Akwanhyia rm -rf anaa Shift-Delete wɔ Linux, macOS, anaa Windows: Ntɛm ara akenkan-nko Remount¶

Hwɛ a wobɛhwɛ biribi a ɛbae wɔ akwanhyia mu rm -rf, . find -delete, . git clean -fdx, anaa Windows Shift+Delete popa production databases a ɛho hia, source code, anaa ankorankoro fael ahorow a womfa nkɔ Recycle Bin anaa Trash folda mu no kanyan ehu ntɛm ara. Nanso, emu biara nni hɔ rm -rf saa ara nso na Shift+Delete nokwarem no, zeroes out wo underlying storage sectors bere a ahyɛde no awie: mmom no, operating system no yiyi directory entry no mu kɛkɛ, ɛyɛ ne metadata journal no foforo, na ɛhyɛ saa inode pointers anaa Master File Table no agyirae (MFT) kyerɛwtohɔ ne block bitmaps sɛnea ɛwɔ hɔ a wobetumi asan de adi dwuma. Nea ɛsɛe wo fael a woapopa no daa ne sekan biara fael nhyehyɛe no kɔ so yɛ nea wɔde ahyɛ akenkan-kyerɛw mu (rw) mode akyi deletion, sɛnea akyi nhyehyɛe loggers (systemd-journald, . rsyslog), browser caches, swap dwumadi, ne SSD TRIM / . discard ahyɛde ahorow no kyerɛw block ahorow a wɔade wɔn ho foforo no so ntɛmntɛm. Sɛ wo system no rehu amane mmom wɔ honam fam kliki, sectors bɔne, anaa controller a awu ho a, gyae na dan kɔ yɛn guide on no so hard drive a entumi nyɛ adwuma yiye ne data a wɔsan nya, anaasɛ sɛ wo solid-state drive no atoto ne ho esiane controller wear nti a, hwɛ SSD ne NVMe mpofirim akenkan nkutoo mode ne TRIM a ɛma nkwagye yɛ adwuma; sɛ wopɛ mfomso a ɛtrɛw wɔ formatting mu anaasɛ camera card ho nsɛm a, hwɛ fael a wɔpopa wɔ akwanhyia mu, formatted drive, ne mfonini a wɔsan nya. Sɛ asɛm yi fa nsɛmmɔnedifo a wɔsɛe nneɛma, apoobɔ, anaasɛ nkwa ho ahobammɔ nhyehyɛe a wɔatwa ho a, frɛ wo mpɔtam hɔ nɔma a egye ntɛmpɛ (911 wɔ United States ne Canada no, . 112 wɔ Europa Aman Nkabom no nyinaa mu, . 999 wɔ United Kingdom) anaa hwɛ yɛn amanaman ntam nsɛmma nhoma a ɛfa nɔma ahorow a egye ntɛmpɛ.

Yɛ eyi mprempren¶

1. Nsɛm so dua Ctrl+C ntɛm ara sɛ deletion command no da so ara reyɛ adwuma a, na MMFA terminal windows biara a wɔabue, text editors, media players, anaa database daemons: Sɛ program biara a ɛreyɛ adwuma (nginx, . postgres, . mysqld, . vim, . code, . python, . tail, anaa video player) da so ara wɔ fael a wɔapopa no abue wɔ memory mu, Linux anaa macOS kernel no ma fael no data blocks no kɔ so yɛ adwuma wɔ disk so kosi sɛ saa adeyɛ no bɛto ne fael descriptor no mu. Sɛ woto application no mu anaasɛ wosan bɔ afiri no mprempren ara a, ɛbɛma reference count no afi hɔ ntɛm ara (i_nlink == 0) na ɛkanyan block deallocation ankasa.
2. Ansa na wobɛsan de ahyɛ Linux so anaasɛ wobɛdum no, hwɛ /proc/<pid>/fd/ seesei ara sɛ wobɛgye fael biara a wɔapopa a ɛda so ara kura mu abue denam dwumadie a ɛretu mmirika so: Tu mmirika sudo lsof +L1 (a ɛkyerɛ fael a wɔabue nyinaa a ɛwɔ link count a ennu 1, a ɛkyerɛ sɛ na ɛnyɛ linked denam rm bere a ɛda so ara abue) na ntɛm ara kɔpi wɔn raw contents fi RAM/kernel cache kɔ drive soronko anaa /dev/shm (tmpfs RAM disk) a wɔde di dwuma cp /proc/<pid>/fd/<fd_number> /dev/shm/rescued_file.
3. San fa mpaapaemu a ɛka ho no si Read-Only (ro) ntɛm ara enti OS kernel no ntumi nkyerɛw baiti biako foforo a ɛyɛ journal logs anaa temp fael ahorow no nkɔ blocks a wɔankyekyɛ no so:
4. Wɔ Linux so (ext4, . XFS, . Btrfs): Mmirikatu sudo mount -o remount,ro /path/to/mountpoint (sɛ nhwɛso no, . sudo mount -o remount,ro /home anaasɛ sudo mount -o remount,ro /).
5. Sɛ mount -o remount,ro di nkogu wɔ mount point is busy wo ntini so ( ./) partition: Kanyan kernel no ntɛm ara ntɛm akenkan-nko remount denam Magic SysRq denam mmirikatu so echo u | sudo tee /proc/sysrq-trigger (a ɛhyɛ fael nhyehyɛe a wɔde ahyɛ mu nyinaa ma wɔsan de akenkan nkutoo nhyɛ mu ntɛm ara a enkum nhyehyɛe ahorow anaasɛ ɛntwɛn sɛ wɔbɛbue apon).
6. Wɔ macOS so (APFS / . HFS+): Mmirikatu sudo diskutil mount readOnly /Volumes/TargetVolume ma non-boot volumes, anaasɛ sɛ fael ahorow no wɔ wo primary so a Data ɛnne nnyigyei (/System/Volumes/Data), ntɛm ara hyɛ anyinam ahoɔden dum denam Touch ID / Power bɔtn a wobɛkura mu sikani 10 na ama akyi Spotlight (mds_stores) ne fseventsd kyerɛw.
7. Wɔ Windows so (NTFS / . ReFS): Sɛ na fael ahorow a wɔapopa no wɔ secondary drive (D:, . E:), bue Administrator Command Prompt na to volume a wɔkenkan nkutoo so diskpart (select volume D, . attributes volume set readonly). Sɛ na fael ahorow no wɔ so a C:\, nto Windows sɛnea ɛte biara (toto a ɛyɛ daa kyerɛw megabytes ɔhaha pii registry hives, event logs, ne pagefile updates so freed MFT akuwakuw akuwakuw); mmom no, twe desktop power cord no anaa kura laptop power button no mu sikani 10 na twa anyinam ahoɔden no ntɛm ara.
8. Siw SSD kwan TRIM (discard / . UNMAP) fi zeroing a wɔankyekyɛ flash nkratafa: Sɛ draibɛ no yɛ NVMe anaa SATA SSD na na wɔde kɔ so ahyɛ mu a discard (anaasɛ sɛ Windows/macOS tu mmirika nhyehyɛe a TRIM ntɛm ara bere a wɔapopa fael no), twa ahoɔden anaasɛ remounting ro ntɛm ara na ɛma OS no ntumi nkɔ ntonto mu foforo NVME_DSM_ATTR_DEALLOCATE ahyɛdeɛ, ne SSD no a wode bɛto USB-to-NVMe bridge adapter a ɛntwam mu TRIM bere a wɔresan agye no siw controller no akyi nwura a wɔboaboa ano no kwan sɛ ɛbɛpopa blocks a wobetumi asan anya.
9. Boot fi abɔnten Live USB (Ubuntu Live, . SystemRescue, anaa WinPE) na clone mpaepaemu no bit-for-bit kɔ abɔnten storage drive a wode di dwuma ddrescue ansa na woayɛ undelete adwinnade biara: Ntu mmirika da ext4magic, . extundelete, . testdisk, . photorec, anaa ntfsundelete tẽẽ wɔ write mode mu tia victim drive no; bere nyinaa mfonini a wɔde siw afiri no ano (sudo ddrescue -d -r0 /dev/nvme0n1p2 /mnt/external/disk_image.raw /mnt/external/rescue.map) na di wo fael ahorow no fi mfonini no mu anaasɛ kyerɛw fael ahorow a wɔasan anya no katee kɔ honam fam disk a ɛto so abien so.
10. Hwɛ mpɔtam hɔ fael nhyehyɛe mfonini ahorow a ahintaw (Btrfs, . ZFS, . LVM, macOS APFS Time Machine local snapshots, ne Windows Volume Shadow Copies) ansa na wode nnɔnhwerew pii ayɛ raw sectors: Nhyehyɛe pii kura atom point-in-time block references komm (tmutil listlocalsnapshots / wɔ macOS so no, . vssadmin list shadows wɔ Windows so, . zfs list -t snapshot, anaa btrfs subvolume list -s /) a ɛma kwan ma wɔsan nya ahoɔden ɔha biara mu nkyem 100 ntɛm ara rm -rf anaasɛ Shift+Delete directory ahorow a ɛnka raw unallocated clusters.

