On the Linux file (a) inode and block, hard links and soft links, recover accidentally deleted files

A, inode and block

1.inode and block Overview

File data includes meta-information and the actual data, a file must occupy one inode, but at least take up a block.

Sector: file is stored on the hard disk, the hard disk is the smallest unit of storage sectors, each sector is 512 bytes of storage space.
Block (Block): eight successive sectors of a block, block of file access is the minimum unit for storing data files.
the inode (inode): also known as i-node for storing the meta information file.

2.inode understanding

(1) inode contains meta-information file:

• Number of bytes in the file
• File's Owner User ID (UID)
• Group ID file (GID)
• File has read, write, and execute permissions
• Timestamp file (atime, ctime, mtime)

When we want to see a file's inode information, use the "stat" command, directly connected to the back of the path and file name.

[root@localhost opt]# stat test/
  文件："test/"
  大小：24         块：0          IO 块：4096   目录
设备：802h/2050d   Inode：33574981    硬链接：2
权限：(0755/drwxr-xr-x)  Uid：(    0/    root)   Gid：(    0/    root)
环境：unconfined_u:object_r:usr_t:s0
最近访问：2019-08-28 11:39:33.953003238 +0800
最近更改：2019-08-28 11:39:20.023004045 +0800
最近改动：2019-08-28 11:39:20.023004045 +0800
创建时间：-
[root@localhost opt]# 

The three main time property (2) file:

• The last time a file or directory: atime (access time)
• ctime (change time): Last change a file or directory (attributes) of time
• mtime (modify time): last modified files or directories (content) of time

3.inode number

Each has an inode number, operating system files are identified by a different inode number. Internal Linux system that does not use a file name to identify the file name for the file system is the inode number. The file name is just easy to remember user name, the equivalent of inode number of nicknames. In fact, this is equivalent to our phone contacts, usually as long as we can remember the name of the contact to dial his cell phone, but really used to connect the call is stored in the address book of your mobile phone number. Move or rename a file, it will only change the file name, inode number is unchanged.

(1) When the user opens a file, the system inside the file name follows:

• The system will first find the inode number corresponding to the file name
• Get inode number inode information (see the meta-information to see if there is access)
• According inode information, where to find the data block file, read data

(2) View inode number of methods:

ls -i command: View inode number corresponding to the file name

[root@localhost opt]# ls -i test/
34964204 test01.txt
[root@localhost opt]#

stat command: View file inode number inode information

[root@localhost opt]# stat test/test01.txt 
  文件："test/test01.txt"
  大小：13         块：8          IO 块：4096   普通文件
设备：802h/2050d   Inode：34964204    硬链接：1
权限：(0644/-rw-r--r--)  Uid：(    0/    root)   Gid：(    0/    root)
环境：unconfined_u:object_r:usr_t:s0
最近访问：2019-08-28 11:39:34.875003185 +0800
最近更改：2019-08-28 11:39:20.023004045 +0800
最近改动：2019-08-28 11:39:20.023004045 +0800
创建时间：-
[root@localhost opt]# 

4.inode size

inode will consume disk space, typically the size of each inode is 128 bytes or 256 bytes, when formatting the file system determines the total number of the inode.

df -i command: see the total number and inode number has been used for each hard disk partition

[root@localhost opt]# df -i
文件系统          Inode        已用(I)        可用(I)       已用(I)% 挂载点
/dev/sda2      10485760  121223   10364537          2% /
devtmpfs         229705     368          229337           1% /dev
tmpfs            233378        1                233377         1% /dev/shm
tmpfs            233378         599           232779       1% /run
tmpfs            233378        16             233362         1% /sys/fs/cgroup
/dev/sda5     5241856     144          5241712       1% /home
/dev/sda1     3145728     328          3145400       1% /boot
tmpfs            233378         6             233372         1% /run/user/42
tmpfs            233378         20           233358         1% /run/user/0
[root@localhost opt]# 

The special role 5.inode

When we delete the file name contains special characters that can not use the keyboard to knock out, it can not lead us to delete the file. At this point we can directly delete files by inode.

Second, the hard links and soft links

In the linux file system is a kind of link files, you can use to solve the shared files. The link can be divided into two types, one is a hard link (Hard Link), the other is also referred to as a soft link or symbolic link (Symbolic Link).

In the Linux system, multiple file names point to the same inode, generally referred to as hard links on this link. One of the roles of hard links allow a file has multiple valid path names, so that users can create hard links to important files to prevent accidental deletion of important files, but hard links only between files in the same file system link, and directory can not be created. In fact, the file name is equivalent to hard link, when we establish a hard link to the file, delete it again the source file, which is equivalent to delete a hard link. But meta information and then stores the data in any block in the inode. When the last hard link is deleted, its meta-information and data in any course, but the system will release its inode number to number pool, when there is a new file acquired after the inode number, it's meta-information and data It will be covered.

软链接，其实与windows系统中的快捷方式很相似，与硬链接不同，软链接就是一个普通文件，只是数据块内容有点特殊，文件用户数据块中存放的内容是另一文件的路径名的指向，通过这个方式可以快速定位到软连接所指向的源文件实体。软链接可对文件或目录创建，当源文件被删除后，软链接也就失效了。

ln命令：创建硬链接。

[root@localhost test]# ls
test01.txt
[root@localhost test]# ls -l
总用量 4
-rw-r--r--. 1 root root 13 8月  28 11:39 test01.txt
[root@localhost test]# ln test01.txt t01.txt
[root@localhost test]# ls -i
34964204 t01.txt  34964204 test01.txt
[root@localhost test]# ls -l
总用量 8
-rw-r--r--. 2 root root 13 8月  28 11:39 t01.txt
-rw-r--r--. 2 root root 13 8月  28 11:39 test01.txt
[root@localhost test]#

我们可以看到，文件和它的硬链接的inode号码是相同的，所以无论我们用哪个打开它的内容都是相同的。

ln -s命令：创建软链接

[root@localhost test]# ls
test01.txt
[root@localhost test]# ln -s test01.txt t01.txt
[root@localhost test]# ls
t01.txt  test01.txt
[root@localhost test]#

file命令：查看文件类型

[root@localhost test]# file test01.txt 
test01.txt: ASCII text
[root@localhost test]# cd ../
[root@localhost opt]# file test/
test/: directory
[root@localhost opt]# 

三、恢复误删文件

1.恢复Linux6版本的EXT4类型的文件

安装extundelete软件包，先安装它的依赖包。

输入：cd /mnt/Packages/
输入：rpm -ivh e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
输入：rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
输入：rpm -ivh libcom_err-devel-1.41.12-18.el6.x86_64.rpm
输入：rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm

我们先新建一个目录，再将我们本地的工具包挂载到目录中。

输入：mkdir /extundel
输入：mount.cifs //192.168.100.50/share/ /extundel/
输入：df -h

将挂载过来的工具压缩包解压到“/opt/”目录中

输入：cd /extundel/
输入：tar jxvf extundelete-0.2.4.tar.bz2 -C /opt/

用“cd”命令进入“/opt/extundelete-0.2.4/”目录，安装编译器，因为现在的源码包是用C语言写的，不能直接用。

输入：cd /opt/extundelete-0.2.4/
输入：yum install gcc gcc-c++ -y

编译安装extundelete工具。

输入：./configure
输入：make
输入：make install

添加一块磁盘，对磁盘进行配置，配置完后，将磁盘分区格式化，文件格式为ext4，再创建一个目录“/data/”，并将磁盘分区挂载到目录下。

进入到“/data/”目录，创建三个文件a、b、c。然后再将三个文件删除，模拟文件误删。

我们先返回宿主目录，然后将sdb1解挂载。然后用“extundelete /dev/sdb1 --restore-all”来恢复删除的所有文件。注意：当你误删文件后，第一时间一定要将设备解挂载，因为如果有新的文件将删除的文件inode号给占用了就无法恢复了。（工作环境中一定要注意备份）

我们用“cd”命令进入到“RECOVERED_FILES/”目录中就能看到恢复的文件了。

2.恢复Linux7版本中的XFS类型文件。

xfsdump命令：备份系统文件

Format: Path xfsdump -f backup storage location or device files to be backed up
common options:

-f：-------------------指定备份文件位置
-L：------------------指定备份会话标签（免交互）
-M：-----------------指定设备标签（免交互）
-s：------------------备份指定的文件，使用相对路径，相对于备份的文件系统路径

xfsrestore command: restore the backup system files

: Format Location xfsrestore -f restore files after location for recovered files

Common options:

-f：-----------------------指定备份文件位置
-s：----------------------恢复指定文件恢复
-t：-----------------------查看文件的内容及详细信息

First, add a hard disk, and then configure partition, reformatting the formatted xfs file format type, mounted to the new directory of "/ data /" below.

Copy the passwd file into the "/ data /" directory, and then in the "/ data /" directory Create a "test" directory, and create an empty file in the directory.

Exit "/ data /" directory, then back up sdb1 partition file to "/ opt /" directory named "xfs_dump"

[root@localhost ~]# xfsdump -f /opt/xfs_dump /dev/sdb1                //备份命令
                                  ..................................                                           //省略部分
please enter label for this dump session (timeout in 300 sec)
 -> xfs_dump                                                                                       //输入备份后文件名
session label entered: "xfs_dump"
                                  .....................................                                     //省略部分
please enter label for media in drive 0 (timeout in 300 sec)
 -> sdb1                                                                                            //输入备份分区
media label entered: "sdb1"
                                   .........................................                           //省略部分
xfsdump: Dump Status: SUCCESS

Delete all files in "/ data /" directory, analog accidentally deleted files.

Deletion is complete we will return to "/ data /" by xfsrestore command file directory.