rm -rf, Huri-Muku ranei i runga i te Linux, macOS, Matapihi ranei: Panui-anake Whakahou Inamata¶

Te matakitaki i tetahi ohorere rm -rf, find -delete, git clean -fdx, Windows ranei Shift+Delete ūkui i ngā pātengi raraunga whakaputa nui, waehere pūtake, ngā kōnae whaiaro rānei me te kore e tukuna ki te Ipu Para, ki te kōpaki Parapara ranei, ka ohorere tonu. Heoi ano, kaore rm -rf kahore hoki Shift+Delete Ka whakakorea e koe nga waahanga rokiroki o raro i te waa ka oti te whakahau: engari, ka wetewete noa te punaha whakahaere i te urunga whaiaronga, ka whakahou i tana hautaka metadata, ka tohu i aua tohu tohu inode, Ripanga Kōnae Matua ranei (MFT) nga rekoata me nga maheremoka poraka e waatea ana hei whakamahi ano. Ko te mea e whakangaro tonu ana i o konae kua mukua ko ** ia hekona kotahi ka mau tonu te punaha konae ki te panui-tuhi (rw) aratau** i muri i te mukunga, hei kaitautai punaha papamuri (systemd-journald, rsyslog), keteroki tirotiro, mahi whakawhiti, me te SSD TRIM / discard ka tere te tuhirua e nga whakahau nga poraka hou kua wetekina. Mena kei te raru to punaha i te paato a tinana, i nga waahanga kino, i tetahi kaiwhakahaere mate ranei, kati ka huri ki ta maatau kaiarahi. kore puku mārō me te whakaora raraunga, ki te mea ranei kua kati to puku totika na te kakahu o te kaiwhakahaere, tirohia SSD me te NVMe te aratau panui-anake ohorere me te TRIM whakakore i te whakaoranga; mo nga hapa whakahōputu whanui me nga take kaari kamera, korero te mukunga kōnae ohorere, te puku whakahōputu, me te whakaora whakaahua. Mena kei roto i tenei aitua te whakawetiweti taihara, te muru, me te mate o te punaha ora, waea atu ki to nama whawhati tata (911 i te United States me Canada, 112 puta noa i te Kotahitanga o Europi, 999 i roto i te United Kingdom) tirohia to maatau raarangi ingoa o te ao tau ohorere.

Mahia tenei inaianei¶

1. ** Perehi Ctrl+C mena kei te haere tonu te tono muku, KAUA e kati i nga matapihi kati tuwhera, nga kaiwhakatika tuhinga, nga kaitoro pāpāho, nga daemon papaarangi ranei**: Mena kei te whakahaere he papatono (nginx, postgres, mysqld, vim, code, python, tail, he kaitoro ataata ranei) kei te tuwhera tonu te konae kua mukua ki roto i te mahara, ka pupuri tonu te kakano Linux, macOS ranei i nga paraka raraunga o te konae i runga i te kōpae kia kati ra ano taua mahi i tana kaiwhakaahua konae. Ko te kati i te tono, te whakaara ano ranei i te miihini i naianei ka tukuna tonu te kaute tohutoro (i_nlink == 0) me te whakaoho i te tauwehenga poraka.
2. I mua i te whakahou, te whakakore ranei i runga i te Linux, tirohia /proc/<pid>/fd/ i tenei wa tonu ki te whakaora i nga konae kua mukua e noho tuwhera tonu ana e te tukanga whakahaere: Run sudo lsof +L1 (e whakarārangi ana i nga konae tuwhera katoa he hono iti iho i te 1 te tatau, ko te tikanga i wetekina e rm i te wa e tuwhera tonu ana) ka kape tonu i o raatau ihirangi mata mai i te keteroki RAM/kernel ki te puku motuhake ranei /dev/shm (tmpfs kōpae RAM) te whakamahi cp /proc/<pid>/fd/<fd_number> /dev/shm/rescued_file.
3. Whakaekea ano te arai kua pangia Pānui-anake (ro) kia kore e taea e te kernel OS te tuhi i tetahi paita kotahi o nga raarangi hautaka, nga konae temp ranei ki nga poraka kaore i tohaina:
4. I runga Linux (ext4, XFS, Btrfs): Rere sudo mount -o remount,ro /path/to/mountpoint (hei tauira, sudo mount -o remount,ro /home ranei sudo mount -o remount,ro /).
5. Mehemea mount -o remount,ro rahua ki mount point is busy i runga i to putake (/) Wehewehenga: Whakaotia te kakano ohotata tonu te panui panui-anake ma te Magic SysRq ma te rere. echo u | sudo tee /proc/sysrq-trigger (e akiaki ana i nga punaha konae kua whakairihia ki te whakahou i te panui-anake tonu me te kore e patu i nga tukanga, e tatari ana ranei mo nga kati tuwhera).
6. I te macOS (APFS / HFS+): Rere sudo diskutil mount readOnly /Volumes/TargetVolume mo nga pukapuka kore-boot, mena kei runga ranei nga konae i to tuatahi Data rōrahi (/System/Volumes/Data), ka peia tonutia te hiko ma te pupuri i te patene Touch ID / Hiko mo te 10 hēkona hei aukati i te Maama o muri (mds_stores) me fseventsd tuhi.
7. I te Matapihi (NTFS / ReFS): Mēnā kei te puku tuarua ngā kōnae kua mukua (D:, E:), whakatuwheratia he Tohu Whakahau Kaiwhakahaere ka maukati te rōrahi panui-anake ma diskpart (select volume D, attributes volume set readonly). Mena kei runga nga konae C:\, kaua e tutakina a Windows i te tikanga (ka tuhia e te katinga noa nga rau megapaita o nga hive rehita, nga raarangi takahanga, me nga whakahōutanga wharangi wharangi kua wetea MFT tautau); engari, toia te taura hiko papamahi, pupuri ranei i te paatene hiko pona ki raro mo te 10 hēkona kia tapahia te hiko tonu.
8. ** Aukati SSD TRIM (discard / UNMAP) mai i te whakakore i nga wharangi kohiko kaore i toha**: Mena he NVMe, SATA SSD ranei te puku, ka mau tonu discard (mehemea ka rere a Windows/macOS kua whakaritea TRIM i muri tonu i te mukunga o nga konae), te tapahi i te mana, te whakahou ranei ro ka mutu tonu te OS ki te tutira i etahi atu NVME_DSM_ATTR_DEALLOCATE whakahau, me te whakatakoto i te SSD ki roto i te urutau piriti USB-ki-NVMe e kore e paahi TRIM i te wa whakaora ka aukati i te kohinga para papamuri o te kaiwhakahaere mai i te muru i nga poraka ka taea te whakaora.
9. Whakaoho mai i te USB Ora o waho (Ubuntu Live, SystemRescue, ranei WinPE) me te kati i te moka-mo-moka wehewehe ki te puku rokiroki waho ma te whakamahi ddrescue i mua i te whakahaere i tetahi taputapu whakakore: Kaua rawa e rere ext4magic, extundelete, testdisk, photorec, ranei ntfsundelete tika ki te aratau tuhi ki te puku patunga; whakaahua tonu te taputapu paraka (sudo ddrescue -d -r0 /dev/nvme0n1p2 /mnt/external/disk_image.raw /mnt/external/rescue.map) ka whakairohia o konae mai i te ahua, tuhia ranei nga konae kua ora ake ki te kopae tinana tuarua.
10. Tirohia nga whakaahua punaha konae konae rohe huna (Btrfs, ZFS, LVM, MacOS APFS Time Machine nga whakaahua a-rohe, me nga kape Atarangi Rōrahi Windows) i mua i te whakapaunga haora ki te whakairo i nga waahanga mata: He maha nga punaha e pupuri marie ana i nga tohutoro paraka-a-wa-a-waa (tmutil listlocalsnapshots / i runga i te macOS, vssadmin list shadows i runga i te Matapihi, zfs list -t snapshot, ranei btrfs subvolume list -s /) ka taea e 100 ōrau te whakaora tonu o rm -rf ranei Shift+Delete whaiaronga me te kore e pa ki nga tautau karekau i tohatohahia.

