Home stand-alone Linux Delete files in time for remediation and recovery

As a multi-user, multitasking operating system, Linux files are difficult to recover once they are deleted. Although the delete command is a deletion mark in the file node and does not really erase the contents of the file, other users and some processes with write-up actions will quickly overwrite the data. However, for home stand-alone Linux, or mistakenly deleted files after timely remediation, or can be restored.

1. A brief introduction to the structure of EXT2 file system

In the Ext2 file system used by Linux, files are stored in blocks, and by default the size of each block is 1K, and different blocks are distinguished by block numbers. Each file also has a node that contains information such as file owners, read and write permissions, file types, and so on. For a file less than 12 blocks, the block number of the file data block is stored directly in the node. If the file is larger than 12 blocks, then the node stores a block number of an indirect block after 12 blocks, and in the block corresponding to the indirect block number, the block number that stores 256 file blocks (each block number in the Ext2fs occupies 4 bytes, so that the block number that can be stored in a block is http:// Www.aliyun.com/zixun/aggregation/12560.html ">1024/4=256). If there is a larger file, there will also be a level two indirect block and level three indirect block in the node.

2. How to recover a deleted file by mistake

Most Linux distributions provide a DEBUGFS tool that you can use to edit the Ext2 file system. But before using this tool, there is still work to be done.

The partition in which the deleted file was mistakenly mounted is first reproduced in read-only mode. Use the following command: (assuming the file is in/usr partition)

Mount–r–n–o REMOUNT/USR

-R is a read-only mount;-n means not to write to/etc/mtab, and if you are restoring a file on etc, add this argument. If the system says XXX partion busy, you can use the Fuser command to see which processes use the files on this partition:

Fuser–v–m/usr

If there are no important processes, use the command to stop them:

Fuser-k–v–m/usr

You can then mount the file systems again.