Ka kotsi rm -rf kapa Shift-Delete ho Linux, macOS, kapa Windows: Remount hang-hang¶

Ho shebella ka phoso rm -rf, find -delete, git clean -fdx, kapa Windows Shift+Delete hlakola li-database tsa bohlokoa tsa tlhahiso, khoutu ea mohloli, kapa lifaele tsa hau ntle le ho li romella ho Recycle Bin kapa foldara ea Lithōle li baka tšabo hanghang. Leha ho le joalo, ha ho joalo rm -rf leha e le Shift+Delete ha e le hantle ha e fane ka likarolo tsa hau tsa polokelo ka nako eo taelo e phethelang ka eona: ho e-na le hoo, tsamaiso ea ts'ebetso e mpa e kopanya lethathamo la ho kena, e nchafatsa koranta ea eona ea metadata, 'me e tšoaea li-inode pointer kapa Master File Table (MFT) lirekoto le ho thibela li-bitmaps joalo ka ha li fumaneha bakeng sa ho sebelisoa hape. Se senyang lifaele tsa hau tse tlositsoeng ka ho sa feleng ke ** motsotsoana o mong le o mong tsamaiso ea lifaele e ntse e kentsoe ho bala-ho ngola (rw) mode** ka mor'a ho hlakoloa, joalo ka ba remang lifate tsa morao-rao (systemd-journald, rsyslog), li-cache tsa sebatli, ts'ebetso ea swap, le SSD TRIM / discard litaelo li hlakola li-block tse sa tsoa lokolloa. Haeba tsamaiso ea hau e na le bothata ba ho tobetsa 'meleng, likarolo tse mpe, kapa molaoli ea shoeleng, ema 'me u fetole tataiso ea rona ho hard drive hloleha le ho hlaphoheloa ya data, kapa haeba hard-state drive ea hau e koalehile ka lebaka la ho apara ha taolo, bona SSD le NVMe mokhoa oa ho bala feela ka tšohanyetso le TRIM e thibelang pholoso; bakeng sa liphoso tse pharalletseng tsa ho fometa kapa litaba tsa karete ea khamera, ikopanye ho hlakolwa ha faele ka phoso, drive e hlophisitsoeng, le ho hlaphoheloa ha lifoto. Haeba ketsahalo ena e ama ts'ebetso ea botlokotsebe, bosholu, kapa ts'ebetso ea ts'ireletso ea bophelo, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa sheba bukana ea rona ea machaba ea dinomoro tsa tshohanyetso.