Rakau whakatau: te whakamatautau tonu i muri i te aitua rm -rf ranei Shift+Delete¶

Whaia tenei rakau whakatau i roto i te 60 hēkona tuatahi o te kitenga i te mukunga hei pupuri i te paheketanga teitei rawa o nga paraka raraunga kore hono:

flowchart TD
    Start["Ko rm -rf ohorere, kitea -muku, Neke+Muku ranei kua mahia"] --> OpenCheck{"Ka Tuwhera tonu te konae kua mukua (DB, Etita, Tūmau, Hiwero)?"}

    OpenCheck -->|"Ae (Kei te Rere tonu a Linux / macOS)"| ProcRescue["STEP 1: Whakahaerehia te sudo lsof +L1 Tonu ka Tārua Whakatuwheratia nga Kaituhi Kōnae mai i /proc/PID/fd/N ki te Kōpae RAM (/dev/shm) ranei te USB o waho."]
    OpenCheck -->|"Kao (Kua Katia Nga Kōnae Katoa)"| SnapCheck{"Kei te Whakamahihia e te Rōrahi ZFS, Btrfs, APFS Mahinga Paetata, he kape Atarangi Windows ranei?"}

    ProcRescue --> FreezeOS["STEP 2: Whakatio Tonu Nga Tuhi Kopae Katoa"]
    SnapCheck -->|"Āe: Kei te Tiari te Whakaahua a CoW"| FreezeOS
    SnapCheck -->|"Kao: Paerewa ext4, XFS, NTFS ranei me te kore he whakaahua"| FreezeOS

    FreezeOS --> OSBranch{"Ko tehea Pūnaha Whakahaere me te Wehewehenga i Patua?"}

    OSBranch -->|"Linux-kore-pakiaka (/home, /raraunga)"| RemountRO["Whakahaere: sudo mount -o remount,ro /mountpoint"]
    OSBranch -->|"Linux Root (/) Wehewehenga"| SysRqRO["Whakahaere: echo u | sudo tee /proc/sysrq-trigger (Kernel Emergency Read-Only Remount)"]
    OSBranch -->|"Windows C: Puku, macOS Boot APFS ranei"| HardPower["KAUA E Whakaweto Tikanga: Purihia te Patene Hiko 10 Hekona, Toia ranei te Waea Hiko hei aukati i te Tuhi i te Rangitaki/Whairangi."]
    OSBranch -->|"Tuarua o waho, Puku Raraunga ranei"| UnmountSec["Wetewete / Tautuhi Rōrahi Pānui-anake Inamata ka Momotu Puku"]

    RemountRO --> LiveBoot["KAUPAPA 3: Whakaarahia te Pūnaha Whakaora o waho USB Live me te Wehewehenga Clone me te ddrescue ki te Puku o waho"]
    SysRqRO --> LiveBoot
    HardPower --> LiveBoot
    UnmountSec --> LiveBoot

    LiveBoot --> FSRecovery{"Tīpakohia te Tikanga Whakaora ma te Pūnaha Kōnae"}
    FSRecovery -->|"ext4 / ext3"| ExtRec["Journal Inode Whakaora: ext4magic / extundelete / debugfs"]
    FSRecovery -->|"XFS / APFS / Karekau"| CarveRec["Waitohu me te Pane/Hiku Whakairo: photorec / scalpel / mua / xfs_irecover"]
    FSRecovery -->|"NTFS (Windows)"| NtfsRec["MFT Record Parsing: ntfsundelete / TestDisk / UFS Explorer / DMDE"]

He aha te mea ka whakairihia ia tuarua Panui-Tuhituhi (rw) ka whakangaro i nga konae kua mukua¶

Kia mohio ai koe he aha te panui-anake-anake-whakahou, te tapahi hiko kaha ranei he whakatau ora-mate-mate ranei mo o raraunga, tirohia he aha te whakarereketanga o ia punaha konae hou ina rere koe unlink() (rm) ranei DeleteFileW() (Shift+Delete):

1. Ka aha i roto ext4, XFS, APFS, a NTFS i te wa e mukua ana¶

Ina mukua tetahi konae, karekau he punaha whakahaere a nga kaihoko e whakapau ana i te kopae I/O bandwidth ki te tuhi kore i runga i te 10 gigabyte (10.7 piriona paita) papaa raraunga, konae ataata ranei. Engari, ko te taraiwa o te punaha konae ka huri noa i nga hanganga metadata iti:

2. Ko te SSD TRIM (Discard / Deallocate) Poma Waa¶

I runga i te puku hurihuri (HDD), ka noho panui nga waahanga tae noa ki te tuhirua. I runga i te SSD (SATA ranei NVMe), i te wa e puta ai tetahi punaha konae a TRIM ranei Deallocate whakahau: - Ko te nuinga o nga kaiwhakahaere NVMe ka whakatinana Deterministic Read Zero i muri i te TRIM (DRAT / DZAT), ka hoki mai 0x00000000 (nga kore katoa) mai i te Apa Whakamaori Flash (FTL) i muri tonu i te whiwhinga TRIM, ahakoa i mua i te whakahaerenga o te kohinga para NAND tinana. - ** He aha nga punaha Linux e ora tonu ana TRIM**: Te nuinga o nga tohatoha Linux (Ubuntu, Debian, Fedora, RHEL) kaore e taea te wa-maunga tonu discard ma te taunoa; ka whakahaerehia e ratou he taima ia wiki (fstrim.timer). Mena ka whakahou ano koe i te panui-anake (ro) i mua fstrim.timer ka rere, kaore ano te SSD kia wetewete i aua poraka.

Wāhanga 1: Te whakaora i nga konae kua mukua e noho tuwhera tonu ana e te tukanga whakahaere (/proc/<pid>/fd/)¶

I mua i to whakaara ano, wetewete, kati ranei i te matapihi kotahi i runga i te Linux, i te macOS ranei, takihia mo nga kaiwhakaahua konae tuwhera. I roto i nga punaha POSIX, rm waea unlink(). Ka whai te kernel i nga porotiti e rua mo ia inode: 1. i_nlink: Ko nga tuhinga whaiaronga kei runga-kopae e tohu ana ki te inode. 2. i_count: Nga tukanga kaha e pupuri ana i te inode e tuwhera ana ki te mahara.

Ko te ture POSIX koura: Ko te kakano kaore e wetekina te inode, ka toha ranei nga poraka kōpae tae noa ki te RUA i_nlink == 0 ME i_count == 0. Mēnā kei te tūwhera tonu tētahi pātengi raraunga kua mukua, te rangitaki, te ataata, te konae waehere ranei i roto i tetahi tukanga, 100 paiheneti o taua konae kei te noho tonu ki runga kōpae.

Hipanga-i-taahiraa /proc/<pid>/fd/ tangohanga i runga i te Linux¶

1. Kimihia nga konae kua mukua e noho tuwhera tonu ana e tetahi tukanga:

   sudo lsof +L1
   

   (Tatari ranei ma te ingoa kōnae: sudo lsof | grep -i "(deleted)" | grep -i "filename")
2. ** Panuitia te lsof tīwae putanga**:

   COMMAND    PID     USER   FD   TYPE DEVICE  SIZE/OFF   NLINK    NODE NAME
   postgres  4182 postgres   14u   REG  259,2 524288000       0 1839204 /var/lib/postgresql/16/main/base/16384/16399 (deleted)
   

   Kia mahara ki te PID(4182) ka murua te reta whai muri (u, r, w) mai i FD(14u -> 14).
3. Tapahia te konae mata ki waho /proc/<pid>/fd/<fd_num> ki te RAM (/dev/shm) he puku waho ranei: Kaua rawa e tuhia te konae i whakaorahia ki runga i te arai kua pa. Tuhia ki /dev/shm (kopae RAM) he puku USB waho ranei:

   mkdir -p /dev/shm/rescued_files
   sudo cp /proc/4182/fd/14 /dev/shm/rescued_files/16399_recovered
   

4. Whakaorangia te maha o nga konae tuwhera kua mukua mai i te papaunga raraunga, ipu ranei (PID=4182) i roto i te koropiko kotahi:

   sudo mkdir -p /dev/shm/rescued_db
   for fd in /proc/4182/fd/*; do
     target=$(sudo readlink "$fd")
     if echo "$target" | grep -q "(deleted)"; then
       fd_num=$(basename "$fd")
       clean_name=$(echo "$target" | sed 's/ (deleted)//; s/\//_/g')
       sudo cp "$fd" "/dev/shm/rescued_db/fd_${fd_num}${clean_name}"
     fi
   done
   

5. Kaiwhakaora me te IDE History Local (vim, VS Code, Cursor, JetBrains):
6. Kaua e kati i nga ripa etita tuwhera: Tiakina tika nga papaa tuwhera ki /dev/shm he puku koromatua ranei.
7. Waehere VS / Pehu / VSCodium Hītori ā-rohe: Ka penapena i nga kape tohu wa aunoa o ia konae kua tiakina ki roto -/.config/Code/User/History/ (Linux), -/Library/Application Support/Code/User/History/ (macOS), ranei %APPDATA%\Code\User\History\ (Windows), kei waho rawa i to kōpaki kaupapa. Ahakoa i muri rm -rf -/my-project ranei git clean -fdx, kei te noho tonu o konae waehere ki roto User/History/ me te entries.json whakaatu mapi ia kōnae ki tona ara taketake.
8. JetBrains IDEs (IntelliJ, PyCharm, WebStorm): Ka penapena hitori aunoa i roto -/.cache/JetBrains/<IDE>/LocalHistory/.
9. Git (git reset --hard ranei git branch -D me .git/ mau tonu): Rere git reflog ranei git fsck --lost-found ki te whakaora i nga pupuhi tarewa i roto .git/objects/.

Wāhanga 2: Whakatio i te pūnaha kōnae Pānui-anake (ro) me te kore e tuhirua i nga poraka kaore i tohatohahia¶

Ina tangohia e koe etahi kaiwhakaahua konae tuwhera mai /proc (kaore ranei i manatokohia), ko to kaupapa matua tonu ko te aukati i te punaha whakahaere ki te tuhi i tetahi atu waahanga ki te wehewehenga.

1. Linux: Whakaekea ano he Wehewehenga Raraunga ki te Putake (/) Wehewehenga Panui-anake¶

• Tauari A: Ko nga konae kua mukua kei runga i te wehenga motuhake (/home, /var, /data, /mnt/storage):
• Ngana tonu ki te remount panui-anake:

  sudo mount -o remount,ro /home
  

• Mehemea mount ta mount point is busy, te tautuhi me te whakamutu i nga tukanga tuhi (sudo fuser -vm /home whai muri sudo fuser -km -TERM /home), katahi ka oma ano sudo mount -o remount,ro /home.
• Tauari B: Ko nga konae kua mukua kei runga i te Putake (/) wehewehe (kaore ranei e taea e koe te patu i nga mahi pukumahi): Kaua e oma sudo reboot ranei sudo shutdown -h now, no te mea he noa systemd katinga tuhi mekapaita o journald rākau whakaweto, kākano matapōkere, me ngā kōnae kāwanatanga ratonga ki runga tika /. Engari, whakaohohia te Linux Kernel Magic SysRq Emergency Read-One-Remount:

  echo 1 | sudo tee /proc/sys/kernel/sysrq
  echo s | sudo tee /proc/sysrq-trigger
  echo u | sudo tee /proc/sysrq-trigger
  

• s (Emergency Sync): Ka pupuhihia e tarewa ana i roto i te mahara-roto metadata punaha konae kia rite tonu te superblock.
• u (Emergency Remount Read-Only): Ka hoki kaha ki te whakanoho i nga punaha konae kua eke ki runga i te miihini hei Panui-anake (ro) kei roto i te kernel, ahakoa he tuwhera tonu nga konae mo te tuhi. Manatokohia tena / he panui-anake inaianei me grep " / " /proc/mounts.

2. Te whakaahua i te Tūmau Kapua Mamao tio (AWS EC2, GCP, DigitalOcean, Hetzner) runga SSH¶

Mena kua oma ohorere koe rm -rf i runga i te tūmau kapua mamao e kore e taea e koe te mono ki te puku USB: 1. Whakahaerehia te Magic SysRq panui-anake remount (echo s > /proc/sysrq-trigger && echo u > /proc/sysrq-trigger). Kei te ora tonu to waahi SSH na te mea ka rere a SSH i roto i te RAM me te /dev/pts (devpts) he punaha konae pseudo-terminal RAM mariko. 2. I runga i nga papaahi kapua (AWS EC2, GCP, Azure, DigitalOcean), tangohia tonutia he ngota EBS / Block Volume Snapshot mai i te papatohu kapua, ka mutu ranei te tauira, wetewete te rōrahi pakiaka, ka whakapiri i te panui-anake (/dev/xvdf) ki te VM whakaora ma. 3. I runga i te tūmau mamao kore-whakarewa, rere he atahanga mata kōpeke o te wehenga panui-anake tio ki runga i te SSH ki to teihana mahi rohe:

ssh root@remote-server-ip "dd if=/dev/nvme0n1p2 bs=4M status=progress | zstd -1" > ~/rescued_partition.img.zst

Wāhanga 3: Takitaki huna Tārua-i-Tuhia (CoW) nga whakaahua me nga kape Atarangi i mua i te whakairo¶

I mua i te karapa terapaita o nga waahanga kaore i tohatohahia, tirohia mena i hanga aunoatia e to punaha whakahaere he whakaahua huna-a-waa:

1. MacOS: Miihini Waa Takiwa APFS Whakaahuatanga (tmutil)¶

Ahakoa kua wetekina to puku Miihini Waa o waho mo nga wiki, ka tuhi aunoa a MacOS ** i nga haora o te rohe APFS Kape-a-Tuhia nga whakaahua** ki to SSD o roto (com.apple.TimeMachine.YYYY-MM-DD-HHMMSS.local) i nga wa katoa ka whirihorahia te Miihini Waa, i mua ranei i nga whakahoutanga macOS: 1. Whakarārangihia nga whakaahua paetata katoa ki te Terminal:

tmutil listlocalsnapshots /
tmutil listlocalsnapshots /System/Volumes/Data

mkdir -p /tmp/apfs_rescue
sudo mount_apfs -o ro -s com.apple.TimeMachine.2026-10-31-140000.local /System/Volumes/Data /tmp/apfs_rescue
ls -la /tmp/apfs_rescue/Users/yourname/

2. Windows 10 / 11 / Tūmau: Rōrahi Kōruru Tārua (VSS)¶

1. Whakatuwheratia he Whakatairanga Whakahau a te Kaiwhakahaere ka whakahaere:

   vssadmin list shadows
   

2. Mēnā he Tārua Kōruru (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1) i mua i to Shift+Delete, hono ki te kōpaki ka tārua i ō kōnae ki te puku USB:

   mklink /d C:\ShadowRescue \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
   

3. Linux: Btrfs, ZFS, a LVM Nga whakaahua¶

• Kei Btrfs (Fedora, openSUSE, Synology, Timeshift/Snapper system): Rere sudo btrfs subvolume list -s / me te tirotiro /.snapshots/ ranei /run/timeshift/backup/timeshift-btrfs/snapshots/.
• Kei ZFS (Ubuntu ZFS, Proxmox, TrueNAS): Rere zfs list -t snapshot ka kape tika mai i nga konae /path/to/dataset/.zfs/snapshot/.

Wāhanga 4: Inode, Tuhitaka, me te Whakaora MFT na te punaha konae¶

Mena karekau he kaiwhakaahua konae tuwhera (/proc/<pid>/fd/) a karekau he whakaahua, katahi ka puta mai i te SystemRescue, Ubuntu Live USB ranei, whakapirihia he puku puku USB waho (/mnt/external), ka hangaia he moka-mo-moka-moka-moka o te wehewehenga patunga kaore i mauhia (/dev/nvme0n1p2) tuatahi:

sudo ddrescue -f -n /dev/nvme0n1p2 /mnt/external/victim_partition.img /mnt/external/ddrescue.log

1. Whakaora mai ext4 / ext3 i runga i te Linux (ext4magic a extundelete)¶

Ina rm -rf ka muku i nga konae kei runga ext4, ka whakakorehia e te kakano nga tohu tohu rakau i roto i te ripanga inode matua. Heoi ano, ext4s jbd2 hautaka (ko te tikanga 128 megabytes ki te 1,024 megabytes te rahi) kei te rongoa i nga kape o mua o nga poraka inode kua whakarerekehia inaianei. I te mea kua eke ano koe ro i mua i te takai o te mahi kōpae taumaha i te putunga mowhiti hautaka, ext4magic ka tango i te inode i mua i te mukunga mai i te hautaka me te hanga ano i o konae me nga ingoa konae taketake me nga rakau whaiaronga kia mau tonu.

1. Rere ext4magic ki te whakaora i nga konae katoa i mukua i roto i nga haora 2 kua hipa (-a) i roto i te ara whanaunga (-f): (Waiho te rītaha matua o te ira maunga ki roto -f: mo /home/kmyers/project i runga i te pakiaka / wehewehe, haere -f home/kmyers/project; mehemea /home ko tona ake wehewehenga, pass -f kmyers/project.)

   mkdir -p /mnt/external/recovered_ext4
   sudo ext4magic /mnt/external/victim_partition.img \
     -a $(date -d "2 hours ago" +%s) \
     -f home/kmyers/project \
     -R -d /mnt/external/recovered_ext4
   

2. He rereke: Rere extundelete ki te ahua:

   cd /mnt/external
   sudo extundelete /mnt/external/victim_partition.img --restore-directory home/kmyers/project
   

2. Whakaora mai i Windows NTFS muri Shift+Delete (TestDisk a ntfsundelete)¶

Rerekē ext4, ** Matapihi NTFS KORE e whakakore i nga tohu tohu whanui paraka (Data Runs) kei roto i te Ripanga Kōnae Matua ($MFT) tuhi ina mukua he kōnae**. Ka pehi koe Shift+Delete i runga i te NTFS, te 1,024-paita $MFT ka huri noa te urunga i tana haki pane 0x01 (Kei-Whakamahia) ki 0x00 (Kua Mukua). Ko ona $FILE_NAME huanga me $DATA Ka noho tonu te rarangi rarangi roopu 100 paiheneti kia whakamahia ano e tetahi atu konae tera $MFT mokowhiti:

1. Whakamahia TestDisk mo te NTFS inamata $MFT te whakakore me nga ara kōpaki katoa:

   sudo testdisk /mnt/external/victim_partition.img
   

   Tīpako [ Proceed ] -> [ EFI GPT ] -> [ Advanced ] -> tohuhia te waahanga NTFS -> [ Undelete ]. Whakatere ki to kōpaki, pēhia a ki te kowhiri i nga konae kua mukua, ka peehi C (matua C) hei kape i a raatau /mnt/external/recovered_ntfs/.
2. Whakamahia ntfsundelete (ntfs-3g):

   sudo ntfsundelete /mnt/external/victim_partition.img -t 2d
   sudo ntfsundelete /mnt/external/victim_partition.img -u -m "*" -d /mnt/external/recovered_ntfs
   

3. Whakaora mai XFS, APFS, he Tuhituhi Tuhirua ranei ma te Whakairo Poraka Raw (PhotoRec a grep -a -b)¶

Ina ngaro nga tohu inode (pērā i runga XFS, APFS, he ** raneiext4** Wehewehenga i takaihia te hautaka), whakaora raraunga ma te karapa i nga paraka 4,096-paita (4 kiropaita) kaore i tohatohahia mo nga pane / hiku, nga aho kuputuhi ahurei ranei:

Me pehea te whakamahi grep -a -b + dd ki te whakaora waehere puna mukua ranei .env kōnae i raro i te 2 meneti¶

Mena kua mukua e koe te waehere puna, .env ngaro, tuhipoka ranei i raro i te 32 kiropaita te rahi: 1. Rapua he aho ahurei kei roto i te konae kua mukua ka taia tana paita whakawhito (-b):

LC_ALL=C grep -a -b -o "def calculate_invoice_tax" /mnt/external/victim_partition.img

dd if=/mnt/external/victim_partition.img bs=4096 skip=11789795 count=30 status=none > /mnt/external/rescued_code_block.txt

Wāhanga 5: Te aukati i nga aitua a meake nei rm -rf a Shift+Delete aituā¶

• Whakakapihia te tauwhitiwhiti rm me trash-cli a rm -I --preserve-root=all: Tāuta trash-cli (trash-put, trash-list, trash-restore) me te ingoa ingoa rm ki rm -I --preserve-root=all i roto /etc/bash.bashrc a -/.zshrc no reira ko nga mukunga recursive ohorere ka tere kotahi i mua i te wete i nga inodes.
• Tiakihia nga raarangi whakangao nui me te Huanga Whakarereke Linux (chattr +i): Ahakoa root (sudo rm -rf) kaore e taea te muku, te whakarereke ranei i tetahi whaiaronga, konae ranei kua tohua sudo chattr +i /path/to/critical_config kia rere ra ano tetahi kaiwhakahaere sudo chattr -i.
• Whakahohehia te kape-i-tuhi-a-rohe Aunoa (CoW) Whakaahuatanga (Btrfs / ZFS / APFS / Windows Shadow Copies): Whakamahia Snapper ranei Timeshift i runga Btrfs, sanoid i runga ZFS, e rua ranei ia ra nga kape Atarangi Rōrahi i runga Windows (SystemPropertiesProtection.exe).
• Kia mau tonu nga Pūrua 3-2-1 Aunoa me te Rokiroki Tautui Tuwhera: A pee i ta maatau aratohu ki nga taapiri rorohiko, te rautaki 3-2-1, me te whakaoranga kino te whakamahi restic ranei borgbackup me te taapiri-anake nga putunga mamao.

Nga nama ohorere a rohe me nga tikanga umanga¶

Ahakoa he ohorere hangarau te mukunga kōnae i runga i te rorohiko whaiaro, ehara i te take pirihimana, ko te whakakorenga ohorere, kino kino ranei e pa ana ki nga punaha hauora, nga hanganga taone, nga taunakitanga ture i raro i te ota tiaki a te kooti, me nga raraunga whaiaro kua whakatauhia, tera pea ka puta mai he purongo maiki:

• Te Hononga o Amerika me Kanata:
• Haumaru-Haumaru-Haumarutanga / Hanganga Tino Whakamatea: Waea 911 mena ka pa ki te tiaki o nga turoro o te hohipera, te tuku ohorere, me nga mana haumaru tinana ahumahi ranei.
• Te Tari Haumaru Haumaru me te Hanganga Hanganga (CISA) (US): Ripoata i te pakarutanga o nga raraunga hangahanga tino nui, i te whakapae ranei kei te whakakinohia e te tangata i 1-844-Say-CISA (1-844-729-2472) ranei cisa.gov/report.
• Te Pokapū Kanata mo te Haumarutanga Cyber: Whakapā 1-833-CYBER-88 (1-833-292-3788) mo nga maiki hanganga tino nui.
• United Kingdom:
• Ratonga Ohotata: Waea 999 (ranei 101 mo te purongo pirihimana kore ohorere mena ka uru te whakakorenga i te kino rorohiko i raro i te Computer Misuse Act 1990).
• Te Tari Toihau Korero (ICO): Ki te whakakorenga ohorere te whakakore i nga raraunga whaiaro me te kore he whakaora whakaora (he Waahi Wātea i raro i te UK GDPR), tirohia mehemea he panui ki te ICO (0303 123 1113) i roto i nga haora 72 e hiahiatia ana.
• Uniana Pākehā:
• Ratonga Ohotata: Waea 112 puta noa i nga whenua mema EU katoa.
• Tuhinga GDPR 33 Nga Ripoata Takahanga Wātea: I raro i te Poari Tiaki Raraunga Pakeha (EDPB) nga aratohu, ko te whakakorenga ohorere o nga raraunga whaiaro me te kore he taapiri ka taea te whakahoki mai ka whakarōpūtia hei takanga raraunga whaiaro (kua ngaro te waatea) a ka hiahia pea koe ki te tuku korero ki to Mana Whakahaere Raraunga a-motu (DPA) i roto i te 72 haora.
• Ahitereiria me Aotearoa:
• Ratonga Ohotata: Waea 000 i Ahitereiria ranei 111 kei Aotearoa.
• Te Pokapū Haumaru Haumaru o Ahitereiria (ACSC): Waea 1300 CYBER1 (1300 292 371) mo te awhina hinonga, hangahanga ranei.
• India me Ahia-Kiwa:
• India (CERT-In / Waea Awhina mo te Hara Cyber Motu): Waea 112 mo te urupare ohorere ranei 1930 mo nga aitua ipurangi; Ko nga maiki hinonga e kapi ana i nga mana whakahaere CERT-In me ripoata i roto i nga haora 6 ki incident@cert-in.org.in.

Pātai auau¶

He aha i kore ai extundelete ranei ext4magic kimihia aku ingoa kōnae kei runga ext4 ahakoa ka mutu taku whakamahi i te rorohiko i te tere?¶

Ina mukua tetahi konae i runga ext4, ka whakakorea e te kernel Linux te whanuitanga o nga tohu rakau i roto i te ripanga inode-kopae kia mohio ai te punaha konae kaore he waahanga toha o te inode. Utauta rite ext4magic a whakakorekore whakawhirinaki ki te kimi i tetahi kape tawhito, i mua i te mukunga o taua inode i roto i te ext4 hautaka (jbd2). Mena i waihangahia te konae ka mukua me te kore tana inode e toro atu ana i roto i te hautaka, mena ka tuhi te papamuri taumaha ka takai te 128 MB ki te 1 GB putunga mowhiti hautaka i mua i to whakairinga panui-anake, kua ngaro te kape pukapuka. Ina, me huri koe ki te whakairo waitohu paraka mata (PhotoRec) te rapu paita kupu-maama ranei (grep -a -b), e karapa tika ana i nga paraka raraunga kaore i tohatohahia me te kore e hiahiatia he metadata inode.

Kei te SSD TRIM whakangaro tonu rm -rf ranei Shift+Delete kōnae tonu?¶

Ehara i nga wa katoa, ina koa i runga i te Linux me nga puku o waho. I runga i te Windows 10/11 me te macOS me nga NVMe SSD o roto, ka tukuna e te punaha whakahaere he raina-roto TRIM / Tohaina whakahau ki te kaiwhakahaere SSD i roto i nga hēkona i muri i te mukunga tuturu, na te SSD's Flash Translation Apa (FTL) ki te whakahoki kore (DZAT) mo aua poraka. Heoi, ko te nuinga o nga tohatoha Linux (Ubuntu, Debian, Fedora, RHEL). kaore taea te wa-maunga tonu whakarerea taunoa; engari ka oma fstrim.timer kotahi te wiki. I tua atu, he maha nga USB-ki-SATA me te USB-ki-NVMe o waho kaore e paahi TRIM whakahau i runga USB Rokiroki Papatipu (BOT), me nga raupaparorohiko RAID / LVM / LUKS he maha nga wa e aukati ana whakarerea haere taunoa ki te kore e tino whirihora (`issue_discards = 1` ranei `allow-discards`).

He aha mena ka whakamunatia taku wehenga Linux LUKS (dm-crypt) ka whakamahia ranei e taku puku Windows BitLocker: ka taea tonu e au te whakairo i nga konae kua mukua?¶

Ae, mena kei a koe te kīangahipa whakamunatanga, te kī whakaora ranei ka iriti i te ipu ki te aratau panui-anake. Kaua rawa e oma photorec, ext4magic, ranei kōpae whakamātautau ki te wehewehenga tinana whakamunatia (/dev/nvme0n1p2), na te mea he rite te haruru matapōkere te ahua o te kupu huna whakamunatia. Engari, whakaoho mai i te USB Live, iriti i te ipu ki roto aratau panui-anake (mo LUKS: sudo cryptsetup tuwhera --panui anake /dev/nvme0n1p2 crypt_rescue; mo BitLocker i runga i te Linux: whakarara -r iriti ranei i te panui-anake i roto i te WinPE), ka atahanga, ka matawai ranei i te taputapu mahere mariko kua wetemuna (/dev/mapper/crypt_rescue).