--- .

Gyinaesi dua: triage ntɛm ara wɔ akwanhyia akyi rm -rf anaasɛ Shift+Delete¶

Di saa gyinaesi dua yi akyi wɔ sikani 60 a edi kan a woahu sɛ wɔapopa no mu na woakora ɔha biara mu nkyem a ɛkorɔn sen biara a ebetumi aba wɔ data blocks a enni abusuabɔ no so:

flowchart TD
    Start["Akwanhyia rm -rf, hwehwɛ -popa, anaa Shift+Popa Wɔadi"] --> OpenCheck{"So Adeyɛ Biara a Ɛrekɔ So (DB, Editor, Server, Tail) Da so ara Betumi Abue Fael a Wɔapopa no?"}

    OpenCheck -->|"Yiw (Linux / macOS Da so ara Yɛ Adwuma)"| ProcRescue["ANAMMƆN 1: Tu sudo lsof +L1 Ntɛm ara na Kɔpi Open File Descriptors fi /proc/PID/fd/N kɔ RAM Disk (/dev/shm) anaa External USB"]
    OpenCheck -->|"Dabi (Anaasɛ Wɔtoo Fael Nyinaa Mu) ."| SnapCheck{"So Volume no De ZFS, Btrfs, APFS Local Snapshots, anaa Windows Shadow Copies Di Dwuma?"}

    ProcRescue --> FreezeOS["ANAMMƆN 2: Freeze Disk Writes Nyinaa Ntɛm ara"]
    SnapCheck -->|"Yiw: CoW Snapshot Wɔ Hɔ"| FreezeOS
    SnapCheck -->|"Dabi: Standard ext4, XFS, anaa NTFS a Ɛnyɛ Mfoninitwa"| FreezeOS

    FreezeOS --> OSBranch{"Operating System ne Partition Bɛn na Wɔbɔɔ?"}

    OSBranch -->|"Linux Ɛnyɛ Ntini (/fie, /data) ."| RemountRO["Run: sudo mount -o san fa so,ro /beae"]
    OSBranch -->|"Linux Ntini (/) Nkyekyɛmu"| SysRqRO["Mmirikatu: echo u | sudo tee /proc/sysrq-trigger (Kernel Ntɛmntɛm Akenkan-Nkutoo Remount)"]
    OSBranch -->|"Windows C: Drive anaa macOS Boot APFS"| HardPower["MMƆ DWUMA Mpɛn pii: Kura Tumi Bɔton no mu Sikɔne 10 anaa Twe Tumi Nhama no na Siw Tumi no ano Log/Pagefile Writes"]
    OSBranch -->|"Secondary Abɔnten anaa Data Drive"| UnmountSec["Yi / Set Volume Read-Only Ntɛm ara na Twa Drive no mu"]

    RemountRO --> LiveBoot["ANAMMƆN 3: Boot Abɔnten SystemRescue Live USB ne Clone Partition ne ddrescue kɔ Abɔnten Drive"]
    SysRqRO --> LiveBoot
    HardPower --> LiveBoot
    UnmountSec --> LiveBoot

    LiveBoot --> FSRecovery{"Paw Recovery Method denam Faelsystem so"}
    FSRecovery -->|"ntrɛwmu4 / ntrɛwmu3"| ExtRec["Journal Inode a Wɔsan Yɛ: ext4magic / extundelete / debugfs"]
    FSRecovery -->|"XFS / APFS / Wɔnkyerɛw nsɛmma nhoma"| CarveRec["Nsaano nkyerɛwee ne Ti/Ase hɔ Nsusuwii: photorec / scalpel / anim / xfs_irecover"]
    FSRecovery -->|"NTFS (Mfɛnsere) ."| NtfsRec["MFT Kyerɛwtohɔ Nkyekyɛmu: ntfsundelete / TestDisk / UFS Explorer / DMDE"]

--- .

