Linux controls file deletion by the number of links. A file is deleted only when there are no links In general, each file has two link counters: i_ Count and i_ nlink.
i_ Count means the number of current file users (or called).
i_ The meaning of nlink is the number of media connections (the number of hard links).
It can be understood as i_ Count is the memory reference counter, i_ Nlink is the reference counter of the disk.
When a file is referenced by a process, it corresponds to i_ The count number will increase; When creating a hard link to a file, the corresponding i_ The number of nlinks will increase
For the delete command rm, it actually reduces the disk reference count i_ nlink. There will be a problem here. If a file is being called by a process, but the user executes rm operation to delete the file, what will happen?
When the user executes the rm operation to delete a file, and then executes ls or other file management commands, the file can no longer be found, but the process calling the deleted file continues to execute normally, and can still read and write correctly from the file. This is because the rm operation only transfers_ Nlinks are reduced. If there are no other links, i_ Nlink is 0;
However, since the file is still referenced by the process_ The count is not 0, so even if the rm operation is executed, the system does not really delete this file_ Nlink and i_ When count is all 0, the file will be deleted. That is to say, the process needs to cancel the call to the file.
I mentioned above_ Nlink and i_ Count is the real condition for file deletion. But when the file is not called, can the deleted file still be found after the rm operation is performed to delete the file?
As mentioned earlier, the rm operation is only used to_ The number of nlinks is reduced, or set to 0. In fact, the link between the file name and the inode is deleted. At this time, the entity that did not delete the file (block data block). At this time, if the machine is stopped in time, the data can be retrieved. If the data is continued to be written at this time, the new data may be allocated to the block data block of the deleted data. At this time, the file will be really recycled.
Windows file deletion principle
Each file stored on the hard disk can be divided into two parts:
File header and data area for storing data.
The file header is used to record file name, file attribute, occupied cluster number and other information.
The file header is stored in a cluster and mapped in the FAT table (file allocation table). The real data is stored in the data area.
The usual deletion is actually to modify the first two codes of the file header. This modification is mapped in the FAT table, which marks the deletion of the file, and clears the registration item of the cluster number occupied by the file in the FAT table, indicating that space is freed. This is why the hard disk space increases after deleting the file.
The real file content is still saved in the data area and has not been deleted It is necessary to wait until later data is written and this data area is overwritten, so that the original data can be completely deleted.
If it is not overwritten by later saved data, it will not be erased from the disk.
Format and Fdisk partition are similar to file deletion. The former only changes the partition table, while the latter only modifies the FAT table, without directly deleting data from the data area
According to the principle of file deletion, to completely delete data, only the data area where the deleted file is located can be completely overwritten.
Most complete deletion tools use this principle: write useless data into the data area of the deleted file repeatedly.
The file is overwritten several times to completely delete the file.
Although this kind of pseudo deletion of Windows has brought us benefits and made us regret it, we have trouble with very confidential files and have the possibility of being restored Therefore, when deleting confidential documents, you must use the complete deletion tool to make confidential documents completely “broken”, so that you can rest easy.
Basic principles of data storage and recovery
In reality, many people do not know that the data lost in hard disk operations such as deleting and formatting can be recovered, thinking that the data will not exist after deleting and formatting.
In fact, after the above simple operations, the data still exists in the hard disk. People who know the principles of data recovery can find the lost data in just a few times. Don’t be surprised. After understanding the principles of data storage on hard disk, USB disk, floppy disk and other media, you can also be a magician yourself.
Step 1 – partitioning
The basic unit of hard disk storage data is sector, which can be understood as a page of a book
When we install or buy a mobile hard disk, the first step is to facilitate management – partitioning No matter what partition tool is used, the first sector of the hard disk will be marked with information such as the number of partitions, the size of each partition, and the starting position of the hard disk. The term is called the master boot record (MBR), or the partition information table When the master boot record is damaged due to various reasons (hard disk bad track, virus, misoperation, etc.), some or all partitions will naturally be lost. According to the characteristics of data information, we can recalculate the size and location of the partition, manually mark it to the partition information table, and the “lost” partition will come back.
