Linux rm may not need to run if you accidentally run it

Is it really impossible for us to recover files accidentally deleted under Linux system through software?

File recovery can be divided into two situations

• One is that the process still has deletion information after deletion
• The other is that the process cannot be found after deletion and can only be restored with the help of tools.

Today we will only discuss the situation where the related process still exists after the file is deleted

“

This situation usually occurs when an active process continues to perform standard input or output, causing the process PID to still exist after the file is deleted. This is also the reason why some servers delete certain files but the disk space is not released.

”

Message received. Is it really impossible for us to recover files accidentally deleted under Linux system through software?

File recovery can be divided into two situations - one is that the deletion information still exists in the process after deletion - the other is that the process cannot be found after deletion, and can only be restored with the help of tools.

Today we will only discuss the situation where the related process still exists after the file is deleted > This situation usually occurs when an active process continues to perform standard input or output, causing the process PID to still exist after the file is deleted. This is also the reason why some servers delete certain files but the disk space is not released.

Case Demonstration

Create a file

> vim  rumenz.txt
123
//保存退出
> cat rumenz.txt
123

Use tail -f to open the rumenz.txt

file

“

The purpose is to allow the process to still exist after

rumenz.txt

is deleted

”

> tail -f rumenz.txt

Open a new terminal and deleterumenz.txt

> rm -f rumenz.txt

Find the process occupying rumenz.txt

Use lsof to check whether the deleted file process still exists.
If it is not installed, please yum install lsof or apt-get install lsof

> lsof | grep delete | grep rumenz
tail      10222          root    3r      REG              253,1          4   70911074 /root/test/rumenz.txt (deleted)

“######

进程ID是10222,从上面可以看出，当前文件状态为已删除（deleted）

”

恢复文件

• /proc/10222/fd：进程操作的文件描述符目录

> cd /proc/10222/fd
> ls -al
dr-x------ 2 root root  0 May 11 21:41 .
dr-xr-xr-x 9 root root  0 May 11 21:41 ..
lrwx------ 1 root root 64 May 11 21:41 0 -> /dev/pts/1
lrwx------ 1 root root 64 May 11 21:41 1 -> /dev/pts/1
lrwx------ 1 root root 64 May 11 21:41 2 -> /dev/pts/1
lr-x------ 1 root root 64 May 11 21:41 3 -> /root/test/rumenz.txt (deleted)
lr-x------ 1 root root 64 May 11 21:41 4 -> anon_inode:inotify

“

开始恢复文件

”

> cp 3 /root/test/rumenz.txt
> cat /root/test/rumenz.txt
123

能恢复的根本原因

“

当程序运行时，操作系统会专门开辟一块内存区域，提供给当前进程使用，对于依赖的文件，操作系统会发放一个文件描述符，以便读写文件，当我们执行rm -f删除文件时，其实只是删除了文件的目录索引节点，对于文件系统不可见，但是对于打开它的进程依然可见，即仍然可以使用先前发放的文件描述符读写文件，正是利用这样的原理，所以我们可以使用I/O重定向的方式来恢复文件。

”

The above is the detailed content of Linux rm may not need to run if you accidentally run it. For more information, please follow other related articles on the PHP Chinese website!