search
Homephp教程PHP开发How to recover accidentally deleted files in Linux

What I wrote before

Before starting the tutorial, I need to remind everyone that there is a difference between using the window manager (GUI) to delete files and using the command line tool (CLI) to delete files.

When we use the window manager to delete files, we just move the files from one directory to another (recycle bin). In this case, the only thing that gets updated is the metadata information of your file system index node (inode), such as the timestamp of the deleted file, the storage block occupied by the file, and extended attributes. You can use tune2fs (adjust and view the file system parameters of the ext2/ext3 file system) to view the index node information of the file system. Enter the following command in the command line tool:

sudo tune2fs -l /dev/sda1 |grep -i inode

After running, you will get something similar to the one given below Sample information output:

$ sudo tune2fs -l /dev/sda1 |grep -i inode  
Filesystem features: has_journal ext_attr resize_inode dir_index filetype needs_recoveryextent flex_bg sparse_super large_file 
huge_file uninit_bg dir_nlinkextra_isize 
Inode count:             30007296 
Free inodes:             29382378 
Inodes per group:        8192 
Inode blocks per group:  512 
First inode:             11 
Inode size:              256 
Journal inode:           8 
First orphan inode:      21628027 
Journal backup:          inode blocks

How much do you know about file deletion

When you use SSH to remotely access your computer, you can see all deleted files in the directory "~/.local/share/Trash". In this way, we can directly use the GUI window to restore deleted files, which is very simple. However, when you use the "rm" command to delete a file, the file is not just moved to a hidden directory. At this time, you need to notify the operating system by updating the index node metadata that the disk space previously occupied by this file can continue to be used. The operating system can now directly write other files into this part of the storage space. Next, the operating system may overwrite this part of the disk space after an hour, but it may also take two months to use this part of the storage area, depending on the operating system and file system settings.

When you remove (safely delete) your file, it is equivalent to letting the file system delete the file and then write random data to the part of the storage space previously occupied by the file. For "safe delete" situations, we usually cannot recover deleted files. So the best way is to start file recovery immediately when you realize that you have deleted a file by mistake. The longer you wait, the lower the chance of successfully recovering accidentally deleted files.

How to recover accidentally deleted files on Linux platform?

Currently we have many methods to recover accidentally deleted files on Linux platform, among which the two mainstream options are TestDisk/PhotoRec and extundelete.

PhotoRec is one of the components of TestDisk suite, we can use it to recover individual files. Of course, TestDisk is more powerful and can help us recover file system partitions or disk boot sectors. TestDisk supports current mainstream file systems, and this tool can be used on current mainstream operating system platforms. In this article, we mainly use PhotoRec as an example to explain.

PhotoRec-[Tool Download]

PhotoRec is a data recovery tool used to recover lost videos, documents, compressed packages and other files on hard drives and optical discs. Apart from this, it can also recover lost pictures from SD memory card of digital camera. Hence, the software was named PhotoRecovery. PhotoRec can ignore the file system type and recover data directly from the underlying media. Therefore, it is also capable of data recovery after the media's file system has been severely damaged or reformatted. PhotoRec is an open source, cross-platform free data recovery software protected by the GNU General Public License (GPLV v2+).

Important: Once you find that a picture or file has been lost or accidentally deleted, please do not continue to write new files to the storage device or disk, otherwise you may overwrite the original data. This means that when you use PhotoRec, you should never write the recovered files to the same partition where the original data is located.

OS platforms supported by PhotoRec

-DOS/Win9x  
-Windows NT 4/2000/XP/2003/Vista  
-Linux  
-FreeBSD, NetBSD, OpenBSD 
-Sun Solaris  
-Mac OS X

File systems supported by PhotoRec

-FAT  
-NTFS  
-exFAT  
-ext2/ext3/ext4  
-HFS+

Generally, the file recovery process of PhotoRec is as shown below:

How to recover accidentally deleted files in Linux

extundelete-[Tool Download]

In addition to PhotoRec , we can also choose to use extundelete to complete the data recovery work. extundelete targets ext3 and ext4 file systems, so compared to TestDisk, the scope of use of extundelete is somewhat limited.

