Linux prevention of accidental deletion operations (use safe-rm; use mv command to delete files, accidental deletion recovery method)
The update will be included in the original text: http://alvincr.com/2020/06/linux%e9%98%b2%e8%af%af%e5%88%a0%e6%93%8d%e4%bd%9c %ef%bc%88%e4%bd%bf%e7%94%a8safe-rm%ef%bc%9b%e4%bd%bf%e7%94%a8mv%e5%91%bd%e4%bb%a4 %e5%88%a0%e9%99%a4%e6%96%87%e4%bb%b6%ef%bc%89%ef%bc%88%e6%9b%b4/
1. Why does text-based Linux have no recycle bin?
In my opinion:
1.Linux is a command line operating system. Unlike the graphical interface of win, linux cannot easily recover files quickly. For example, using mv under linux can achieve the same effect as the recycle bin under win, but no one uses mv+file name+ The path method actually only needs to create a folder named trash in the root directory, which can fully realize the function of the recycle bin. What is the specific reason for not using mv? I personally think that it is because of inconvenience and use Most Linux users are not computer novices, and generally know what they are doing.
\2. When linux deletes a file, if you use rm -r, there will be a prompt whether to delete it, similar to the simple recycle bin of win10, but it does not store it, but you need to directly confirm whether the file is deleted. (A lot of materials are taught to use rm -rf when writing code now)
Views of others:
\1.
The tree-shaped file system is not compatible with the recycle bin. Could it be that the eighteenth-level directories are deleted, and when restoring from the recycle bin, restore the entire directory structure again? Most of the things turned out from the trash can in daily life are useless. It is precisely because the operation of deleting a file from the computer does not change the content of the file itself, what is thrown in the trash can can be used again. The problem now is that in fact we only have one form of file system, which is tree-shaped. This is neither necessary nor convenient for storing personal files. We should remove the tree file system. Only keep the index function in BeFS. Deleting a file just marks the file. When the disk space is full, I will prompt you to delete the file. https://www.zhihu.com/question/32294243/answer/135858069
\2.
original:
I think you may be sadly uninformed about what is and OS and what is a GUI.
When using the CLI in either Windows or Linux the delete/rm command does in fact immediately delete a file. And there are utilities that can attempt to recover such files if used immediatel after the mistake happens.
Every GUI I have seen in Linux does have a trash can. Linux GUIs I have seen also come with backup software and if they don’t a script file using rsync isn’t hard to write/find in order to efficiently backup the drives.
You might read this rather dated article about how to use the trashcan even from the CLI.
How to manage Trash can or Recycle bin in Linux Desktop graphic environment
translation:
When using CLI in Windows or Linux, the delete /rm command actually does delete the file immediately. And, if the utility is used immediately after the error occurs, they can try to recover such files.
Every GUI I see in Linux has a trash can. The Linux GUIs I have seen also come with backup software, if they don’t use rsync to write script files, it’s not difficult to write/find in order to effectively backup the drive.
\3. The following view is similar to mine
original:
linux was generally for competent users…you can delete a file and ask for cofirmation rm -i filename.
also a competent user has backups…so even if most files got removed it would be ok
but if a library was removed or something like that, then you are in trouble. as you dont back these things up..and it may make your system unworkable …that said you can easily with a little bit of know how chroot into your system or you can use a live dvd and reinstall the library.
bottom line is once you use linux for a while you will delete required files…but chances are …you will only do this once.
linux is made to be used from command line and in windows if you delete something from command line i dont even think there is a dustbin.
translation:
Linux is usually suitable for capable users… You can delete files and ask for confirmation rm -i filename.
A capable user also has backups…so it doesn’t matter even if most files are deleted
However, if you delete a library or a similar library, you will run into trouble. Because you do not back up these contents, this may make your system not work properly… This means that you can easily import the chroot into the system, or you can use a live DVD and reinstall the library.
The most important thing is that once you use linux for a while, you will delete the files you need…but most likely…you will only do it once.
Linux is used from the command line, in Windows, if you delete something from the command line, I don’t even think there is a trash can.
2. Use the safe-rm package
It is not recommended for users who are familiar with Linux to use this method, this article only provides ideas
Safe-rm is a security tool designed to prevent accidental deletion of important files by replacing /bin/rm with a packaging program that will perform a blacklist of configurable files and directories that will never delete given parameters with an examination.
wget https://launchpad.net/safe-rm/trunk/0.12/+download/safe-rm-0.12.tar.gz
tar -xzvf safe-rm-0.12.tar.gz
cd safe-rm-0.12
vi /etc/profile You can add the PATH path in the last line: PATH=/usr/local/bin:$PATH
source /etc/profile
vi /etc/safe-rm.conf
Then enter the directory of the folder that needs to be protected
Note: Writing this way can prevent the deletion of common files in the test directory and the test directory, but it cannot prevent the link files in the test directory from being deleted. Therefore like
/libor/lib64, directories , there will be a lot of link files to library files underneath, and usingsafe-rmthem does not protect the files . (Reference: https://linuxgeeks.github.io/2015/11/25/172103-%E4%BD%BF%E7%94%A8safe-rm%E9%81%BF%E5%85%8Drm%E5% 91%BD%E4%BB%A4%E8%AF%AF%E5%88%A0%E6%96%87%E4%BB%B6/, Remarks: The method of the reference website can be implemented on my machine. Question, it is not recommended to read the original text)
1.2 Effect: 
3. Disable the rm command and use the mv command instead
It is not recommended for users who are familiar with Linux to use this method, this article only provides ideas
4. Recovery tool extundelete
4.1 Recovery principle:
Under Linux, you can use the “ls -id” command to view the inode value of a file or directory. For example, to view the inode value of the root directory, you can enter:
It can be seen that the inode value of the root directory is 2.
When using extundelete to restore files, it does not rely on a specific file format. First, extundelete will use the inode information of the file system (the inode of the root directory is generally 2) to obtain the information of all files under the current file system, including existing and deleted files , This information includes file name and inode. Then use the inode information combined with the log to query the block location where the inode is located, including direct block, indirect block and other information. Finally, use the dd command to back up the information to restore the data file.
Reference: https://blog.csdn.net/coco3600/article/details/100232811
4.2 Installation and use
Common open source recovery tools are: debugfs, R-Linux, ext3grep, extundelete, the following is the extundelete operation method
1. Install dependencies
2. Unzip the toolkit
3. Specify the installation directory, compile, compile and install
use
Common parameters:
2
3
4
5
6
7
--before dtime 时间参数，表示在某段时间之前被删除的文件或目录
--inode ino 显示节点 ino 的信息
--block blk 显示数据块 blk 的信息
--restore-inode ino 表示恢复节点 ino 的文件，用来恢复单个文件
--restore-file path 表示恢复指定路径下的文件，用来恢复目录下所有文件
--restore-all 表示恢复所有被删除的目录跟文件Start the recovery process:
1. Find the directory id of the deleted file
Note: The leftmost output is the ID number.
2. View the deleted upper directory inode
2
extundelete /dev/sdb1 --inode 1306193. Restore data, restore all deleted data in the specified directory
2
extundelete /dev/sdb1 --restore-directory /xxx/xxx/xxx/4. Complete the follow-up work of recovery
2
cp RECOVERED_FILES/xxx/xxx/* /xxx/xxx/xxx/Method source: https://www.cnblogs.com/xiangsikai/p/10779457.html https://www.cnblogs.com/xiangsikai/p/10779457.html
