网易游戏,【Linux】Linux上简略的文件康复操作,潘多拉魔盒

在 Linux 运用 rm 删去文件后,恢复起来仍是有点费事的,不像 windows 上还有回收站和各种文件恢复软件;而且在删去文件,后履行了很多的 IO 操作,恢复起来更是困难,乃至无法恢复。

rm 删去的实质是履行unlink() 函数,删去目录是履行 remove() 函数;而 unlink() 函数首要做的便是删去文件目录项刘智媛并削减一个衔接数,假如链接数为0而且没有任何进程翻开该文件,文件将会被删去,可是其 inode 节点信息和data bloack依然存在,仅仅解除了链接。假如是最终一个衔接可是有进程翻开文件,文件仍会存在,直到翻开的文件被封闭。

关于 inode表、super block、inode节点、data bl网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒ock不在此赘叙。

rm 的防护办法:

alias rm='rm -i'
###强制删去承认,应写到配置文件中去
alias rm='mv -f $@ ~/backup'
###将rm 换成 mv,每隔一段时间整理 backup文件夹

文件恢复操作:

删去的文件正在被运转的进程运用(I/O操作): lsof

[free@hurd]$ cat file
total 240
drwxrwxr-x 2 free free 4096 Sep 13 11:20 asciiquarium_1.1
-rw-rw-r-- 1 free free 15436 Mar 9 2013 asciiquarium.tar.gz
drwxrwxr-x 5 free free 4096 Apr 25 16:36 bumblebee-Old-and-abbandoned
drwxrwxr-x 2 free free 4096 Apr 23 16:01 cmatrix-1.2a
-rw-r--r-- 1 root root 74376 Apr 23 15:35 cmatrix-1.2a.tar.gz
drwxr-xr-x 3 free free 4096 Sep 30 10:08 extundelete-0.2.4
-rw-rw-r-- 1 free free 108472 Jan 4 2013 extundelete-0.2.4.tar.bz2
-rw-rw-r-- 1 free free 0 Sep 30 11:35 file
drwxrwxr-x 3 free free 4096 Sep 30 10:21 recovertest
-rw-rw-r-- 1 free free 18785 Dec 17 2006 Term-Animation-2.4.tar.gz
[free@hurd]$ cat >> file
test rm file

从头敞开一个终端:

[free@hurd]$ cat file
total 240
drwxrwxr-x 2 free free 4096 Sep 13 11:20 asciiquarium_1.1
-rw-rw-r-- 1 f扁鹊ree free 15436 Mar 9 2013 asciiquarium.tar.gz
drwxrwxr-x 5 free free 4096 Apr 25 16:36 bumblebee-Old-and-abbandoned
drwxrwxr-x 2 free free 4096 Apr 23 16:01 cmatrix-1.2a
-rw-r--r-- 1 root root 74376 Apr 23 15:35 cmatrix-1.2a.tar.gz
drwxr-xr-x 3 free free 4096 Sep 30 10:08 extundelete-0.2.4
-rw-rw-r-- 1 free free 108472 Jan 4 2013 extundelete-0.2.4.tar.bz2
-rw-rw-r-- 1 free free 0 Sep 30 11:35 file
drwxrwxr-x 3 free free 4096 Sep 30 10:21 recovertest
-rw-rw-r-- 1 free free 18785 Dec 17 2006 Term-Animation-2.4.tar.gz
test rm file
###能够看到新增的内容
###然后删去文件
[free@hurd]$ rm file
[free@hurd]$ sudo lsof | grep cat
cat 23877 free cwd DIR 253,1 4096 131380 /home/free/tmp
cat 23877 free rtd DIR 253,1 4096 2 /
cat 23877 free txt REG 253,1 54080 658390 /usr/bin/cat
cat 23877 free mem REG 253,1 106070960 677352 /usr/lib/locale/locale-archive
cat 23877 free mem REG 253,1 2173512 657095 /usr/lib64/libc-2.17.so
cat 23877 free mem REG 253,1 164240 657088 /usr/lib64/ld-2.17.so
cat 23877 free 0u CHR 136,4 0t0 7 /dev/pts/4
cat 23877 free 1w REG 253,1 639 132886 /home/free/tmp/file (deleted)
cat 23877 free 2u CHR 136,4 0t0 7 /dev/pts/4
###看到(deleted)了,找到其pid,进入/proc/pid/fd/
[free@hurd]$ cd /proc/23877/fd
[free@hurd]$ ls -l
total 0
lrwx------ 1 free free 64 Sep 30 11:40 0 -> /dev/pts/4
l-wx------ 1 free free 64 Sep 30 11:40 1 -> /home/free/tmp/file (deleted)
lrwx------ 1 free free 64 Sep 30 11:40 2 -> /dev/pts/4
###文件描述符1尹国驹采访全程视频便是被删去的文件
###将其仿制即可
[free@hurd]$ cp 1 /tmp/file.rec
[free@hurd]$ cat /tmp/file.rec
total 240
drwxrwxr-x 2 free free 4096 Sep 13 11:20 asciiquarium_1.1
-rw-rw-r-- 1 free free 15436 Mar 9 2013 asciiquarium.tar.gz
drwxrwxr-x 5 free free 4096 Apr 25 16:36 bumblebee-Old-and-abbandoned
drwxrwxr-x 2 free free 4096 Apr 23 16:01 cmatrix-1.2a
-rw-r--r-- 1 root root 74376 Apr 23 15:35 cmatrix-1.2a.tar.gz
drwxr-xr-x 3 free free 4096 Sep 30 10:08 extundelete-0.2.4
-rw-rw-r-- 1 free free 108472 Jan 4 2013 extundelete-0.2.4.tar.bz2
-rw-支付宝提现要手续费吗rw-r-- 1 free free 网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒0 Sep 30 11:35 file
drwxrwxr-x 3 free free 4096 Sep 30 10:21 recovertest
-rw-rw-r-- 1 free free 18785 Dec 17 2006 Term-Animation-2.4.tar.gz
test rm file
###恢复成功

