectify the file by mistake.

1. A brief introduction to the Ext2 File System Structure

In the Ext2 File System Used in Linux, files are stored in blocks. By default, the size of each block is 1 K. Different blocks are distinguished by block numbers. Each file has a node that contains information such as the file owner, read/write permission, and file type. For a file smaller than 12 blocks, the block number of the file data block is directly stored in the node. If the file contains more than 12 blocks, the node stores the block number of an indirect block after the 12 blocks. In the block corresponding to this indirect block number, block number that stores 256 file data blocks (each block number in Ext2fs occupies 4 bytes, so that the block number that can be stored in a block is 1024/4 = 256 ). If a larger file exists, the second-level indirect block and third-level indirect block appear in the node.

2. Restore deleted objects by mistake

Most Linux distributions provide a debugfs tool for editing Ext2 file systems. However, there is still some work to do before using this tool.

First, Remount the partition where the accidentally deleted file is located in read-only mode. Run the following command: (assume that the file is in the/usr partition)

Mount? R? N? O remount/usr

-R indicates read-only mounting;-n indicates no write to/etc/mtab. this parameter is added if the file on/etc is restored. If the system says xxx partion busy, you can run the fuser command to check which processes use the files in this partition:

Fuser? V? M/usr

If there are no important processes, run the following command to stop them:

Fuser-k? V? M/usr

Then you can remount these file systems.

If all the files are installed in a large partition, you can use linux single to enter the single-user mode at the boot prompt to minimize the chance of system processes writing data to the hard disk, or simply mount the hard disk on another machine. In addition, recovery

Mount? R? N/dev/hda1/mnt/had

Then you can run debugfs: (Suppose Linux is in/dev/hda5)

# Debugfs/dev/hda5

The prompt debugfs appears:

The lsdel command can be used to list the information of many deleted files:

debugfs：lsdel debugfs: 2692 deleted inodes found. Inode Owner Mode Size Blocks Time deleted 164821 0 100600 8192 1/ 1 Sun May 13 19:22:46 2001 ………………………………………………………………………………… 36137 0 100644 4 1/ 1 Tue Apr 24 10:11:15 2001 196829 0 100644 149500 38/ 38 Mon May 27 13:52:04 2001

[1] [2] Next page