Normally, when performing file recovery work, we must first remount the file system and then assign read-only permissions to it. After completion, write the recovered files to another file system to avoid overwriting the storage area where the original data is located. The steps to use extundelete to recover files are very simple. We only need to select the corresponding file system and then run the following command:

extundelete /dev/sda1 --restore-all

Summary

Data recovery is a very complex task, and due to the interference of the operating system, file system and human factors, the files we recover are likely to suffer data loss. So when you find that you have accidentally deleted a file, please stop using your computer immediately and perform data recovery as soon as possible to prevent your accidentally deleted files from being overwritten by other data.


Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
什么是linux设备节点什么是linux设备节点Apr 18, 2022 pm 08:10 PM

linux设备节点是应用程序和设备驱动程序沟通的一个桥梁;设备节点被创建在“/dev”,是连接内核与用户层的枢纽,相当于硬盘的inode一样的东西,记录了硬件设备的位置和信息。设备节点使用户可以与内核进行硬件的沟通,读写设备以及其他的操作。

Linux中open和fopen的区别有哪些Linux中open和fopen的区别有哪些Apr 29, 2022 pm 06:57 PM

区别:1、open是UNIX系统调用函数,而fopen是ANSIC标准中的C语言库函数;2、open的移植性没fopen好;3、fopen只能操纵普通正规文件,而open可以操作普通文件、网络套接字等;4、open无缓冲,fopen有缓冲。

linux中什么叫端口映射linux中什么叫端口映射May 09, 2022 pm 01:49 PM

端口映射又称端口转发,是指将外部主机的IP地址的端口映射到Intranet中的一台计算机,当用户访问外网IP的这个端口时,服务器自动将请求映射到对应局域网内部的机器上;可以通过使用动态或固定的公共网络IP路由ADSL宽带路由器来实现。

什么是linux交叉编译什么是linux交叉编译Apr 29, 2022 pm 06:47 PM

在linux中,交叉编译是指在一个平台上生成另一个平台上的可执行代码,即编译源代码的平台和执行源代码编译后程序的平台是两个不同的平台。使用交叉编译的原因:1、目标系统没有能力在其上进行本地编译;2、有能力进行源代码编译的平台与目标平台不同。

linux中eof是什么linux中eof是什么May 07, 2022 pm 04:26 PM

在linux中,eof是自定义终止符,是“END Of File”的缩写;因为是自定义的终止符,所以eof就不是固定的,可以随意的设置别名,linux中按“ctrl+d”就代表eof,eof一般会配合cat命令用于多行文本输出,指文件末尾。

linux怎么判断pcre是否安装linux怎么判断pcre是否安装May 09, 2022 pm 04:14 PM

在linux中,可以利用“rpm -qa pcre”命令判断pcre是否安装;rpm命令专门用于管理各项套件,使用该命令后,若结果中出现pcre的版本信息,则表示pcre已经安装,若没有出现版本信息,则表示没有安装pcre。

linux怎么查询mac地址linux怎么查询mac地址Apr 24, 2022 pm 08:01 PM

linux查询mac地址的方法:1、打开系统,在桌面中点击鼠标右键,选择“打开终端”;2、在终端中,执行“ifconfig”命令,查看输出结果,在输出信息第四行中紧跟“ether”单词后的字符串就是mac地址。

linux中rpc是什么意思linux中rpc是什么意思May 07, 2022 pm 04:48 PM

在linux中,rpc是远程过程调用的意思,是Reomote Procedure Call的缩写,特指一种隐藏了过程调用时实际通信细节的IPC方法;linux中通过RPC可以充分利用非共享内存的多处理器环境,提高系统资源的利用率。

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
4 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SecLists

SecLists

SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

ZendStudio 13.5.1 Mac

ZendStudio 13.5.1 Mac

Powerful PHP integrated development environment

EditPlus Chinese cracked version

EditPlus Chinese cracked version

Small size, syntax highlighting, does not support code prompt function