Etsa sena hona joale¶

1. Tobetsa Ctrl+C hang-hang haeba taelo ea ho hlakola e ntse e sebetsa, 'me U SE KE UA koala lifensetere lifensetere tse bulehileng, bahlophisi ba mongolo, libapali tsa media, kapa li-daemon tsa database: Haeba ho na le lenaneo le sebetsang (nginx, postgres, mysqld, vim, code, python, tail, kapa sebapali sa video) se ntse se na le faele e hlakotsoeng e butsoeng mohopolong, Linux kapa macOS kernel e boloka li-block tsa data tsa faele li ntse li le ka har'a disk ho fihlela ts'ebetso eo e koala tlhaloso ea faele ea eona. Ho koala sesebelisoa kapa ho qala mochini bocha hona joale ho tla lokolla palo ea litšupiso hang-hang (i_nlink == 0) le ho etsa hore ho be le li-block deallocation.
2. Pele o kenya kapa o tima Linux, hlahloba /proc/<pid>/fd/ hona joale ho pholosa lifaele life kapa life tse hlakotsoeng tse ntseng li butsoe ke ts'ebetso e sebetsang: Matha sudo lsof +L1 (e thathamisang lifaele tsohle tse bulehileng tse nang le palo ea lihokelo tse ka tlase ho 1, ho bolelang hore li ne li sa kopanngoa ke rm ha e ntse e butsoe) 'me hang-hang kopitsa litaba tsa bona tse tala ho tsoa ho RAM / kernel cache ho drive e arohaneng kapa /dev/shm (tmpfs RAM disk) ho sebelisoa cp /proc/<pid>/fd/<fd_number> /dev/shm/rescued_file.
3. **Ho phahamisa karolo e amehang Bala-Feela (ro) hanghang hore OS kernel e se ke ea ngola e 'ngoe ea lingoloa tsa koranta kapa lifaele tsa temp ho li-block tse sa abeloang **:
4. Ho Linux (ext4, XFS, Btrfs): Matha sudo mount -o remount,ro /path/to/mountpoint (mohlala, sudo mount -o remount,ro /home kapa sudo mount -o remount,ro /).
5. Haeba mount -o remount,ro hloleha le mount point is busy motsong oa hau (/) partition: Etsa hore kernel e baloe hang-hang ho bala feela ka Magic SysRq ka ho matha echo u | sudo tee /proc/sysrq-trigger (e qobellang litsamaiso tsohle tsa lifaele tse kentsoeng ho bala feela hang-hang ntle le ho bolaea kapa ho emela liloko tse bulehileng).
6. Ho macOS (APFS / HFS+): Matha sudo diskutil mount readOnly /Volumes/TargetVolume bakeng sa li-volumes tse seng tsa boot, kapa haeba lifaele li ne li le sehloohong sa hau Data bophahamo (/System/Volumes/Data), hang-hang qobella ho tima ka ho tšoara konopo ea Touch ID / Power bakeng sa metsotsoana e 10 ho emisa Spotlight e ka morao (mds_stores) le fseventsd oa ngola.
7. Ho Windows (NTFS / ReFS): Haeba lifaele tse hlakotsoeng li ne li le ho drive ea bobeli (D:, E:), bula Administrator Command Prompt ebe o notlela molumo o baloang feela ka diskpart (select volume D, attributes volume set readonly). Haeba lifaele li ne li le teng C:\, u seke oa koala Windows ka tloaelo (thibelo e tloaelehileng e ngola makholo a li-megabyte tsa li-hives tsa ngoliso, lintlha tsa liketsahalo, le liapdeite tsa lifaele tsa leqephe ha li lokollotsoe. MFT lihlopha); ho e-na le hoo, hula thapo ea motlakase ea komporo kapa u tšoare konopo ea matla ea laptop tlase bakeng sa metsotsoana e 10 ho khaola matla hang-hang.
8. **Thibela SSD TRIM (discard / UNMAP) ho tloha ho senya maqephe a sa abuoang **: Haeba koloi e le NVMe kapa SATA SSD 'me e ne e behiloe ka mokhoa o tsoelang pele. discard (kapa haeba Windows/macOS e sebetsa e reriloe TRIM hang ha faele e hlakoloa), ho khaola matla kapa ho phahamisa hape ro hang-hang emisa OS ho tloha queuing eketsehileng NVME_DSM_ATTR_DEALLOCATE litaelo, le ho beha SSD ka har'a adaptara ea borokho ea USB-to-NVMe e sa feteng TRIM nakong ea ho hlaphoheloa e thibela pokello ea lithōle e ka morao ea molaoli hore e se ke ea hlakola li-blocks tse ka fumanoang.
9. Buta ho tsoa ho USB ea kantle ea Live (Ubuntu Live, SystemRescue, kapa WinPE) le ho kopanya karohano bit-for-bit ho drive ea kantle ea polokelo o sebelisa ddrescue pele o sebelisa sesebelisoa leha e le sefe sa ho se tlose: Le ka mohla u se ke ua matha ext4magic, extundelete, testdisk, photorec, kapa ntfsundelete ka ho toba ka mokhoa oa ho ngola khahlanong le koloi ea phofu; kamehla setšoantšo sa sesebelisoa sa block (sudo ddrescue -d -r0 /dev/nvme0n1p2 /mnt/external/disk_image.raw /mnt/external/rescue.map) 'me u betla lifaele tsa hau ho tsoa setšoantšong kapa u ngole lifaele tse hlakotsoeng ka thata ho disk ea bobeli ea' mele.
10. Sheba linepe tse patiloeng tsa sistimi ea lehae (Btrfs, ZFS, LVM, li-snapshots tsa sebakeng sa MacOS APFS Time Machine, le Windows Volume Shadow Copies) pele ba qeta lihora ba betla likarolo tse tala: Litsamaiso tse ngata li boloka litšupiso tsa atomic point-in-time block (tmutil listlocalsnapshots / ho macOS, vssadmin list shadows ho Windows, zfs list -t snapshot, kapa btrfs subvolume list -s /) tse lumellang ho hlaphoheloa hang ka liphesente tse 100 tsa rm -rf kapa Shift+Delete li-directory ntle le ho ama lihlopha tse tala tse sa abeloang.

Sefate sa liqeto: ho lekoa hang-hang ka mor'a kotsi rm -rf kapa Shift+Delete¶

Latela sefate sena sa liqeto nakong ea metsotsoana e 60 ea pele ea ho fumana ho hlakotsoe ho boloka liperesente tse phahameng ka ho fetesisa tsa li-block tsa data tse sa hokahaneng:

flowchart TD
    Start["Ka kotsi rm -rf, fumana -delete, kapa Shift+Delete E phethiloe"] --> OpenCheck{"Na mokhoa ofe kapa ofe oa ho Running (DB, Editor, Server, Tail) o ntse o na le Faele e Hlakotsoeng e Bulehile?"}

    OpenCheck -->|"Ho joalo (Linux / macOS e ntse e sebetsa)"| ProcRescue["MOHATO 1: Matha sudo lsof + L1 Hang-hang 'me Kopitsa Litlhaloso Tsa Lifaele Tse Butsoeng ho tloha /proc/PID/fd/N ho RAM Disk (/dev/shm) kapa USB ea kantle."]
    OpenCheck -->|"Che (Kapa Lifaele Tsohle li ne li Koetsoe)"| SnapCheck{"Na Molumo o Sebelisa ZFS, Btrfs, APFS Local Snapshots, kapa Windows Shadow Copies?"}

    ProcRescue --> FreezeOS["MOHATO 2: Hang-hang Hlakola Lingoliloeng Tsohle tsa Disk"]
    SnapCheck -->|"E: CoW Snapshot e teng"| FreezeOS
    SnapCheck -->|"Che: Standard ext4, XFS, kapa NTFS Ntle le Snapshots"| FreezeOS

    FreezeOS --> OSBranch{"Ke Sistimi efe ea Ts'ebetso le Karohano e Ileng ea Otloa?"}