Nea enti a sekan biara a wɔde asisi so Read-Write (rw) sɛe fael ahorow a wɔapopa no¶

Sɛ wopɛ sɛ wote nea enti a ntɛm ara akenkan nkutoo remounting anaasɛ hard power cutoff yɛ nkwa anaa owu gyinaesi ma wo data no ase a, hwehwɛ nea nnɛyi fael nhyehyɛe biara sesa ankasa bere a woretu mmirika no unlink() (rm) anaasɛ DeleteFileW() (Shift+Delete): .

1. Nea ɛkɔ so wɔ mu ext4, . XFS, . APFS, na NTFS bere a wɔrepopa no¶

Sɛ wɔpopa fael bi a, adetɔfoɔ dwumadie nhyehyɛeɛ biara nsɛe disk I/O bandwidth kyerɛw zero wɔ 10 gigabyte (10.7 billion byte) database anaa video fael so. Mmom, faelsystem draiver no sesa metadata nhyehyɛe nketenkete nkutoo:

2. SSD no TRIM (Discard / . Deallocate) Bere mu Ɔtopae¶

Wɔ hard drive a ɛredi akɔneaba so ( .HDD), sectors no tra hɔ a wotumi kenkan kosi sɛ wɔbɛkyerɛw so. Wɔ SSD so (SATA anaasɛ NVMe), bere a fael nhyehyɛe bi de a TRIM anaasɛ Deallocate hyɛ: - NVMe controllers dodow no ara de Deterministic Read Zero di dwuma wɔ TRIM akyi (DRAT / . DZAT), a ɔresan aba 0x00000000 (zero nyinaa) fi Flash Nkyerɛase Layer (FTL) ntɛm ara bere a wɔagye no TRIM, ansa na wɔreyɛ NAND nwura a wɔboaboa ano honam fam mpo. - Nea enti a Linux nhyehyɛe taa tra ase TRIM: Linux nkyekyɛmu dodow no ara (Ubuntu, . Debian, . Fedora, . RHEL) mma nkɔ so mount-time ntumi nyɛ adwuma discard sɛnea wɔahyɛ no; wɔde dapɛn dapɛn bere kyerɛwtohɔ (fstrim.timer). Sɛ wosan de akenkan nkutoo (ro) ansa na fstrim.timer runs, SSD no nnya nyii saa blocks no nyɛɛ ho mfonini.

--- .

Ɔfã 1: Fael ahorow a wɔapopa a wɔda so ara kura mu a nhyehyɛe bi a ɛrekɔ so no gye (/proc/<pid>/fd/) .¶

Ansa na wobɛsan ahyɛ aseɛ, ayi afiri so, anaa wobɛto mfɛnsere baako mu wɔ Linux anaa macOS so no, hwɛ sɛ fael nkyerɛkyerɛmufoɔ abue. Wɔ POSIX nhyehyɛe ahorow mu no, . rm frɛ unlink(). Kernel no di akontaabu abien akyi ma inode biara: 1. ** i_nlink: On-disk directory nsɛm a ɛkyerɛ inode no. 2. ** i_count: Active processes a ɛkura inode no mu bue wɔ memory mu.

POSIX mmara a ɛyɛ sika kɔkɔɔ: Kernel no nnye inode no da anaasɛ ɛnsɛe disk blocks kosi sɛ ABIEN no nyinaa i_nlink == 0 NE i_count == 0 na ɛyɛ. Sɛ database, log, video, anaa code fael a wɔapopa no da so ara abue wɔ adeyɛ biara mu a, saa fael no ɔha biara mu nkyem 100 kɔ so yɛ nea enni dɛm wɔ disk so.

Anamɔn biara /proc/<pid>/fd/ extraction wɔ Linux so¶

1. Hwehwɛ fael biara a wɔapopa a ɛda so ara kura mu abue denam adeyɛ biara so:

   sudo lsof +L1
   

   (Anaasɛ fa fael din yiyi mu: sudo lsof | grep -i "(deleted)" | grep -i "filename") .
2. Kenkan asɛm no lsof nsɛm a wɔde fi mu ba adum: .

   COMMAND    PID     USER   FD   TYPE DEVICE  SIZE/OFF   NLINK    NODE NAME
   postgres  4182 postgres   14u   REG  259,2 524288000       0 1839204 /var/lib/postgresql/16/main/base/16384/16399 (deleted)
   

   Hyɛ no nsow sɛ ** .PID** ( ) .4182) na yi nkyerɛwde a edi akyi no (u, . r, . w) efi ** .FD** ( ) .14u -> ** .14**).
3. Copy fael raw no fi mu /proc/<pid>/fd/<fd_num> kɔ RAM (/dev/shm) anaasɛ abɔnten so drive: Mma nkyerɛw fael a wɔagye no nsan nkɔ mpaapaemu a ɛka ho no so da. Kyerɛw kɔma /dev/shm (RAM disk) anaa USB draibɛ a ɛwɔ akyi:

   mkdir -p /dev/shm/rescued_files
   sudo cp /proc/4182/fd/14 /dev/shm/rescued_files/16399_recovered
   

4. Gye fael ahorow pii a wɔabue a wɔapopa afi database anaa adekorabea (PID=4182) wɔ loop biako mu:

   sudo mkdir -p /dev/shm/rescued_db
   for fd in /proc/4182/fd/*; do
     target=$(sudo readlink "$fd")
     if echo "$target" | grep -q "(deleted)"; then
       fd_num=$(basename "$fd")
       clean_name=$(echo "$target" | sed 's/ (deleted)//; s/\//_/g')
       sudo cp "$fd" "/dev/shm/rescued_db/fd_${fd_num}${clean_name}"
     fi
   done
   

5. Nkwagye buffers ne IDE Mpɔtam Abakɔsɛm (vim, . VS Code, . Cursor, . JetBrains):
6. Nto editor tabs a wɔabue mu: Sie buffers a wɔabue no tẽẽ wɔ /dev/shm anaasɛ nsateaa a wɔde di dwuma.
7. VS Code / Cursor / VSCodium Local History: Ɛkora fael biara a wɔakora so no mfonini a wɔde bere ahyɛ mu a ɛnyɛ adwuma wɔ mu -/.config/Code/User/History/ (Linux), . -/Library/Application Support/Code/User/History/ (macOS), anaasɛ %APPDATA%\Code\User\History\ (Windows), a ɛwɔ wo project folda no akyi koraa. Ɛno akyi mpo rm -rf -/my-project anaasɛ git clean -fdx, wo code fael ahorow no kɔ so yɛ nea ɛte saa wɔ mu User/History/ ne an entries.json manifest mapping fael biara san kɔ ne mfitiaseɛ kwan so.
8. JetBrains IDE ahorow (IntelliJ, . PyCharm, . WebStorm): Ɛkora abakɔsɛm a ɛyɛ adwuma ankasa so wɔ mu -/.cache/JetBrains/<IDE>/LocalHistory/.
9. Git ( ) .git reset --hard anaasɛ git branch -D ne .git/ intact): Mmirikatu git reflog anaasɛ git fsck --lost-found ntɛm ara na ama wɔasan anya blobs a ɛsensɛn mu no .git/objects/.

--- .

Ɔfã 2: Faelsystem no a wɔbɛma ayɛ nwini Read-Only (ro) a wonkyerɛw block ahorow a wɔankyekyɛ no so¶

Bere a woayi fael nkyerɛkyerɛmu biara a wɔabue afi mu no /proc (anaasɛ wɔagye atom sɛ biara nni hɔ), nea ɛho hia wo ntɛm ara ne sɛ wubegyae adwumayɛ nhyehyɛe no sɛ ɛbɛkyerɛw sector foforo biako akɔ mpaapaemu no mu.

1. Linux: Data Partition a wɔsan de si hɔ vs. Ntini no (/) Partition Akenkan-Nkutoo¶

• Scenario A: Na fael ahorow a wɔapopa no wɔ mpaapaemu a ɛyɛ soronko so (/home, . /var, . /data, . /mnt/storage):
• Bɔ mmɔden ntɛm ara sɛ wobɛsan de akenkan nkutoo na ɛho tew:

  sudo mount -o remount,ro /home
  

• Sɛ mount ka mount point is busy, kyerɛ na gyae akyerɛw nhyehyɛe ahorow no (sudo fuser -vm /home akyi no sudo fuser -km -TERM /home), afei ntɛm ara san tu mmirika sudo mount -o remount,ro /home.
• Nsɛm B: Na fael ahorow a wɔapopa no wɔ Root (/) mpaepaemu (anaasɛ worentumi nkum nnwuma a adagyew nnim): Ntu mmirika sudo reboot anaasɛ sudo shutdown -h now, efisɛ ɛyɛ ade a ɛyɛ daa systemd shutdown kyerɛw megabytes a ɛyɛ journald shutdown logs, random seeds, ne service state fael ahorow a ɛkɔ so tẽẽ /. Mmom, kanyan Linux Kernel Magic SysRq Emergency Read-Only Remount no:

  echo 1 | sudo tee /proc/sys/kernel/sysrq
  echo s | sudo tee /proc/sysrq-trigger
  echo u | sudo tee /proc/sysrq-trigger
  

• ** s (Emergency Sync): Flushes pending in-memory faelsystem metadata enti superblock no yɛ pɛpɛɛpɛ.
• ** u (Emergency Remount Read-Only): Ɛsan de ahoɔden san fa fael nhyehyɛe biara a wɔde ahyɛ afiri no so sɛ Read-Only (ro) wɔ kernel no mu, sɛ mpo processes da so ara wɔ fael ahorow a wɔabue ama akyerɛw a. Hwɛ sɛ ɛyɛ nokware / mprempren yɛ akenkan nkutoo ne grep " / " /proc/mounts.

2. Mfonini a wɔde yɛ Remote Cloud Server a wɔahyɛ no nwini (AWS EC2, . GCP, . DigitalOcean, . Hetzner) wɔ SSH so¶

Sɛ wotuu mmirika wɔ akwanhyia mu a rm -rf wɔ akyirikyiri cloud server a wuntumi mfa USB drive nhyɛ mu so: 1. Fa Magic SysRq akenkan nkutoo remount (echo s > /proc/sysrq-trigger && echo u > /proc/sysrq-trigger). Wo SSH nhyiamu a ɛwɔ hɔ dada no tena ase ɛfiri sɛ SSH tu mmirika wɔ RAM mu na /dev/pts (devpts) yɛ virtual RAM pseudo-terminal fael nhyehyɛe. 2. Wɔ mununkum platforms (AWS EC2, GCP, Azure, DigitalOcean), ntɛm ara fa atom EBS / Block Volume Snapshot fi mununkum console, anaa gyae nhwɛso no, yi ntini volume no, na fa bata akenkan nkutoo ho (/dev/xvdf) kɔ VM a ɛho tew a wɔde gye nkwa mu. 3. Wɔ bare-metal remote server so no, fa frozen read-only partition a wɔabɔ no raw mfonini a wɔahyɛ no den no fa SSH so tẽẽ kɔ wo mpɔtam hɔ adwumayɛbea:

ssh root@remote-server-ip "dd if=/dev/nvme0n1p2 bs=4M status=progress | zstd -1" > ~/rescued_partition.img.zst

--- .

Ɔfã 3: Hwɛ Copy-on-Write a ahintaw (CoW) mfonini ahorow ne Shadow Copies ansa na wɔadi adwini¶

Ansa na wobɛhwehwɛ terabytes a ɛwɔ sectors a wɔankyekyɛ mu no, hwɛ sɛ wo operating system no ankasa yɛɛ point-in-time snapshot a ahintaw anaa:

1. macOS: Mpɔtam Hɔ Bere Mfiri APFS Mfoninitwa (tmutil) .¶

Sɛ mpo wɔayi wo Time Machine drive a ɛwɔ akyi no afiri mu adapɛn pii a, macOS no ankasa kyerɛw dɔnhwerew biara mpɔtam hɔ APFS Copy-on-Write snapshots wɔ wo SSD a ɛwɔ mu no so (com.apple.TimeMachine.YYYY-MM-DD-HHMMSS.local) bere biara a wɔbɛhyehyɛ Time Machine anaasɛ ansa na macOS updates: 1. Kyerɛw mpɔtam hɔ mfonini ahorow nyinaa wɔ Terminal:

tmutil listlocalsnapshots /
tmutil listlocalsnapshots /System/Volumes/Data

mkdir -p /tmp/apfs_rescue
sudo mount_apfs -o ro -s com.apple.TimeMachine.2026-10-31-140000.local /System/Volumes/Data /tmp/apfs_rescue
ls -la /tmp/apfs_rescue/Users/yourname/

2. Windows 10 / 11 / Server: Volume Sunsuma Nkyerɛwee (VSS) .¶

1. Bue Administrator Command Prompt na tu mmirika:

   vssadmin list shadows
   

2. Sɛ Sunsuma Nkyerɛwee (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1) di kan ansa na wo Shift+Delete, fa bata folda bi ho na kɔpi wo fael ahorow no kɔ USB drive so:

   mklink /d C:\ShadowRescue \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
   

3. Linux ho nsɛm: . Btrfs, . ZFS, na LVM Mfonini ahorow a wɔayɛ no ntɛm¶

• So Btrfs (Fedora, openSUSE, Synology, Bere a Wɔde Sesa/Snapper nhyehyɛe ahorow): Tu mmirika sudo btrfs subvolume list -s / na wɔahwɛ mu /.snapshots/ anaasɛ /run/timeshift/backup/timeshift-btrfs/snapshots/.
• So ZFS (Ubuntu ZFS, Proxmox, TrueNAS): Tu mmirika zfs list -t snapshot na kɔpi fael ahorow tẽẽ fi /path/to/dataset/.zfs/snapshot/.

--- .

Ɔfa 4: Anamɔn biara Inode, Journal, ne MFT Recovery by Filesystem¶

Sɛ fael nkyerɛkyerɛmu a wɔabue biara nni hɔ a (/proc/<pid>/fd/) na mfonini biara nni hɔ, boot fi SystemRescue anaa Ubuntu Live USB, fa abɔnten USB hard drive (/mnt/external), na yɛ bit-for-bit clone a ɛfa victim mpaapaemu a wɔanhyɛ no so (/dev/nvme0n1p2) deɛ ɛdi kan:

sudo ddrescue -f -n /dev/nvme0n1p2 /mnt/external/victim_partition.img /mnt/external/ddrescue.log

1. Sɛ obi ho bɛtɔ wo afi ext4 / . ext3 wɔ Linux so (ext4magic na extundelete) .¶

Bere a rm -rf popa fael ahorow wɔ so ext4, kernel no zero fi extent dua pointers a ɛwɔ inode table titiriw no mu. Nanso, ** .ext4's jbd2 journal (mpɛn pii no ne kɛse yɛ megabytes 128 kosi megabytes 1,024) sie abakɔsɛm mu mfonini ahorow a ɛfa inode blocks a wɔasesa no nnansa yi ara ho**. Bere tenten a wosan de wo ho hyɛɛ mu no ro ansa na disk dwumadi a emu yɛ duru rebɔ journal ring buffer no, . ext4magic yi inode a wɔadi kan apopa no fi journal no mu na ɛsan kyekye wo fael ahorow no a mfitiase fael din ne daerekta nnua a enni dɛm.

1. Mmirikatu ext4magic sɛnea ɛbɛyɛ a wobɛsan anya fael ahorow a wɔapopa wɔ nnɔnhwerew 2 a atwam no mu nyinaa (-a) wɔ ɔkwan bi a ɛfa ho mu ( .-f): (Yi slash a edi kan a ɛwɔ mountpoint no mu no fi mu -f: ma /home/kmyers/project wɔ ntini bi so / mpaepaemu, twam -f home/kmyers/project; sɛ /home ne n’ankasa mpaapaemu, pass -f kmyers/project.) .

   mkdir -p /mnt/external/recovered_ext4
   sudo ext4magic /mnt/external/victim_partition.img \
     -a $(date -d "2 hours ago" +%s) \
     -f home/kmyers/project \
     -R -d /mnt/external/recovered_ext4
   

2. Akwan foforo: Mmirikatu extundelete tia ohoni no:

   cd /mnt/external
   sudo extundelete /mnt/external/victim_partition.img --restore-directory home/kmyers/project
   

2. Woresan afi Windows so NTFS akyi Shift+Delete (TestDisk na ntfsundelete) .¶

Nea ɛnte sɛ ext4, Mfɛnsere mu NTFS ƐNNYƐ zero mfi block extent pointers no mu (Data Runs) wɔ Master Fael Table ( ) no mu.$MFT) kyerɛw bere a wɔapopa fael bi. Bere a wo mia so no Shift+Delete wɔ NTFS so no, na ɛyɛ 1,024-byte $MFT entry kɛkɛ flips ne header frankaa fi 0x01 (Wɔde Di Dwuma) to 0x00 (Wɔapopa). Ɛyɛ $FILE_NAME su ne $DATA cluster runlist kɔ so yɛ ɔha biara mu nkyem 100 kosi sɛ fael foforo bɛsan de saa adi dwuma $MFT kwan:

1. Ɔde di dwuma TestDisk ma NTFS a ɛba ntɛm ara $MFT undeletion ne folda akwan a edi mũ:

   sudo testdisk /mnt/external/victim_partition.img
   

   Yi ho [ Proceed ] -> [ EFI GPT ] -> [ Advanced ] -> twe adwene si NTFS mpaepaemu no so -> [ Undelete ] na ɛyɛ. Kɔ wo folda no so, mia ** .a** sɛ wopɛ sɛ wopaw fael ahorow a wɔapopa, na mia ** .C** (kɛseɛ C) sɛ wobɛsuasua wɔn akɔ /mnt/external/recovered_ntfs/.
2. Ɔde di dwuma ntfsundelete (ntfs-3g):

   sudo ntfsundelete /mnt/external/victim_partition.img -t 2d
   sudo ntfsundelete /mnt/external/victim_partition.img -u -m "*" -d /mnt/external/recovered_ntfs
   