He aha te take e toia ana te taura hiko i runga Windows C:\ he haumaru ake i muri i te tupono Shift+Delete i te panui "Whakaweto"?¶

Ka paato koe Tīmata > Whakaweto i runga i te Matapihi, ka mahia e te punaha whakahaere nga rau megapaita o te kopae tuhi i mua i te whakaweto: ka pehia e ia nga hiwi rehita, ka tuhi i nga kaupapa kati ki .evtx rangitaki, whakahou i te USN Journal ($UsnJrnl), ka whakawātea, ka huri anō rānei pagefile.sys, a ki runga i nga punaha Whakaoho Tere ka tuhi i te konae hibernation maha-kipaita (hiberfil.sys) puta noa i nga tautau NTFS kaore i tohatohahia. Ko aua tuhi katinga ka tuhirua i nga mea kaore i tohatohahia $MFT nga rekoata me nga kohinga raraunga i tukuna e to Neke+Muku. Ko te pehi i te hiko tonu (ka mau i te paatene hiko mo te 10 hēkona, ka kumea ranei te mono) ka mutu nga tuhi katoa; Ka noho tonu te NTFS ka taea te panui ina pekehia mai i te Linux panui-anake, WinPE whakaora USB ranei.

Me pehea e taea ai e ahau te whakaora i te mea kua mukua .env kōnae, kī SSH, kōnae waehere puna ranei e PhotoRec kare e arohia?¶

PhotoRec titiro mo nga pane paita makutu rua (penei %PDF, PNG, ranei PK mo nga konae ZIP/Office), no reira he maha nga wa ka mokowhiti, ka whakahiatohia ranei nga konae kupu-kupu poto penei .env whirihoranga, waehere puna Python/JavaScript, tuhipoka Markdown, me nga taviri SSH. Hei whakaora i tetahi konae tuhinga-maama mai i te ahua kōpae, i te waahanga panui-anake ranei, rere LC_ALL=C grep -a -b -C 100 "UNIQUE_TEXT_FROM_FILE" /dev/nvme0n1p2 > /dev/shm/found.txt. Mena ka mohio koe ki tetahi ingoa rereke (penei STRIPE_SECRET_KEY= ranei TIMATA OPENSSH Kī TATAU), grep -a -b ka matawai i nga rängai mata ki te maha o nga gigabytes ia hekona ka ta i nga paraka kōpae huri noa.

Mena kua oma noa ahau rm -rf / kua mukua ranei /usr ranei /lib i runga i te Linux a inaianei kaore ano ls, cp, ranei sudo mahi, me pehea taku whakahaere whakahau i taku tauranga tuwhera?¶

Ki te muru koe /bin ranei /lib i te wa e noho ana tukituki ranei zsh kei te tuwhera tonu te tauranga i roto i te RAM, penei i nga takirua o waho /bin/ls ranei /bin/cp ka taka ki Karekau he konae, he whaiaronga ranei, engari kei te mahi tonu te anga i roto i te RAM. Ka taea e koe te whakamahi paoro * hei utu mo ls, printf "%s\n" "$( /dev/shm/rescued hei utu mo cp, a echo u > /proc/sysrq-trigger (mehemea kua puta ke te anga o to anga) hei whakaoho i te remount kernel panui-anake i mua i te whakaweto me te whakaara i te USB SystemRescue Live.

Nga kaiarahi e pa ana¶

• Te mukunga kōnae ohorere, te puku whakahōputu, me te whakaora whakaahua
• SSD me NVMe aratau panui-anake ohorere, 0% poraka e manawapa ana, me te TRIM whakakore i te whakaoranga
• Rahunga puku mārō me te whakaora raraunga
• Kua whakahekehia te raupapa NAS RAID, he maha nga puku puku, me te whakaora ZFS/Btrfs
• Nga taapiri rorohiko, te rautaki 3-2-1, me te whakaora i nga aitua
• Ko nga nama ohorere ma te whenua

Nga puna me nga aratohu whai mana¶

• National Institute of Standards and Technology (NIST) (Te Hononga o Amerika): Te Whakaputa Motuhake 800-86: Te Aratohu mo te Whakauru i nga Hangarau Whakatairanga ki roto i te Whakautu Whakautu & SP 800-88 Rev. 1: Nga Aratohu mo te Whakapaipaoho (ATA TRIM / NVMe Deallocate Behavior).
• Te Whakahaere Kernel Linux (kernel.org): Tuhinga Pūnaha Kōnae Ext4 (Tuhinga Paraka me te Inode, jbd2 Tuhituhi, me procfs /proc/<pid>/fd/ Kupu Whakamarama Kupu Whakaata) me te Kī Tono Pūnaha Maama Linux (sysrq.txt).
• CGSecurity (TestDisk & PhotoRec Tuhinga Whaimana) me ext4magic Pukapuka Tohutoro Whakarunga: Journal Inode Tangohanga me te Whakairo Roonga Kore i wehea ki runga ext3/ext4 me NTFS Volumes.
• Pokapü Haumaru Haumaru me te Hanganga Hangarau (CISA) (Te Hononga o Amerika): Te Whakautu mai i nga Tikanga me nga Tikanga Pai mo te Whakaoranga i nga Whakaaturanga Moerangi/Kore-Kore Nga Mahi Pai.
• Te Roopu Uniana a Europi mo te Haumaru Haumaru (ENISA): He Aratohu Mahinga Pai mo te Mamati Mamati me te Tiaki Papaho Pupuri.