    OSBranch -->|"Linux Non-Root (/hae, / data)"| RemountRO["Matha: sudo mount -o remount,ro /mountpoint"]
    OSBranch -->|"Linux Root (/) Karohano"| SysRqRO["Matha: echo u | sudo tee /proc/sysrq-trigger (Kernel Emergency Read-Only Remount)"]
    OSBranch -->|"Windows C: Drive kapa macOS Boot APFS"| HardPower["U SE KE UA Koala Ka tloaelo: Tšoara Konopo ea Matla Metsotsoaneng e 10 kapa Hula Khoele ea Matla ho Thibela Log/Leqephe le Ngola"]
    OSBranch -->|"Bobeli ba Kantle kapa Data Drive"| UnmountSec["Fokotsa / Beha Bolumo bo Balang Feela Hang-hang 'me u hakolle Drive"]

    RemountRO --> LiveBoot["MOHATO 3: Boot External SystemRescue Live USB le Clone Partition e nang le ddrescue ho External Drive"]
    SysRqRO --> LiveBoot
    HardPower --> LiveBoot
    UnmountSec --> LiveBoot

    LiveBoot --> FSRecovery{"Khetha Mokhoa oa ho Pholosa ka Filesystem"}
    FSRecovery -->|"ext4 / ext3"| ExtRec["Journal Inode Recovery: ext4magic / extundelete / debugfs"]
    FSRecovery -->|"XFS / APFS / Unjournaled"| CarveRec["Tlhaeno le Hlooho / Maoto a ho Betla: photorec / scalpel / pele / xfs_irecover"]
    FSRecovery -->|"NTFS (Windows)"| NtfsRec["MFT Record Parsing: ntfsundelete / TestDisk / UFS Explorer / DMDE"]

Hobaneng motsotsoana o mong le o mong o kentsoe Read-Write (rw) e senya lifaele tse hlakotsoeng¶

Ho utloisisa hore na ke hobane'ng ha ho khutlisa ho bala feela kapa ho khaola motlakase ka thata e le qeto ea bophelo kapa lefu bakeng sa data ea hau, hlahloba hore na sistimi e 'ngoe le e' ngoe ea sejoale-joale e hlile e fetola eng ha o tsamaisa. unlink() (rm) kapa DeleteFileW() (Shift+Delete):

1. Ho etsahalang ka hare ext4, XFS, APFS, le NTFS nakong ya ho hlakolwa¶

Ha faele e hlakotsoe, ha ho sistimi e sebelisang bareki e sebelisang li-bandwidth tsa disk I/O ho ngola zeroes holim'a database ea 10 gigabyte (10.7 billion byte) kapa faele ea video. Sebakeng seo, mokhanni oa sistimi e fetola feela metadata e menyenyane:

2. SSD TRIM (Discard / Deallocate) Bomo ea Nako¶

Ho hard drive e ohlang (HDD), likarolo li lula li baloa ho fihlela li ngotsoe. Ho SSD (SATA kapa NVMe), ha tsamaiso ea lifaele e fana ka a TRIM kapa Deallocate taelo: - Boholo ba balaoli ba NVMe ba kenya tšebetsong Deterministic Read Zero kamora TRIM (DRAT / DZAT), ea khutla 0x00000000 (manoto kaofela) ho tsoa ho Flash Translation Layer (FTL) hang ha o amohela TRIM, le pele pokello ea lithōle ea NAND e qala. - Hobaneng litsamaiso tsa Linux hangata li phela TRIM: Liphatlalatso tse ngata tsa Linux (Ubuntu, Debian, Fedora, RHEL) Se ke oa lumella nako ea ho hloa e tsoelang pele discard ka ho sa feleng; ba tsamaisa nako ea beke le beke (fstrim.timer). Haeba u phahamisa ho bala feela (ro) ** pele fstrim.timer e sebetsa **, SSD ha e so ka e manolla li-blocks tseo.

Mohato oa 1: Ho pholosa lifaele tse tlositsoeng tse ntseng li butsoe ke ts'ebetso e sebetsang (/proc/<pid>/fd/)¶

Pele o qala bocha, oa theola, kapa oa koala fensetere e le 'ngoe ho Linux kapa macOS, ** hlahloba litlhaloso tsa faele tse bulehileng **. Litsamaisong tsa POSIX, rm mehala unlink(). Kernel e latela li-counter tse peli bakeng sa inode e 'ngoe le e' ngoe: 1. i_nlink: Kenyelletso ea li-directory tsa li-disk tse supang inode. 2. i_count: Mekhoa e sebetsang e tšoereng inode e butsoe mohopolong.

Molao oa khauta oa POSIX: kernel ** ha ho mohla e lokollang inode kapa e arola li-disk tsa disk ho fihlela BOTHO. i_nlink == 0 LE i_count == 0**. Haeba database e hlakotsoeng, log, video, kapa faele ea khoutu e ntse e bulehile ts'ebetsong efe kapa efe, ** karolo ea 100 lekholong ea faele eo e lula e le disk **.

