Home stand-alone Linux Delete files in time for remediation and recovery

Source: Internet
Author: User
Keywords Accidentally deleted stand-alone if this can
Tags block data default delete delete files deleted file file system architecture

As a multi-user, multitasking operating system, Linux files are difficult to recover once they are deleted. Although the delete command is a deletion mark in the file node and does not really erase the contents of the file, other users and some processes with write-up actions will quickly overwrite the data. However, for home stand-alone Linux, or mistakenly deleted files after timely remediation, or can be restored.

1. A brief introduction to the structure of EXT2 file system

In the Ext2 file system used by Linux, files are stored in blocks, and by default the size of each block is 1K, and different blocks are distinguished by block numbers. Each file also has a node that contains information such as file owners, read and write permissions, file types, and so on. For a file less than 12 blocks, the block number of the file data block is stored directly in the node. If the file is larger than 12 blocks, then the node stores a block number of an indirect block after 12 blocks, and in the block corresponding to the indirect block number, the block number that stores 256 file blocks (each block number in the Ext2fs occupies 4 bytes, so that the block number that can be stored in a block is http:// Www.aliyun.com/zixun/aggregation/12560.html ">1024/4=256). If there is a larger file, there will also be a level two indirect block and level three indirect block in the node.

2. How to recover a deleted file by mistake

Most Linux distributions provide a DEBUGFS tool that you can use to edit the Ext2 file system. But before using this tool, there is still work to be done.

The partition in which the deleted file was mistakenly mounted is first reproduced in read-only mode. Use the following command: (assuming the file is in/usr partition)

Mount–r–n–o REMOUNT/USR

-R is a read-only mount;-n means not to write to/etc/mtab, and if you are restoring a file on etc, add this argument. If the system says XXX partion busy, you can use the Fuser command to see which processes use the files on this partition:

Fuser–v–m/usr

If there are no important processes, use the command to stop them:

Fuser-k–v–m/usr

You can then mount the file systems again.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.