Linux文件删除恢复 [英] Linux file deleted recovery

问题描述

是否可以在Linux中创建链接到特定iNode的文件? 以这种情况为例:正在写入一个文件(可能是一个日志)，并且删除了该特定文件 ，但是dir/proc中的链接仍指向该文件.在这种情况下，我们需要它的不是裸副本，而是硬链接，以便我们可以在进程关闭并系统删除它之前拥有将来的修改和最后的修改.

Is there a way to create a file in Linux that link to a specific iNode? Take this scenario: There is a file that is in course of writing (a log maybe) and the specific file is deleted but a link in the dir /proc is still pointing at it. In this case we need not a bare copy of it but an hard link to it so we can have the future modifications and the most last modification before the process close and the system delete it.

如果我们拥有iNode编号，有没有办法实现这一目标?

If we have the iNode number is there a way to achieve this goal?

推荐答案

由于没有涉及iNode的Syscall，因为这是extX fs的概念，不是一个好习惯，但要制造炉灶，而是要制造一条链关于责任(如MEL所建议的)，此问题只有一个否答案，因为在VFS级别上，我们处理文件的路径和名称，而不处理其他内部表示形式.

Since there is no Syscall that involves iNode, because is a concept of extX fs and is not a good practice make a stove pipe but it is to make a chain of responsability (as M.E.L. suggests), there is only a NO answer for this question because at VFS level we handle files path and names and not other internal representations.

但要以实现跟踪最新修改的目标，我们可以对 tail 使用连续监控和重复:

BUT to achieve the goal to track the most last modification we can use a continous monitoring and duplication with tail:

tail -c+1 -f --pid=PID /proc/PID/fd/FD > /path/to/the/copy

其中PID是仍打开已删除文件的进程的pid，而FD是其文件描述符号.在 -f 尾部打开并按住该文件以显示进一步修改的情况下， -c + 1 从第一个字节开始尾部"，并使用-pid当pid退出时，会通知= PID 尾巴退出.

where PID is the pid of the process that have the deleted file still opened and FD is its file descriptor number. With -f tail open and hold the file to display further modification, with -c+1 start to "tail" from the first byte and with --pid=PID tail is informed to exit when the pid exit.

这篇关于Linux文件删除恢复的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！