Mohato ka mohato /proc/<pid>/fd/ tlhahiso ho Linux¶

1. ** Fumana faele e 'ngoe le e' ngoe e tlositsoeng e ntse e butsoe ke ts'ebetso efe kapa efe **:

   sudo lsof +L1
   

2. (Kapa sefa ka lebitso la faele: sudo lsof | grep -i "(deleted)" | grep -i "filename")*
3. Bala buka ea lsof dikholomo:

   COMMAND    PID     USER   FD   TYPE DEVICE  SIZE/OFF   NLINK    NODE NAME
   postgres  4182 postgres   14u   REG  259,2 524288000       0 1839204 /var/lib/postgresql/16/main/base/16384/16399 (deleted)
   

   Hlokomela PID(4182) ebe o hlobola lengolo le latelang (u, r, w) ho tloha FD(14u -> 14).
4. **Kopitsa faele e tala ho tsoa ho /proc/<pid>/fd/<fd_num> ho RAM (/dev/shm) kapa drive ea kantle **: Le ka mohla u se ke ua ngola faele e pholositsoeng karolong e amehang. Ngolla ho /dev/shm (RAM disk) kapa drive ea kantle ea USB:

   mkdir -p /dev/shm/rescued_files
   sudo cp /proc/4182/fd/14 /dev/shm/rescued_files/16399_recovered
   

5. ** Pholosa lifaele tse ngata tse bulehileng tse hlakotsoeng polokelong ea litaba kapa setshelo (PID=4182) ka lupu e le 'ngoe**:

   sudo mkdir -p /dev/shm/rescued_db
   for fd in /proc/4182/fd/*; do
     target=$(sudo readlink "$fd")
     if echo "$target" | grep -q "(deleted)"; then
       fd_num=$(basename "$fd")
       clean_name=$(echo "$target" | sed 's/ (deleted)//; s/\//_/g')
       sudo cp "$fd" "/dev/shm/rescued_db/fd_${fd_num}${clean_name}"
     fi
   done
   

6. ** Pholosa buffers le IDE Local History (vim, VS Code, Cursor, JetBrains)**:
7. Se ke oa koala li-tab tsa mohlophisi tse bulehileng: Boloka li-buffer ka kotloloho ho /dev/shm kapa ho khanna monoana.
8. ** VS Code / Cursor / VSCodium Local History **: E boloka likopi tsa nako e ikemetseng tsa faele e 'ngoe le e' ngoe e bolokiloeng ka hare. -/.config/Code/User/History/ (Linux), -/Library/Application Support/Code/User/History/ (macOS), kapa %APPDATA%\Code\User\History\ (Windows), ka ntle ho foldara ea projeke ea hau ka botlalo. Esita le ka morao rm -rf -/my-project kapa git clean -fdx, lifaele tsa hau tsa khoutu li lula li le teng ka hare User/History/ le entries.json bonts'a 'mapa oa faele e' ngoe le e 'ngoe ho khutlela tseleng ea eona ea pele.
9. Li-IDE tsa JetBrains (IntelliJ, PyCharm, WebStorm): E boloka histori ea othomathike ka hare -/.cache/JetBrains/<IDE>/LocalHistory/.
10. Git (git reset --hard kapa git branch -D ka .git/ e tiile): Matha git reflog kapa git fsck --lost-found hang-hang ho khutlisa li-blobs tse leketlileng kahare .git/objects/.

Mokhahlelo oa 2: Ho emisa tsamaiso ea faele Bala-Feela (ro) ntle le ho ngola diboloko tse sa abuwang¶

Hang ha u se u ntšitse litlhaloso tsa faele tse bulehileng ho tsoa ho /proc (kapa ho netefalitsoe hore ha e eo), taba ea mantlha ea hau hanghang ke ho thibela sistimi ea ts'ebetso ho ngola karolo e le 'ngoe ho ea karohanong.

1. Linux: Ho phahamisa Karolo ea data khahlano le Root (/) Partition Bala-Feela¶

• Scenario A: Lifaele tse tlositsoeng li ne li le karohanong e arohaneng (/home, /var, /data, /mnt/storage):
• Leka hanghang ho ntlafatsa ho bala feela:

  sudo mount -o remount,ro /home
  

• Haeba mount ho rialo mount point is busy, khetholla le ho emisa mekhoa ea ho ngola (sudo fuser -vm /home e lateloang ke sudo fuser -km -TERM /home), ebe hang-hang qala hape sudo mount -o remount,ro /home.
• Boemo B: Lifaele tse tlositsoeng li ne li le ho Root (/) partition (kapa u ke ke ua bolaea mekhoa e phathahaneng): U se ke ua matha sudo reboot kapa sudo shutdown -h now, hobane e tloaelehileng systemd shutdown e ngola megabyte ea journald shutdown logs, peo e sa reroang, le lifaele tsa boemo ba litšebeletso ka kotloloho ho tsona /. Sebakeng seo, qala Linux Kernel Magic SysRq Emergency Read-Only Remount:

  echo 1 | sudo tee /proc/sys/kernel/sysrq
  echo s | sudo tee /proc/sysrq-trigger
  echo u | sudo tee /proc/sysrq-trigger
  

• s (Emergency Sync): Lits'oants'o tse ntseng li emetse metadata ea sistimi ea memori e le hore superblock e fetohe.
• u (Emergency Remount Read-Only): E kopanya ka likhoka tsamaiso e 'ngoe le e 'ngoe e kentsoeng mochineng e le Bala-Feela (ro) ka har'a kernel, leha lits'ebetso li ntse li na le lifaele tse bulehileng bakeng sa ho ngoloa. Netefatsa seo / e se e baloa feela le grep " / " /proc/mounts.

