Linux能恢复被删除的文件吗？

denglj

系统：CentOS7.6
问题：Linux如何恢复被删除的文件？

Linux删除文件最终调用的是ulink函数，该函数会将对应的文件删除，
如果仍然有进程在使用文件，那么只将对应目录项删除，
数据仍旧可以在进程中访问，等进程退出后，数据才会被完全删除.

所以利用ulink的特性，可以恢复一些被删除的文件，
前提条件是文件还有其它进程在使用.

演练测试过程：
[oracle@hisdb1 dbs]$ ll
total 2060
-rw-rw---- 1 oracle asmadmin    1544 Apr 23 11:52 hc_orcl1.dat
-rw-r----- 1 oracle asmadmin 2097152 Apr 23 12:34 id_orcl1.dat
-rw-r--r-- 1 oracle oinstall    3079 May 14  2015 init.ora
-rw-r--r-- 1 oracle asmadmin    1675 Apr 23 12:34 initorcl1.ora

[oracle@hisdb1 dbs]$ less initorcl1.ora
orcl2.__data_transfer_cache_size=0
orcl1.__data_transfer_cache_size=0
orcl2.__db_cache_size=2634022912
orcl1.__db_cache_size=2483027968
orcl2.__inmemory_ext_roarea=0
orcl1.__inmemory_ext_roarea=0
orcl2.__inmemory_ext_rwarea=0
orcl1.__inmemory_ext_rwarea=0
orcl2.__java_pool_size=83886080
orcl1.__java_pool_size=100663296
orcl2.__large_pool_size=16777216
orcl1.__large_pool_size=16777216
orcl1.__oracle_base='/u01/app/oracle'#ORACLE_BASE set from environment
orcl2.__oracle_base='/u01/app/oracle'#ORACLE_BASE set from environment
orcl2.__pga_aggregate_target=1224736768
orcl1.__pga_aggregate_target=1224736768
orcl2.__sga_target=3640655872
orcl1.__sga_target=3640655872
orcl2.__shared_io_pool_size=134217728
orcl1.__shared_io_pool_size=134217728
...
将less置于后台(Ctrl + z)

恢复到前台
[oracle@hisdb1 dbs]$ fg
less initorcl1.ora

删除文件initorcl1.ora
[oracle@hisdb1 dbs]$ rm initorcl1.ora
[oracle@hisdb1 dbs]$ ll
total 2056
-rw-rw---- 1 oracle asmadmin    1544 Apr 23 11:52 hc_orcl1.dat
-rw-r----- 1 oracle asmadmin 2097152 Apr 23 12:56 id_orcl1.dat
-rw-r--r-- 1 oracle oinstall    3079 May 14  2015 init.ora

说明：less命令依然在运行，也就是文件数据还存在于磁盘上.

查看删除的文件信息
[oracle@hisdb1 dbs]$ lsof |grep initorcl1.ora
less      38696               oracle    4r      REG              253,0      1675 135294796 /u01/app/oracle/product/19.3.0/db/dbs/initorcl1.ora (deleted)

根据删除文件的信息恢复删除的文件
[oracle@hisdb1 dbs]$ cd /proc/38696/fd
[oracle@hisdb1 fd]$ ls
0  1  2  3  4
[oracle@hisdb1 fd]$ cat 4
orcl2.__data_transfer_cache_size=0
orcl1.__data_transfer_cache_size=0
orcl2.__db_cache_size=2634022912
orcl1.__db_cache_size=2483027968
orcl2.__inmemory_ext_roarea=0
orcl1.__inmemory_ext_roarea=0
orcl2.__inmemory_ext_rwarea=0
orcl1.__inmemory_ext_rwarea=0
orcl2.__java_pool_size=83886080
orcl1.__java_pool_size=100663296
orcl2.__large_pool_size=16777216
orcl1.__large_pool_size=16777216
orcl1.__oracle_base='/u01/app/oracle'#ORACLE_BASE set from environment
orcl2.__oracle_base='/u01/app/oracle'#ORACLE_BASE set from environment
orcl2.__pga_aggregate_target=1224736768
orcl1.__pga_aggregate_target=1224736768
orcl2.__sga_target=3640655872
orcl1.__sga_target=3640655872
orcl2.__shared_io_pool_size=134217728
orcl1.__shared_io_pool_size=134217728
orcl2.__shared_pool_size=754974720
orcl1.__shared_pool_size=855638016
orcl2.__streams_pool_size=0
orcl1.__streams_pool_size=33554432
orcl2.__unified_pga_pool_size=0
orcl1.__unified_pga_pool_size=0
*.audit_file_dest='/u01/app/oracle/admin/orcl/adump'
*.audit_trail='db'
*.cluster_database=true
*.compatible='19.0.0'
*.control_files='+DATA/ORCL/CONTROLFILE/current.261.1099913261'
*.db_block_size=8192
*.db_create_file_dest='+DATA'
*.db_name='orcl'
*.diagnostic_dest='/u01/app/oracle'
*.dispatchers='(PROTOCOL=TCP) (SERVICE=orclXDB)'
family:dw_helper.instance_mode='read-only'
orcl2.instance_number=2
orcl1.instance_number=1
*.local_listener='-oraagent-dummy-'
*.nls_language='AMERICAN'
*.nls_territory='AMERICA'
*.open_cursors=300
*.pga_aggregate_target=1155m
*.processes=320
*.remote_login_passwordfile='exclusive'
*.sga_target=3464m
orcl2.thread=2
orcl1.thread=1
orcl1.undo_tablespace='UNDOTBS1'
orcl2.undo_tablespace='UNDOTBS2'

[oracle@hisdb1 fd]$ cat 4 >/u01/app/oracle/product/19.3.0/db/dbs/initorcl1.ora
[oracle@hisdb1 fd]$ cd /u01/app/oracle/product/19.3.0/db/dbs/
[oracle@hisdb1 dbs]$ ll
total 2060
-rw-rw---- 1 oracle asmadmin    1544 Apr 23 11:52 hc_orcl1.dat
-rw-r----- 1 oracle asmadmin 2097152 Apr 23 13:01 id_orcl1.dat
-rw-r--r-- 1 oracle oinstall    3079 May 14  2015 init.ora
-rw-r--r-- 1 oracle oinstall    1675 Apr 23 13:01 initorcl1.ora

根据前面lsof信息，被删除的文件实际就是less程序的文件描述符号4.
注意：Linux系统中使用rm -rf命令一定要谨慎，否则会造成无法估计的后果.