Accidentally executed rm -f, in addition to running, how to restore?

Foreword

Every time we execute the rm command on a production server environment, always nervous, because accidentally executed mistakenly deleted, then be prepared to run away, after all, people are not machines, not to mention the machine also has bug, ha ha.

If you delete a file you really should not be deleted, such as database, log or execute files, you supposed to do? Information on how funeral, please carefully read this blog.

Simulation scenarios

1. Delete

Accidentally deleted server directory / root / selenium / MySql.Data.dll file under Spider:

image

2. Restore

1. Use the lsof command to see whether the current process open /root/selenium/Spider/MySql.Data.dll file:

image

As can be seen from the above, the current status of the file as deleted (deleted).

2. Check whether there is data recovery:

/ Proc / 13067 / fd: file descriptor directory of the process operations.

86: file descriptor.

cat /proc/13067/fd/86

image

3. Use I / O redirection restore files:

image

Re-run the program:

image

File recovery instructions no problem.

Inquisitive

Through previous simulation scenarios that demonstrate the entire process of restoring the file, then what the principle is, under what circumstances, the file is recoverable.

In the Linux system, each running program has a host process isolated from each other, in order to / proc / process ID to reflect (on Linux is essentially a file system).

For example: ls -l / proc / 13067 13067 for the process to see the process PID information; when the program runs, the operating system will open up a special area of ​​memory available to the current process used to rely on the file, the operating system issued a document describing Fu, in order to read and write files, when we execute rm -f delete files, in fact, just removes the file's directory inode for a file system is not visible, but it is open for the process can still be seen, that you can still use the file previously issued descriptor file read and write, is the use of this principle, so that we can use to redirect the way I O / restore files.

to sum up

If you do not accidentally delete a file, do not worry, the first to use lsof to see the process of opening the file, and then use the cat / proc / process ID / fd / file descriptor view recovery data, and finally the use of I / O redirection way restore files.

Author: justmine
link: http://cnblogs.com/justmine/p/10359186.html

Reproduced in: https: //www.jianshu.com/p/b210d0b8ac2f