Step 2 – File Allocation Table
In order to manage file storage, after the hard disk partition is completed, the next task is to format the partition The formatter reasonably divides the partition into directory file allocation area and data area according to the partition size. As we saw in the novel, the first few pages are chapter directories, and the real content is behind.
The file allocation table records the attributes, size, and location of each file in the data area
We operate all files according to the file allocation table After the file allocation table is damaged, the system cannot locate the file. Although the real content of each file is still stored in the data area, the system still thinks that the file does not exist.
Our data is lost, just like the directory of a novel is torn It is impossible to directly go to the chapter you want. To get the content you want (recover data), you can only know the approximate number of pages of the specific content by memory, or find the content you want on each page (sector). Our data can also be recovered.
Step 3 – Format and Delete
When we store files in the hard disk, the system will first write the file name and size in the file allocation table, and continue to write the file content in the starting position of the data area on the file allocation table according to the free space of the data area. Then, the system will start to write the real content of the file to the data area, and a file storage operation is completed.
The deletion operation is very simple. When we need to delete a file, the system just writes a deletion flag in front of the file in the file allocation table, indicating that the file has been deleted, the space occupied by it has been “freed”, and other files can use the space occupied by it.
Therefore, when we delete a file and want to retrieve it (data recovery), we just need to use a tool to remove the deletion flag and restore the data. Of course, if no new file is written, the space occupied by the file is not covered by the new content.
The format operation is similar to the delete operation. It only operates on the file allocation table. However, the format operation is to add a delete flag to all files, or simply empty the file allocation table. The system will assume that there is nothing on the hard disk partition.
The format operation does not perform any operation on the data area. The directory is empty and the content is still there. With the help of data recovery knowledge and corresponding tools, the data can still be recovered.
Step 4 – understand the coverage
Data recovery engineers often say, “As long as the data is not overwritten, the data may be recovered.”
Because of the storage characteristics of the disk, when we do not need the data on the hard disk, the data is not taken away.
When deleting, the system only writes a deletion flag on the file. Formatting and low-level formatting also rewrite the data with the number 0 on the disk. This is overwriting
After a file is marked with the delete flag, the space occupied by it may be overwritten by new files when new files are written.
At this time, although the deleted file name still exists, the space content pointing to the data area has been overwritten and changed, and the recovered content will be the error exception content.
Similarly, the space occupied by the file information marked with deletion in the file allocation table may also be overwritten by the new file name file information, and the file name will no longer exist.
When a partition is formatted, new content is copied. The new data only covers the space before the partition and removes the space occupied by the new content. The unordered content in the data area of the remaining space in the partition may still be reorganized to recover the data
Similarly, data loss caused by cloning, one click recovery, system restore, etc. As long as the space occupied by new data is less than the space capacity before destruction, data recovery engineers may recover the partitions and data you want.
Step 5 – hardware failure data recovery
Hardware failures account for more than half of all accidental data failures. There are often circuit failures caused by lightning, high voltage, high temperature, mechanical failures caused by high temperature, vibration collisions, physical bad track sector failures caused by high temperature, vibration collisions, and aging of storage media. Of course, there is also intentional loss of damaged firmware BIOS information.
Of course, the data recovery of hardware failure is to diagnose first, fix the corresponding hardware failure first, and then repair other software failures according to the remedy, and finally recover the data successfully.
Circuit failure requires us to have a circuit foundation, and we need to have a deeper understanding of the detailed working principle and process of the hard disk. Mechanical head failure requires a worktable or workshop of more than 100 levels to diagnose and repair. In addition, we need some software and hardware repair tools to repair the firmware area and other fault types.
Step 6 – RAID data recovery of disk array.
The storage principle of the disk array will not be explained here, but you can refer to the array knowledge article on this site. The recovery process is also to first remove hardware and software failures, then analyze the array sequence, block size and other parameters, and use the array card or array software to reorganize. After the reorganization, you can recover data according to conventional methods.
Summary
This article is just to give you a basic understanding of the basic principles of data storage and data recovery, not for those who are experts in data recovery The purpose is to make people no longer feel the mystery of data recovery. A little knowledge of data recovery and data recovery principles can save unexpected data to the maximum extent and avoid greater losses. The real principles and data recovery work should be slightly more complex.