删去的文件正在没有被任何进程运用:extundelete

恢复数据之前中止对当时分区做任何I/O操作,避免inode被掩盖

在此仅仅进行简略的操作,并没有运用dd对当时分区进行备份和运用 umount 分区

装置extundelete

[free@hurd]$ wget https://nchc.dl.sourceforge.net/pr三个美妈oject/extu情何以堪是什么意思ndelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
[free@hurd]$ sudo yum -y install gcc-c++ bzip2
[free@hurd]$ sudo yum -y install e2fsprogs e2fsprogs-devel
[free@hurd]$ tar jxvf extundelete-0.2.4.tar.bz2
extundelete-0.2.4/
extundelete-0.2.4/acinclude.m4
extundelete-0.2.4/missing
extundelete-0.2.4/autogen.sh
extundelet女生裸e-0.2.4/aclocal.m4
extundelete-0.2.4/configure
extundelete-0.2.4/LICENSE
extundelete-0.2.4/README
extundelete-0.2.4/install-sh
extundelete-0.2.4/config.h.in
extundelete-0.2.4/src/
extundelete-0.2.4/src/extundelete.cc
extundelete-0.2.4/src/block.h
extundelete-0.2.4/src/kernel-jbd.h
extundelete-0.2.4/src/insertionops.cc
extundelete-0.2.4/src/block.c
extundelete-0.2.4/src/cli.cc
extundelete-0.2.4/src/extundelete-priv.h
extundelete-0.2.4/src/extundelete.h
extundelete-0.2.4/src/jfs_compat.h
extundelete-0.2.4/src/Makefile.in
extundelete-0.2.4/src/Makefile.am
extundelete-0.2.4/configure.ac
extundelete-0.2.4/depcomp
extundelete-0.2.4/Makefile.in
extundelete-0.2.4/Makefile.am
[free@hurd]$ cd extundelete-0.2.4/
[free@hurd]$ ./configure
Configuring extundelete 0.2.4
Writing generated files to disk
[free@hurd]$ make
make -s all-recursive
Making all in src
extundelete.cc: In function ‘ext2_ino_t find_inode(ext2_filsys, ext2_filsys, ext2_inode*, std::string, int)’:
extundelete.cc:1272:29: warning: narrowing conn秦港version of ‘search_flags’ from ‘int’ to ‘ext2_ino_t {aka unsigned int新西兰签证}’ inside { } [-Wnarrowing]
buf, match_name2, priv, 0};
^

[free@hurd]$ sudo make install
Making install in src
/usr/bin/install -c extundelete '/usr/local/bin'

