A recovery method for accidentally deleting files under Linux

When a person is operating under Linux, they may encounter that the file they are doing is accidentally deleted by others, and there is no corresponding backup before, then it may need to rewrite the file. The following describes a more practical way to recover accidentally deleted files.

An operation method

1.1 User A is viewing the strace.log file;

1.2 User B deleted this file at this time

1.3 C also wants to see this file and finds that the file is no longer;

1.4 This time uses losf to find the process of the deleted file;

1.5 View the file descriptor associated with the process;
< H2>1.6 copy and restore files;

two principles
Save the directory and name of the process under the /proc partition of the Linux system, including fd (file descriptor) and subdirectories under it (process Open the link to the file), then if you delete a file, there is also a reference to the inode: /proc/process number/fd/file descriptor. As long as we know the process pid and file descriptor fd of the currently open file, we can use the lsof tool to list the files opened by the process.

Three considerations
This method can only be used when the file is used or called. It is suitable for the case where the machine is not shut down and the process is not finished. If the machine has been shut down, you can try to use the rescue mode. The anti-delete tool attempts to recover, as long as the data is not overwritten, there is still a greater chance of retrieving the data.