📄 00000005.htm
字号:
<HTML><HEAD> <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>发信人: embonnie (终日乾乾), 信区: Linux <BR>标 题: [文章]通过mc恢复被删除文件[转载] <BR>发信站: BBS 水木清华站 (Tue Oct 3 22:44:38 2000) <BR> <BR>是呀,你们都通过root登录,所以你们删除了不少信件之后就后悔莫及了。 <BR>为了避免国家分配给清华每年最多只能自杀两个人的指标被超越,所以 <BR>特意献上下文,也为清华和其他院校的人做点人道主义的贡献。嘿嘿... <BR> <BR>URL:<A HREF="http://linuxmonth.com/issue2/articles/undelete/undelete.html">http://linuxmonth.com/issue2/articles/undelete/undelete.html</A> <BR>================================================================= <BR>标题:通过mc恢复被删除文件 <BR>作者:William Stearns <BR> <BR>File Recovery <BR>by: William Stearns <BR> <BR>Recovering Deleted Files with "mc" <BR> <BR>There wasn't anything unusual about getting a call at 7pm on a Friday; <BR>when one works at home, one is always accessible. What was unusual was <BR>the tone of voice on the other end; the stress level was unmistakeable. <BR>One of my coworkers was on the other end of the line explaining how an <BR>errant space in a script had, ahem, removed the entire home directory <BR>tree of one of our development machines. <BR> <BR>Once I had explained that Linux doesn't have a true undelete utility, <BR>we started to recover files from our backup tapes. By Monday morning, <BR>most everything was back as it should have been. <BR> <BR>In the stress of the moment, I had forgotten something. It is possible <BR>to recover deleted files from Linux systems, but it needs to be done <BR>soon after the files were nuked. Just like in Windows, if you wait too <BR>long, there's a chance the contents of the files will be overwritten. <BR> <BR>I had learned about this feature while working with the Midnight Commander <BR>file manager in 1998. The delete keystroke will either delete the file <BR>under the cursor, or all of the selected files if any are selected. I <BR>wanted to delete the file under the cursor but had forgotten that all of <BR>the files in my documents directory were selected - you can guess what <BR>happened. It certainly wasn't the file manager's fault; I acknowledged <BR>the request before thinking about the fact that multiple files were selected. <BR> <BR>I certainly thought about it afterwards! *smile* <BR> <BR>Steven Hirsch, a good friend and Linux mentor, was kind enough to explain <BR>how to use a (then specially-compiled version of) Midnight Commander to <BR>recover the files. It was more than a bit ironic that the tool that had <BR>erased my files with the blinding speed one finds in Linux was my best <BR>hope for getting them back. <BR> <BR> <BR>-------------------------------------------------------------------------------- <BR> <BR>While I'm sincerely hoping that you never see hundreds of needed files <BR>evaporating at high speed, I'd like you to be ready when that day comes. <BR>You'll probably want to do this as root; we'll be mounting and unmounting <BR>partitions and working with raw drive partitions. This may be especially <BR>necessary if, like in the following example, you'll be unmounting a partition <BR>like /home. <BR> <BR>Get a copy of Midnight Commander on your system. <BR>While it's certainly not the only program that could have the undelete ability, <BR>it's the program with which I'm most familiar. These days, MC contains the <BR>undelete code by default. If your distribution doesn't have it, get a copy <BR>from <A HREF="http://www.gnome.org/mc/">http://www.gnome.org/mc/</A> and install it. <BR> <BR>The best time to do this is before you delete the files - you want to make as <BR>few changes as possible to a filesystem from which you hope to recover files. <BR> <BR>Create a test file and delete it. <BR>You'll need to do this on a system where you can mount and unmount partitions a <BR>s needed - no fair doing this on your primary web server! <BR> <BR>Pick a partition other than your root partition (use the <BR> <BR>mount <BR>command to see what partitions are mounted). For this example, let's assume that <BR>/dev/sdd1 is mounted on /home. Create a test file with: <BR> <BR>echo "Just