3. Sɛ obi ho bɛtɔ wo afi XFS, . APFS, anaa Nsɛmma Nhoma a Wɔakyerɛw So denam Raw Block Carving so (PhotoRec na grep -a -b) .¶

Bere a inode pointers no ayera (te sɛ nea ɛwɔ ** .XFS, ** .APFS, anaasɛ ** bi .ext4** mpaepaemu a ne journal abɔ mu), san nya data denam scanning a wɔankyekyɛ 4,096-byte (4 kilobyte) blocks ahwehwɛ fael headers/footers anaa text strings soronko:

Sɛnea wɔde di dwuma grep -a -b + dd sɛ wobɛgye source code a wɔapopa anaa .env fael ahorow no wɔ nea ennu simma 2 mu¶

Sɛ wopopa source code a, . .env ahintasɛm, anaa nsɛm a wɔakyerɛw a ne kɛse nnu kilobytes 32: 1. Hwehwɛ ahama soronko wɔ fael a wɔapopa no mu na tintim ne byte offset pɛpɛɛpɛ (-b): .

LC_ALL=C grep -a -b -o "def calculate_invoice_tax" /mnt/external/victim_partition.img

dd if=/mnt/external/victim_partition.img bs=4096 skip=11789795 count=30 status=none > /mnt/external/rescued_code_block.txt

--- .

Ɔfã 5: Ɔsɛe a ɛbɛba daakye a wobesiw ano rm -rf na Shift+Delete akwanhyia ahorow¶

• Sesa nkitahodi nhyehyɛe rm ne trash-cli na rm -I --preserve-root=all: Fa si hɔ trash-cli (trash-put, . trash-list, . trash-restore) ne din foforo rm to rm -I --preserve-root=all mu /etc/bash.bashrc na -/.zshrc enti akwanhyia mu recursive deletions bisa pɛnkoro ansa na unlink inodes.
• Fa Linux Immutable Attribute (chattr +i): Mpo root (sudo rm -rf) ntumi mpopa anaasɛ nsakra daerekta anaa fael a wɔahyɛ no agyirae sudo chattr +i /path/to/critical_config kosi sɛ ɔhwɛfo bi bɛtu mmirika sudo chattr -i.
• Ma Automated Local Copy-on-Write nyɛ adwuma (CoW) Mfonini ahorow ( .Btrfs / . ZFS / . APFS / . Windows Shadow Copies): Fa di dwuma Snapper anaasɛ Timeshift so Btrfs, . sanoid so ZFS, anaasɛ Volume Shadow Copies a wɔde di dwuma mprenu da biara wɔ Windows so (SystemPropertiesProtection.exe).
• Maintain Automated 3-2-1 Backups ne Immutable Offsite Storage: Di yɛn akwankyerɛ no akyi kɔ kɔmputa so backups, 3-2-1 nhyehyɛe, ne atoyerɛnkyɛm bere mu ahotɔ de di dwuma restic anaasɛ borgbackup ne akyirikyiri adekorabea ahorow a wɔde ka ho nkutoo.

--- .

Mpɔtam hɔ ntɛmpɛ nɔma ne adwumakuw no nhyehyɛe ahorow¶

Bere a fael a wɔpopa wɔ akwanhyia mu wɔ ankorankoro kɔmputa so yɛ mfiridwuma mu asɛm a egye ntɛmpɛ sen sɛ ɛbɛyɛ polisifo asɛm no, popa a wɔpopa wɔ akwanhyia mu anaa adwemmɔne so a ɛka akwahosan ho nhyehyɛe, kurow no mu nneɛma, mmara kwan so adanse a ɛwɔ asɛnnibea ahyɛde a wɔde kora so, anaa ankorankoro ho nsɛm a wɔahyɛ ho mmara ase no betumi akanyan asɛm a esii ho amanneɛbɔ a ɛyɛ ahyɛde:

• Amerika ne Canada:
• Asetra-Ahobammɔ a Ɛho Hia Ntɛmntɛm / Nneɛma a Ɛho Hia a Wɔatwa: Dial 911 sɛ nhyehyɛe bi a wɔpopa ka ayaresabea ayarefo hwɛ, ntɛmpɛ a wɔde kɔ, anaa mfiridwuma mu nipadua mu ahobammɔ ho nhyehyɛe so nkɛntɛnso a.
• Internet so Ahobammɔ ne Nneɛma a Wɔde Yɛ Adwuma Ahobammɔ Dwumadibea (CISA) (US): Bɔ infrastructure data a ɛho hia a wɔsɛee anaasɛ wosusuw sɛ insider sabotage ho amanneɛ wɔ ** .1-844-Say-CISA (1-844-729-2472)** anaasɛ cisa.gov/report.
• Canada Asoɛe a Ɛhwɛ Intanɛt So Ahobammɔ So: Nkitahodi 1-833-CYBER-88 (1-833-292-3788) ma nsɛm a ɛho hia a ɛsisi wɔ infrastructure ho.
• Ahemman Nkabom:
• Nneɛma a Ɛho Hia Ntɛmntɛm: Dial 999 (anaasɛ 101 ma polisifoɔ a wɔnyɛ ntɛmpɛ amanneɛbɔ sɛ wɔde kɔmputa a wɔde di dwuma ɔkwammɔne so a wɔamma ho kwan wɔ Computer Misuse Act 1990 ase a wɔpopa no ho a).
• Nsɛm ho amanneɛbɔfo Dwumadibea (ICO): Sɛ popa a wɔpopa wɔ akwanhyia mu no sɛe ankorankoro data daa a wonnya backup recovery biara (a ɛyɛ Availability Breach wɔ UK GDPR ase) a, hwɛ sɛ ebia amanneɛbɔ a wɔde kɔma ICO (0303 123 1113) wɔ nnɔnhwerew 72 mu no, wɔhwehwɛ.
• Europa Aman Nkabom Kuo:
• Nneɛma a Ɛho Hia Ntɛmntɛm: Dial 112 wɔ aman a wɔka EU ho nyinaa mu.
• GDPR Ahyɛdeɛ 33 Amanneɛbɔ a ɛfa Mmara a Wɔabu So wɔ Nneɛma a Ɛwɔ Hɔ Ho: Wɔ Europa Nsɛm Ho Banbɔ Boayikuo ase (EDPB) akwankyerɛ ahorow, wɔde ankorankoro data a wɔsɛe no daa wɔ akwanhyia mu a enni backup a wobetumi asan anya no mu sɛ ankorankoro data a wɔabu so (a ɛyera a ɛwɔ hɔ) na ebetumi ahwehwɛ sɛ wode amanneɛbɔ ma wo man Data Protection Authority (DPA) wɔ nnɔnhwerew 72 ntam.
• Australia ne New Zealand:
• Nneɛma a Ɛho Hia Ntɛmntɛm: Dial 000 wɔ Australia anaa ** .111** wɔ New Zealand.
• Australia Intanɛt so Ahobammɔ Asoɛe (ACSC): Frɛ ** .1300 CYBER1 (1300 292 371)** ma nnwuma anaa nnwumayɛbea mmoa.
• India ne Asia-Pacific:
• India ( .CERT-In / Ɔman Intanɛt so Nsɛmmɔnedi Mmoa Dwumadibea): Dial 112 ma ntɛmpɛ ho mmuae anaa ** .1930** ma kɔmputa so nsɛmmɔnedi ho nsɛm a esisi; ɛsɛ sɛ wɔbɔ nnwuma mu nsɛm a ɛsisiiɛ a CERT-In ahyɛdeɛ no ka ho amanneɛ wɔ nnɔnhwereɛ 6 ntam kɔ incident@cert-in.org.in.

--- .

Nsɛm a wɔtaa bisa¶

Dɛn nti na wɔanyɛ saa extundelete anaasɛ ext4magic hwehwɛ me fael din ahorow wɔ so ext4 ɛwom mpo sɛ migyaee kɔmputa no a mede di dwuma ntɛmntɛm koraa de?¶

Bere a wɔapopa fael bi wɔ nkyekyɛmu4, Linux kernel no zero ntɛm ara fi extent dua pointers a ɛwɔ on-disk inode table no mu enti faelsystem no nim sɛ inode no nni extents a wɔakyekyɛ. Nnwinnade te sɛ ext4nkɔmfoɔ na extundelete a wɔde hyɛ mu fa wo ho to hwehwɛ dedaw, pre-deletion copy a ɛwɔ saa inode no mu so nkyekyɛmu4 nsɛmma nhoma (jbd2). Sɛ wɔbɔɔ fael no na wɔpopae a ne inode no antwam nnansa yi ara wɔ journal no mu, anaasɛ sɛ akyi nkyerɛwee a emu yɛ duru abɔ 128 MB to 1 GB journal ring buffer no ansa na woresan ahyɛ akenkan nkutoo so a, journal copy no ayera. Sɛ ɛba saa a, ɛsɛ sɛ wodan kɔ raw block signature carving (PhotoRec) anaasɛ baiti a wɔde hwehwɛ nsɛm a ɛnyɛ den ( .grep -a -b), a ɛhwehwɛ data blocks a wɔankyekyɛ no tẽẽ a enhia inode metadata.

So SSD yɛ saa TRIM sɛe bere nyinaa rm -rf anaasɛ Shift+Delete fael ahorow no ntɛm ara?¶

Ɛnyɛ bere nyinaa, titiriw wɔ Linux ne abɔnten drive ahorow so. Wɔ Windows 10/11 ne macOS a ɛwɔ NVMe SSDs mu no, dwumadie nhyehyɛeɛ no taa de inline kɔ TRIM / . Deallocate a wɔde kyekyɛ nneɛma mu ahyɛde a wɔde kɔ SSD controller no mu wɔ sikɔne kakraa bi akyi bere a wɔapopa daa, a ɛma SSD no Flash Translation Layer (FTL) sɛ wobɛsan de zero ( .DZAT na ɔkyerɛwee) ma saa block ahorow no. Nanso, Linux nkyekyɛmu dodow no ara (Ubuntu, Debian, Fedora, RHEL) yɛ saa ɛnyɛ saa ma ɛnyɛ adwuma a ɛkɔ so mount-time tow gu sɛnea wɔahyɛ no; mmom no, wotu mmirika fstrim.bere a wɔde yɛ adwuma pɛnkoro dapɛn biara. Bio nso, USB-to-SATA ne USB-to-NVMe abɔnten so enclosures pii ntwam TRIM ahyɛde ahorow a ɛfa USB Mass Storage (BOT), ne software RAID / LVM / LUKS layers taa siw ano tow gu passthrough by default gye sɛ wɔahyehyɛ no pefee (`issue_discards = 1` anaasɛ `allow-discards`).

Na sɛ me Linux mpaepaemu no yɛ encrypted ne LUKS (dm-crypt) anaasɛ me Windows drive no de di dwuma BitLocker: metumi da so ara ayɛ fael ahorow a wɔapopa?¶

Yiw, sɛ wowɔ encryption passphrase anaa recovery key na wobue container no wɔ read-only mode mu a. Mmirikatu da photorec, . ext4nkɔmfoɔ, anaa testdisk a wɔde sɔ hwɛ tia honam fam mpaapaemu a wɔabɔ no kokoam raw ( ./dev/nvme0n1p2 na ɛwɔ hɔ), efisɛ ciphertext a wɔabɔ no kokoam no te sɛ dede a ɛba kwa. Mmom, boot fi Live USB, bue container no mu akenkan nkutoo mode (ma LUKS: sudo cryptsetup bue --akenkan nko ara /dev/nvme0n1p2 crypt_recue; ma BitLocker wɔ Linux so: dislocker -r anaasɛ bue akenkan nkutoo wɔ WinPE mu), na mfonini anaa scan virtual mapper device a wɔabɔ no afi mu no (/dev / mapper / crypt_gye_gye).

Dɛn nti na wɔretwe anyinam ahoɔden nhama no wɔ Windows so C:\ ahobammɔ wom wɔ akwanhyia bi akyi Shift+Delete sen sɛ wobɛbɔ "Shut down"?¶

Sɛ wobɔ so a Fi ase > To mu wɔ Windows so no, operating system no yɛ megabytes ɔhaha pii disk kyerɛw ansa na adum: ɛhohoro registry hives no, kyerɛw shutdown events to .evtx na ɛyɛ logs, yɛ USN Journal no foforo ($UsnJrnl na ɛyɛ adwuma), yi fi hɔ anaasɛ ɛsesa ne kɛse krataafafael.sys, na wɔ Fast Startup nhyehyɛe ahorow so no kyerɛw hibernation fael a ɛwɔ gigabyte pii (hiberfil.sys na ɛyɛ adwuma) tẽẽ wɔ NTFS akuakuo a wɔankyekyɛ no so. Saa shutdown writes no taa kyerɛw nea wɔankyekyɛ no pɛpɛɛpɛ no so $MFT kyerɛwtohɔ ne data akuwakuw a wo Shift+Popa no. Sɛ wohyɛ sɛ wudum anyinam ahoɔden ntɛm ara (wokura tumi bɔtn no mu sikani 10 anaasɛ wotwe plɔg no) a, ɛma nkyerɛwee nyinaa gyae ntɛm ara; NTFS bɛkɔ so akenkan koraa bere a wɔabɔ no afi Linux anaa WinPE nkwagye USB a wɔkenkan nkutoo so.

Mɛyɛ dɛn atumi asan anya deleted .env fael, SSH safoa, anaa fibea koodu fael a PhotoRec wobu ani gu so?¶

PhotoRec hwehwɛ binary magic byte headers (te sɛ %PDF, . PNG, anaa PK ma ZIP/Office fael ahorow), enti ɛtaa huruw anaasɛ ɛboaboa fael ntiantiaa a wɔakyerɛw no pefee te sɛ .env nhyehyeɛ, Python/JavaScript fibea koodu, Markdown nsɛm, ne SSH safoa. Sɛ wopɛ sɛ wosan nya fael biara a wɔakyerɛw no pefee afi disk mfonini anaa mpaapaemu a wɔkenkan nkutoo mu a, tu mmirika LC_ALL=C grep -a -b -C 100 "NKYERƐKYERƐMU_SUO_AFI_FAYƐL_MU" /dev/nvme0n1p2 > /dev/shm/found.txt. Sɛ wunim variable din biara (te sɛ STRIPE_AHINTASƐM_SAFO= anaasɛ FI SƐ OPENSSH PRIVATE KEY MU), . grep -a -b scan raw sectors no wɔ gigabytes pii wɔ sekan biara mu na tintim disk blocks a atwa ho ahyia no pɛpɛɛpɛ.

Sɛ mituu mmirika wɔ akwanhyia mu a rm -rf / anaasɛ wɔapopa /usr anaasɛ /lib wɔ Linux so na seesei ɛnyɛ mpo ls, . cp, anaa sudo yɛ adwuma, mɛyɛ dɛn ayɛ ahyɛde ahorow wɔ me terminal a wɔabue mu no mu?¶

Sɛ wopopae a /bin anaasɛ /lib bere a ɛyɛ nea ɛwɔ hɔ dedaw bash anaasɛ zsh terminal da so ara abue wɔ RAM mu, abɔnten binaries te sɛ /bin/ls, na ɛyɛ adwuma anaasɛ /bin/cp bedi nkogu wɔ Fael anaa directory a ɛte saa biara nni hɔ, . nanso shell built-ins da so ara yɛ adwuma koraa wɔ RAM mu. Wubetumi de adi dwuma echo * . mmom sen sɛ ls, . printf "% s\n" "$( /dev/shm/wɔagye mmom sen sɛ cp, na echo u > /proc/sysrq-asɛm a ɛkanyan no (sɛ wo shell no yɛ root dedaw a) de kanyan akenkan nkutoo kernel remount ansa na woadum na woabɔ SystemRescue Live USB.

--- .

Akwankyerɛ ahorow a ɛfa ho¶

• Fael a wɔpopa wɔ akwanhyia mu, formatted drive, ne mfonini a wɔsan nya
• SSD ne NVMe mpofirim akenkan nkutoo mode, 0% spare blocks, ne TRIM a ɛma nkwagye yɛ adwuma
• Hard drive a entumi nyɛ adwuma yiye ne data a wɔsan nya
• NAS RAID array asɛe, draibɛ pii adi nkogu, ne ZFS/Btrfs sanba
• Kɔmputa so backups, 3-2-1 nhyehyɛe, ne atoyerɛnkyɛm bere mu ahotɔ
• Nnɔmba a egye ntɛmpɛ sɛnea ɔman biara te

--- .

Fibea ne aban akwankyerɛ¶

• Ɔman Asoɛe a Ɛhwɛ Gyinapɛn ne Mfiridwuma So (NIST) (United States): Nhoma Titiriw 800-86: Akwankyerɛ a ɛfa Forensic akwan a wɔde bɛka asɛm a esii ho mmuae ho & SP 800-88 Rev. 1: Akwankyerɛ a ɛfa Media Sanitization (ATA TRIM / NVMe Deallocate Behavior).
• Linux Kernel Ahyehyɛde no (kernel.org): Ext4 Faelsystem Nwoma (Block ne Inode Nkyekyɛmu, . jbd2 Journaling, ne procfs /proc/<pid>/fd/ Fael Nkyerɛkyerɛmu Nkyerɛase) & Linux Magic System Abisade Safoa (sysrq.txt).
• CGSAhobanbɔ (TestDisk & . PhotoRec Ɔmanfoɔ Nwoma) ne ext4magic Upstream Nhwehwɛmu Nhoma: Journal Inode Extraction ne Unallocated Extent Carving wɔ ext3/ext4 ne NTFS Volumes so.
• Intanɛt so Ahobammɔ ne Nneɛma a Wɔde Yɛ Adwuma Ahobammɔ Dwumadibea (CISA) (United States): Asɛm a esisi ho mmuae ne Forensic Volatile/Non-Volatile Adanse a Wɔkora So Nneyɛe Pa.
• Europa Aman Nkabom Asoɛe a Ɛhwɛ Intanɛt So Ahobammɔ So (ENISA): Nneyɛe Pa Akwankyerɛ ma Digital Forensics ne Storage Media Preservation.