2. Ho etsa setšoantšo sa Remote Cloud Server e hatselitsoeng (AWS EC2, GCP, DigitalOcean, Hetzner) ho feta SSH¶

Haeba u matha ka phoso rm -rf ho seva sa leru se hole moo o sa khoneng ho hokela drive ea USB: 1. Matha "Magic SysRq" e baloang feela (echo s > /proc/sysrq-trigger && echo u > /proc/sysrq-trigger). Seboka sa hau sa SSH se ntse se phela hobane SSH e sebetsa ho RAM le /dev/pts (devpts) ke sistimi ea faele ea pseudo-terminal ea RAM. 2. Ho li-platform tsa leru (AWS EC2, GCP, Azure, DigitalOcean), hang-hang nka atomic EBS / Block Volume Snapshot ho tswa ho cloud console, kapa emisa mohlala, tlosa molumo oa motso, 'me ue kopanye le ho bala feela (/dev/xvdf) ho pholosa VM e hloekileng. 3. Ho seva e hole ea tšepe e se nang letho, tsamaisa sets'oants'o se se nang letho sa karolo e batang ea ho bala feela ka ho toba ka SSH ho ea sebakeng sa heno sa mosebetsi:

ssh root@remote-server-ip "dd if=/dev/nvme0n1p2 bs=4M status=progress | zstd -1" > ~/rescued_partition.img.zst

Mokhahlelo oa 3: Ho hlahloba Kopi-on-Ngola e patiloeng (CoW) linepe le Likopi tsa Shadow pele o betla¶

Pele o hlahloba li-terabyte tsa likarolo tse sa abuoang, hlahloba hore na sistimi ea hau ea ts'ebetso e iketselitse setšoantšo se patiloeng sa nako:

1. macOS: Mochini oa Nako ea Lehae APFS Snapshots (tmutil)¶

Leha drive ea hau ea kantle ea Time Machine e se e koaletsoe ka libeke, macOS e rekota **ka hora ea lehae ea APFS Copy-on-Write snapshots ** ho SSD ea hau e kahare (com.apple.TimeMachine.YYYY-MM-DD-HHMMSS.local) neng kapa neng ha Mochini oa Nako o lokisoa kapa pele ho ntlafatso ea macOS: 1. Etsa lethathamo la linepe tsa sebaka ka seng ho Terminal:

tmutil listlocalsnapshots /
tmutil listlocalsnapshots /System/Volumes/Data

mkdir -p /tmp/apfs_rescue
sudo mount_apfs -o ro -s com.apple.TimeMachine.2026-10-31-140000.local /System/Volumes/Data /tmp/apfs_rescue
ls -la /tmp/apfs_rescue/Users/yourname/

2. Windows 10 / 11 / Server: Volume Shadow Copies (VSS)¶

1. Bula Administrator Command Prompt ebe o matha:

   vssadmin list shadows
   

2. Haeba Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1) e etella pele ea hau Shift+Delete, e hokahanya le foldareng ebe u kopitsa lifaele tsa hau ho drive ea USB:

   mklink /d C:\ShadowRescue \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
   

3. Linux: Btrfs, ZFS, le LVM Lits'oants'o¶

• Bula Btrfs (Fedora, openSUSE, Synology, Timeshift/Snapper systems): Matha sudo btrfs subvolume list -s / le ho hlahloba /.snapshots/ kapa /run/timeshift/backup/timeshift-btrfs/snapshots/.
• Bula ZFS (Ubuntu ZFS, Proxmox, TrueNAS): Matha zfs list -t snapshot le ho kopitsa lifaele ka kotloloho ho tsoa ho /path/to/dataset/.zfs/snapshot/.

Mokhahlelo oa 4: Inode ea mohato ka mohato, Journal, le MFT Recovery ka Filesystem¶

Haeba ho se na tlhaloso ea faele e bulehileng (/proc/<pid>/fd/) mme ha ho senepe se neng se le teng, boot ho tloha SystemRescue kapa Ubuntu Live USB, hokela hard drive ea kantle ea USB (/mnt/external), 'me u thehe setšoantšo sa "bit-for-bit" sa karolo e sa lekanyetsoang ea mahlatsipa (/dev/nvme0n1p2) pele:

sudo ddrescue -f -n /dev/nvme0n1p2 /mnt/external/victim_partition.img /mnt/external/ddrescue.log

1. Ho hlaphoheloa ho tloha ext4 / ext3 ho Linux (ext4magic le extundelete)¶

Neng rm -rf hlakola lifaele ho ext4, kernel e hlahisa boholo ba lintlha tsa sefate ka har'a tafole e kholo ea inode. Leha ho le joalo, **ext4's jbd2 koranta (ka tloaelo li-megabyte tse 128 ho isa ho tse 1,024 ka boholo) li boloka likopi tsa histori tsa li-inode blocks tse sa tsoa fetoloa **. Ha feela o ntse o nyoloha ro pele ts'ebetso e boima ea disk e koahela koranta ea ring buffer, ext4magic e hula inode ea ho hlakolwa pele ho koranta mme e hlophisa lifaele tsa hau bocha ka mabitso a lifaele tsa mantlha le lifate tsa mengolo li sa fetohe.