a test file" >/home/testfile <BR>rm -f /home/testfile <BR> <BR>If it turns out that the files are on your root partition (or worse yet, you only <BR>have one partition), you'll have to check back next month when I'll cover how to <BR>work safely with the root partition. <BR> <BR>Unmount the partition with the erased file(s). <BR>In this example, that can be accomplished with <BR> <BR>umount /dev/sdd1 <BR> <BR>You should not attempt to undelete files from a mounted partition - you risk <BR>corrupting the drive. <BR> <BR>Start up Midnight Commander and select the files to recover. <BR>mc <BR>Inside mc, type: <BR> <BR>cd undel:/dev/sdd1 <BR>. You can't do this anywhere else but mc. Using the "cd" command in mc normally <BR>does what it would at a shell prompt; it changes directories. This special syntax <BR>instructs mc to display all the undeleted files on that partition instead of the <BR>files in a directory. <BR> <BR>Wait a moment while it searches through that ext2 filesystem for deleted inodes <BR>(an inode holds the _contents_ of a file, but not the directory name, etc.). In <BR>a minute or so, you'll see a list of files with names like "23434632:2" in that <BR>window. The dates and times for the entries are the dates and times when that <BR>inode was deleted. I find it most useful to sort this window according to time: <BR> <BR><F9>, r, s, m, <Enter> <BR> <BR>or <BR><F9>, l, s, m, <Enter> <BR> <BR> <BR>You can use the <F3> "View" feature to look at the contents of the inode. Press <BR><ins> on top of the files that have times around the time you think you deleted <BR>the file(s). This tags them to be undeleted in a moment. <BR> <BR>Undelete the files. <BR>In the other window (use <tab> to switch windows in mc), make an empty directory <BR>under /tmp, such as /tmp/deletedfiles. <BR> <BR>mkdir /tmp/deletedfiles <BR> <BR>Now switch back to your undel window and press <F5> to copy those files to your <BR>real filesystem. If you're done, you can leave mc with the <F10> key - see the <BR>legend at the bottom of the screen. <BR> <BR>This would also be a good time to remount the /home partition with <BR> <BR>mount /home <BR> <BR>At this point you'll probably want to look at each one and decide what the real <BR>name should be. Now that the files are in /tmp/deletedfiles, they can be manipulated <BR>just like any other file, such as: <BR> <BR>cd /tmp/deletedfiles <BR>mv 23434632:2 /home/testfile <BR> <BR>There's a chance you might get multiple copies of some of your files if you deleted <BR>that file more than once; you'll need to decide which is the one you want to keep. <BR> <BR>That's it! You've recovered a file from a Linux partition. <BR> <BR>There are a few more important notes about this process. First, this particular <BR>undelete trick only works for ext2 partitions. Second, if the files were deleted <BR>on a system running a 2.0.x kernel, the undelete process may be limited to recovering <BR>the first 12288 bytes of the file. There was a bug in the deletion process that <BR>didn't keep the entire file as a single unit when it was deleted. While it's possible <BR>that has been fixed in later 2.0.x kernels than I was using, I do know it has been <BR>fixed in 2.2.x kernels. <BR> <BR> <BR>-------------------------------------------------------------------------------- <BR> <BR>The credit for this feature go to Ted T'so and the other authors of the ext2 filesystem, <BR>and to Miguel de Icaza and the other MC authors. <BR> <BR>Many thanks also to Bob DeRosa, for graciously allowing me to republish this in LinuxMonth. <BR> <BR>-------------------------------------------------------------------------------- <BR>William is an Open-Source developer, enthusiast, and advocate from Vermont, USA. <BR>-------------------------------------------------------------------------------- <BR> <BR>-- <BR> <BR>※ 来源:·BBS 水木清华站 smth.org·[FROM: 210.73.87.125] <BR><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER></BODY></HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -