Home stand-alone Linux mistakenly delete files after recovery strategy

As a multi-user, multitasking operating system, Linux files are difficult to recover once they are deleted. Although the delete command is a deletion mark in the file node and does not really erase the contents of the file, other users and some processes with write-up actions will quickly overwrite the data. However, for home stand-alone Linux, or mistakenly deleted files after timely remediation, or can be restored.

1. Brief introduction of EXT2 file system structure

In the Ext2 file system used by Linux, files are stored in blocks, and by default the size of each block is 1K, and different blocks are distinguished by block numbers. Each file also has a node that contains information such as file owners, read and write permissions, file types, and so on. For a file less than 12 blocks, the block number of the file data block is stored directly in the node. If the file is larger than 12 blocks, then the node stores a block number of an indirect block after 12 blocks, and in the block corresponding to the indirect block number, the block number that stores 256 file blocks (each block number in the Ext2fs occupies 4 bytes, so that the block number that can be stored in a block is http:// Www.aliyun.com/zixun/aggregation/12560.html ">1024/4=256). If there is a larger file, there will also be a level two indirect block and level three indirect block in the node.

2, restore the mistakenly deleted the document method

Most Linux distributions provide a DEBUGFS tool that you can use to edit the Ext2 file system. But before using this tool, there is still work to be done.

The partition in which the deleted file was mistakenly mounted is first reproduced in read-only mode. Use the following command: (assuming the file is in/usr partition)

Mount–r–n–o Remount/usr-r represents a read-only mount;-n means that the/etc/mtab is not written, and if the file on the ETC is restored, this argument is added. If the system says XXX partion busy, you can use the Fuser command to see which processes use the files on this partition:

Fuser–v–m/usr

If there are no important processes, use the command to stop them:

Fuser-k–v–m/usr

You can then mount the file systems again.

If you are installing all the files in one large/partition, you can use Linux single into Single-user mode at the boot prompt to minimize the chance that the system will write data to the hard disk, or simply hang the hard drive on another machine. In addition, the recovered data should not be written to/above to avoid damaging those useful data. If there are dos/windows on the machine, you can write to these partitions:

Mount–r–n/dev/hda1/mnt/had
Then you can perform DEBUGFS: (assuming Linux is/dev/hda5)
#debugfs/dev/hda5
The Debugfs prompt Debugfs appears:
Use the Lsdel command to list information for a number of deleted files:
Debugfs:lsdel
debugfs:2692 deleted inodes found.
Inode Owner Mode Size Blocks time deleted
164821 0 100600 8192 pagination Sun May 13 19:22:46 2001
..................................................................
36137 0 100644 4 pagination Tue APR 24 10:11:15 2001
196829 0 100644 149500 38/38 Mon May 27 13:52:04 2001
Debugfs:

There are a lot of files listed (here are 2,692), the first field is the file node number, the second field is the file owner, the third field is read and write permissions, then the file size, the number of blocks, delete time.