1. Matha ext4magic ho khutlisa lifaele tsohle tse hlakotsoeng nakong ea lihora tse 2 tse fetileng (-a) ka har'a tsela e itseng (-f):
2. (Tlohela sekhechana se ka sehloohong sa mountpoint ho -f: bakeng sa /home/kmyers/project ka motso / karohano, fetisa -f home/kmyers/project; haeba /home ke karohano ea eona, feta -f kmyers/project.)*

   mkdir -p /mnt/external/recovered_ext4
   sudo ext4magic /mnt/external/victim_partition.img \
     -a $(date -d "2 hours ago" +%s) \
     -f home/kmyers/project \
     -R -d /mnt/external/recovered_ext4
   

3. E 'ngoe: Matha extundelete khahlano le setšoantšo:

   cd /mnt/external
   sudo extundelete /mnt/external/victim_partition.img --restore-directory home/kmyers/project
   

2. Ho hlaphoheloa ho tloha Windows NTFS kamora Shift+Delete (TestDisk le ntfsundelete)¶

Ho fapana le ext4, Windows NTFS HA e fane ka li-pointers tsa block extent (Data Runs) ka hare ho Master File Table ($MFT) rekota ha faele e hlakotsoe. Ha o tobetsa Shift+Delete ho NTFS, 1,024-byte $MFT ho kena feela ho flips the header flag from 0x01 (In-Use) ho 0x00 (E hlakotsoe). Ea eona $FILE_NAME tšobotsi le $DATA cluster runlist e lula e le karolo ea 100 lekholong ho fihlela faele e 'ngoe e sebelisa seo hape $MFT sekotjana:

1. ** Sebelisa TestDisk bakeng sa NTFS hang-hang $MFT ho hlakola ka litsela tse felletseng tsa lifoldara **:

   sudo testdisk /mnt/external/victim_partition.img
   

   Khetha [ Proceed ] -> [ EFI GPT ] -> [ Advanced ] -> totobatsa karohano ea NTFS -> [ Undelete ]. Eya ho foldara ea hau, tobetsa a ho khetha lifaele tse hlakotsoeng, ebe o tobetsa C (motse-moholo C) ho li kopitsa ho /mnt/external/recovered_ntfs/.
2. ** Sebelisa ntfsundelete (ntfs-3g)**:

   sudo ntfsundelete /mnt/external/victim_partition.img -t 2d
   sudo ntfsundelete /mnt/external/victim_partition.img -u -m "*" -d /mnt/external/recovered_ntfs
   

3. Ho hlaphoheloa ho tloha XFS, APFS, kapa Lingoliloeng tse Ngotsoeng ka holimo ka Raw Block Carving (PhotoRec le grep -a -b)¶

Ha li-inode pointer li felile (joalo ka ho XFS, APFS, kapa e ext4 karohano eo koranta ea eona e phuthetsoeng), fumana lintlha ka ho skena li-block tsa 4,096-byte (4 kilobyte) tse sa abeloang bakeng sa lihlooho tsa lifaele kapa likhoele tse ikhethang:

Mokhoa oa ho sebelisa grep -a -b + dd ho pholosa khoutu ea mohloli o hlakotsoeng kapa .env lifaele ka tlase ho metsotso e 2¶

Haeba u hlakotse khoutu ea mohloli, .env liphiri, kapa lintlha tse ka tlase ho li-kilobytes tse 32 ka boholo: 1. Batla khoele e ikhethang ka har'a faele e hlakotsoeng ebe u e hatisa hantle byte offset (-b):

LC_ALL=C grep -a -b -o "def calculate_invoice_tax" /mnt/external/victim_partition.img

dd if=/mnt/external/victim_partition.img bs=4096 skip=11789795 count=30 status=none > /mnt/external/rescued_code_block.txt

Mokhahlelo oa 5: Ho thibela tlokotsi e tlang rm -rf le Shift+Delete likotsi¶

• ** Kenya sebaka sa ho sebelisana rm ka trash-cli le rm -I --preserve-root=all**: Kenya trash-cli (trash-put, trash-list, trash-restore) le mabitso rm ho rm -I --preserve-root=all ho /etc/bash.bashrc le -/.zshrc kahoo ho hlakoloa ka phoso ka tšohanyetso hang-hang pele ho li-inodes.
• ** Sireletsa li-directory tsa bohlokoa tsa tlhahiso ka Linux Immutable Attribute (chattr +i)**: Leha root (sudo rm -rf) ha e khone ho hlakola kapa ho fetola bukana kapa faele e tšoailoeng sudo chattr +i /path/to/critical_config ho fihlela motsamaisi a matha sudo chattr -i.
• Lumella ho Kopitsa-ho Ngola ha Lehae (CoW) Lits'oants'o (Btrfs / ZFS / APFS / Windows Shadow Copies): Sebelisa Snapper kapa Timeshift ho Btrfs, sanoid ho ZFS, kapa makhetlo a mabeli ka letsatsi Likopi tsa Moriti oa Mohala ho Windows (SystemPropertiesProtection.exe).
• ** Boloka li-backups tse ikemetseng tsa 3-2-1 ka polokelo e sa fetoheng ea Offsite **: Latela tataiso ea rona ho lik'homphieutha, leano la 3-2-1, le ho hlaphoheloa ha likoluoa tshebediso restic kapa borgbackup e nang le li-repositories feela tse hole.

Linomoro tsa libaka tsa tšohanyetso le liprothokholo tsa mekhatlo¶

Le ha ho hlakolwa ha faele ka phoso komporong ea hau ke ts'ohanyetso ea tekheniki eseng taba ea sepolesa, ho hlakoloa ka phoso kapa ka lonya ho amang lits'ebeletso tsa bophelo bo botle, meaho ea masepala, bopaki ba molao tlasa taelo ea paballo ea lekhotla, kapa data e laoloang e ka baka tlaleho ea ketsahalo e tlamang:

• United States le Canada:
• **Tsireletso ea Bophelo ba Tšohanyetso / Khaello e Bohlokoa ea Meralo **: Daela 911 ha sistimi e hlakola e ama tlhokomelo ea bakuli sepetlele, thomello ea tšohanyetso, kapa taolo ea polokeho ea 'mele ea indasteri.
• Setsi sa Tšireletso ea Cybersecurity le Infrastructures (CISA) (US): Tlaleha ts'enyeho ea bohlokoa ea lits'ebeletso tsa motheo kapa ts'oaetso e belaelloang ea kahare ho 1-844-Say-CISA (1-844-729-2472) kapa cisa.gov/report.
• Setsi sa Canada sa Tšireletso ea Cyber: Ikopanye 1-833-CYBER-88 (1-833-292-3788) bakeng sa diketsahalo tsa bohlokwa tsa meralo ya motheo.
• United Kingdom:
• Litšebeletso tsa Tšohanyetso: Daela 999 (kapa 101 bakeng sa tlaleho ea sepolesa e seng ea tšohanyetso haeba ho hlakolwa ho kenyelletse tshebediso e mpe ya komporo e sa dumellwang tlasa Computer Miuse Act 1990).
• Ofisi ea Khomishenara ea Litaba (ICO): Haeba ho hlakolwa ka phoso ho senya datha tsa motho ka ho sa feleng ntle le ho hlaphoheloa (e leng ho Tloaelana ha Availability tlas'a UK GDPR), hlahloba hore na ke tsebiso ho ICO (0303 123 1113) nakong ea lihora tse 72 lia hlokahala.
• European Union:
• Litšebeletso tsa Tšohanyetso: Daela 112 ho phatlalla le linaha tsohle tseo e leng litho tsa EU.
• GDPR Article 33 Availability Breach Report: Tlas'a European Data Protection Board (EDPB) litataiso, ts'enyehelo ea ka phoso ea data ea hau ntle le bekapo e ka khutlisoang e hlalosoa e le tahlehelo ea data ea hau (tahlehelo ea boteng) mme e ka hloka ho tlaleha ho Bolaoli ba Naha ba Ts'ireletso ea Lintlha (DPA) nakong ea lihora tse 72.
• Australia le New Zealand:
• Litšebeletso tsa Tšohanyetso: Daela 000 Australia kapa 111 New Zealand.
• Setsi sa Tšireletso ea Cyber ​​ea Australia (ACSC): Letsetsa 1300 CYBER1 (1300 292 371) bakeng sa thuso ea likhoebo kapa litšebeletso tsa motheo.
• India le Asia-Pacific:
• India (CERT-In / Mohala oa Thuso oa Naha oa Cyber ​​Crime): Letsetsa 112 bakeng sa karabelo ya tshohanyetso kapa 1930 bakeng sa liketsahalo tsa cybercrime; liketsahalo tsa khoebo tse koahetsoeng ke CERT-In mandates li tlameha ho tlalehoa nakong ea lihora tse 6 ho incident@cert-in.org.in.

Lipotso tse botsoang khafetsa¶

Hobaneng ba sa ka ba etsa joalo extundelete kapa ext4magic fumana mabitso a lifaele tsaka ho ext4 le hoja ke khaotse ho sebelisa k'homphieutha kapele?¶

Ha faele e hlakolwa ext4, Linux kernel hang-hang e hlahisa lintlha tsa sefate ka har'a tafole ea inode ea disk e le hore tsamaiso ea lifaele e tsebe hore inode ha e na tekanyo e fanoeng. Lisebelisoa tse kang ext4magic le extundelete itšetleha ka ho fumana kopi ea khale, e hlakotsoeng esale pele ea inode eo ka hare ho ext4 koranta (jbd2). Haeba faele e bōpiloe le ho hlakoloa ntle le hore e kene ka har'a koranta e sa tsoa feta, kapa haeba boitsebiso bo boima bo ngola bo phuthetsoe 128 MB ho 1 GB ea ring buffer pele u khutlisetsa ho bala feela, kopi ea koranta e felile. Boemong bo joalo, o tlameha ho fetohela ho ho betla li-signature tse tala (PhotoRec) kapa ho batla ka mokhoa o hlakileng (grep -a -b), e hlahlobang li-block tsa data tse sa abeloang ka kotloloho ntle le ho hloka metadata ea inode.

E fana ka SSD TRIM senya kamehla rm -rf kapa Shift+Delete lifaele hang-hang?¶

Ha se kamehla, haholo-holo ho Linux le li-drive tsa kantle. On Windows 10/11 le macOS e nang le li-NVMe SSD tsa kahare, sistimi e sebetsang hangata e romella inline. TLHOKOMELA / Deallocate taelo ho molaoli oa SSD nakong ea metsotsoana ea ho hlakoloa ka ho sa feleng, e leng se bakang Flash Translation Layer ea SSD (FTL) ho khutlisa zero (DZAT) bakeng sa liboloko tseo. Leha ho le joalo, liphaello tse ngata tsa Linux (Ubuntu, Debian, Fedora, RHEL) li etsa eseng thusa ho tsoela pele ho hloa nako lahla ka ho sa feleng; ho e-na le hoo, lia matha fstrim.timer hang ka beke. Ho feta moo, libaka tse ngata tsa USB-to-SATA le USB-to-NVMe ha li fete. TLHOKOMELA litaelo holim'a USB Mass Storage (BOTHO), le likarolo tsa software tsa RAID / LVM / LUKS hangata li thibela lahla passthrough by default ntle le haeba e hlophisitsoe ka ho hlaka (`issue_discards = 1` kapa `allow-discards`).