###装置完结
###检查文件体系和挂载
[free@hurd]$ df -lh
Files柯震东终身禁演令ystem Type 1K-blocks Used Available Use% Mounted on
/dev/vda1 ext4 41151808 5292972 33745404 14% /
devtmpfs devtmpfs 497112 0 497112 0% /dev
tmpfs tmpfs 507704 0 507704 0% /dev/shm
tmpfs tmpfs 507704 428 507276 1% /run
tmpf斗破天穹彩鳞s tmpfs 507704 0 507704 0% /sys/fs/cgroup
tmpfs tmpfs 101544 0 101544 0% /run/user/1001
###挂载在根目录下,文件体系是/dev/vda1
[free@hurd]$ mkdir recovertest捷安特
[free@hurd]$ cd recovertest
###创立目录以作恢复测验运用
###删去文件测验
[free@hurd]$ rm /home/free/file
###直接恢复一切文件
[free@hurd]$ sudo /usr/local/bin/extundelete /dev/vda1 --restore-all
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those 网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
y
Loading filesystem metadata ... 320 groups loaded.
Loading journal descriptors ... 29380 descriptors loaded.
Searching for recoverable inodes in directory / ..网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒.
22 recoverable inodes found.
Looking through the directory structure for deleted files ...
Unable to restore inode 266403 (var/lib/yum/transaction-done.2018-09-30.13:02.11): Space has been reallocated.
Unable to restore inode 266331 (var/lib/rsyslog/imjournal.state.tmp): Space has been real网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒located.
Unable to restore inode 266320 (var/lib/ntp/drift.TEMP): Space has been reallocated.
Unable to restore inode 266319 (var/cache/yum/x86_64/7/base/repomd.xml.old.tmp): Space has been reallocated.
Unable to restore inode 266374 (var/cache/yum/x86_64/7/base/repomdGvOHrztmp.xml): Space has b青翅隐翅虫een reallocated.
Unable to restore inode 266325 (var/cache/yum/x86_64/7/epel/repomd.xml.old.tmp): Space has been reallocated.
Unable to restore inode 266326 (var/cache/yum/x86_64/7/extras/repomd.xml.old.tmp): Space has been reallocated.
Unable to restore inode 266328 (var/cache/yum/x86_64/7/updates/repomd.xml.old.tmp): Space has been reallocated.
Unable to restore inode 266327 (var/cache/yum/x86_64/7/gf/repomd.xml.old.tmp): Space has been reallocated.
8 recoverable inodes still lost.
Unable to restore inode 266323 (file.2663黎安安顾璟琛23): Space has been reallocated.
Unable to restore inode 266324 (file.266324): Space has been reallocated.
Unable to restore inode 266334 (file.266334): Space has been reallocated.
Unable to restore inode 266371 (file.266371): Space has been reallocated.
Unable to restore inode 266372 (file.266372): Space has been reallocated.
Unable to restore inode 266386 (file.266386): Space has been reallocated.
Unable to restore inode 660679 (file.660679): Space has been reallocated.
Unable to restore inode 674046 (file.674046): Space has been reallocated.
[free@hurd]$ cd RECOVERED_FILES/
###恢复的文件都在 RECOVERED_FILES/目录下
[free@hurd]$ ls
home lost+found tmp var
[free@hurd]$ ls home/free
tmp
###此处能够看到咱们恢复失利了
###此办法失利也很正常,由于各种 I/O或许会操作掩盖文件的inode信息
###但也是有或许成功恢复文件的
###extundelete的用法
[free@hurd]$ extundelete --help
Usage: extundelete [options] [--] device-file
Options:
--version, -[vV] Print version and exit successfully.
--help, Print this help and exit successfully.
--superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
--journal Show content of journal.
--after dtime Only process entries deleted on or after 'dtime'.
--before dtime Only process entries deleted before 'dtime'.
Actions:
--inode ino Show info on inode 'ino'.
--夏普电视block blk Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RECOVERED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
生日蛋糕图片大全 of the partition and does not start酷狗铃声 with a '/'
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
局气 Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--restore-directory 'path'
上位电影 Will restore directory 'path'. 'path' is relative to the
root directory of the file system. The restored
directory is cr网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒eated in the output directory as 'path'.
--restore-all Attempts to restore everything.
-j journal Reads an external journal from the named file.
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize Uses blocksize as the block size when opening the file
system. The number should be the number of bytes.
--log 0 Make the program silent.
--log filename Logs all messages to filename.
--log D1=0,D2=filename Custom control of log messages with comma-separated
Examples below: list of options. Dn must be one of info, warn, or
--log info,error error. Omission of the '=name' results in messages
--log warn=0 with the specified level to be logged to the console.
--log error=filename If the parameter is '=0', logging for the specified
level will be turned off. If the parameter is
'=filename', messages with that level will be written
to filename.
-o directory Save the recovered files to the named directory.
网易游戏,【Linux】Linux上简略的文件恢复操作,潘多拉魔盒 The restored files are created in a directory
named 'RECOVERED_FILES/' by default.