Ho thoe'ng haeba karohano ea ka ea Linux e patiloe ka LUKS (dm-crypt) kapa Windows drive ea ka e sebelisa BitLocker: na nka betla lifaele tse hlakotsoeng?¶

Ho joalo, ha feela o na le poleloana ea lekunutu kapa senotlolo sa ho khutlisa 'me o notlolla setshelo ka mokhoa oa ho bala feela. Le ka mohla u se ke ua matha photorec, ext4magic, kapa testdisk khahlano le karohano e tala e kentsoeng ea 'mele (/dev/nvme0n1p2), hobane mongolo o patiloeng o shebahala joalo ka lerata le sa reroang. Sebakeng seo, qala ho tsoa ho Live USB, notlolla setshelo ho kena mokhoa oa ho bala feela (bakeng sa LUKS: sudo cryptsetup bula --readonly /dev/nvme0n1p2 crypt_rescue; bakeng sa BitLocker ho Linux: dislocker -r kapa notlolla tse baloang feela ho WinPE), 'me u etse setšoantšo kapa u hlahlobe sesebelisoa sa 'mapa se sirelelitsoeng (/dev/mapper/crypt_rescue).

Hobaneng o hula thapo ea motlakase ho Windows C:\ sireletsehileng ka mora kotsi Shift+Delete ho feta ho tobetsa "Shut down"?¶

Ha o tobetsa Qala > Kwala ho Windows, sistimi ea ts'ebetso e etsa li-megabyte tse makholo tsa disk e ngolang pele e tima: e hlakola li-hives tsa registry, e ngola liketsahalo tsa ho koala ho .evtx logs, e ntlafatsa USN Journal ($UsnJrnl), e hlakola kapa e fokotsa boholo pagefile.sys, 'me ho Fast Startup systems e ngola faele ea hibernation ea li-gigabyte tse ngata (hiberfil.sys) ka kotloloho ho pholletsa le lihlopha tsa NTFS tse sa abuoang. Lingoliloeng tseo tsa shutdown hangata li hlakola tse sa abuoang $MFT lirekoto le lihlopha tsa data tse lokolotsoeng ke hau Shift+Delete. Ho qobella ho tima hang-hang (ho tšoara konopo ea matla bakeng sa metsotsoana ea 10 kapa ho hula polaka) ho emisa tsohle tse ngolang hang-hang; NTFS e tla lula e baloa ka botlalo ha e buloa ho tsoa ho Linux e baloang feela kapa USB ea pholoso ea WinPE.

Nka hlaphoheloa joang e hlakotsoeng .env faele, senotlolo sa SSH, kapa faele ea khoutu ea mohloli eo PhotoRec e hlokomolohuoe?¶

PhotoRec e batla lihlooho tsa binary magic byte (joalo ka %PDF, PNG, kapa PK bakeng sa lifaele tsa ZIP/Office), kahoo hangata e tlola kapa e kopanya lifaele tse khutšoane tse hlakileng joalo ka .env tlhophiso, khoutu ea mohloli oa Python/JavaScript, lintlha tsa Markdown, le linotlolo tsa SSH. Ho fumana faele efe kapa efe e hlakileng ho tsoa setšoantšong sa disk kapa karohano ea ho bala feela, matha LC_ALL=C grep -a -b -C 100 "UNIQUE_TEXT_FROM_FILE" /dev/nvme0n1p2 > /dev/shm/found.txt. Haeba u tseba lebitso lefe kapa lefe le feto-fetohang (joalo ka STRIPE_SECRET_KEY= kapa QALA PULA KOTLO EA PRIVATE), grep -a -b e lekola likarolo tse tala ka li-gigabyte tse 'maloa motsotsoana ebe e hatisa li-block tsa disk tse haufi.

Haeba ke ile ka matha ka phoso rm -rf / kapa hlakotsoe /usr kapa /lib ho Linux mme hona joale ha ho joalo ls, cp, kapa sudo e sebetsa, ke tsamaisa litaelo joang ho terminal ea ka e bulehileng?¶

Haeba u hlakotsoe /bin kapa /lib ha e ntse e le teng bash kapa zsh terminal e ntse e bulehile ka RAM, li-binaries tsa kantle joalo ka /bin/ls kapa /bin/cp tla hloleha le Ha ho faele kapa lenane le joalo, empa li-shell-ins li ntse li sebetsa ka hare ho RAM. U ka sebelisa echo* sebakeng sa ls, printf "%s\n" "$( /dev/shm/rescued sebakeng sa cp, le echo u > /proc/sysrq-trigger (haeba khetla ea hau e se e le motso) ho etsa hore kernel e baloe feela pele e tima le ho bulela SystemRescue Live USB.

Litataiso tse amanang¶

• Ho hlakolwa ha faele ka phoso, drive e hlophisitsoeng, le ho hlaphoheloa ha lifoto
• SSD le NVMe mokhoa oa ho bala feela ka tšohanyetso, li-block tsa 0%, le pholoso e sitisang TRIM.
• Ho hloleha ha hard drive le ho hlaphoheloa ha data
• Sehlopha sa NAS RAID se senyehile, ho hloleha ha likoloi tse ngata, le ho hlaphoheloa ha ZFS/Btrfs
• Li-backups tsa khomphutha, leano la 3-2-1, le ho hlaphoheloa ha koluoa
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha

Mehloli le tataiso ea semmuso¶

• Setsi sa Naha sa Maemo le Thekenoloji (NIST) (United States): * Phatlalatso e Khethehileng 800-86: Tataiso ea ho Kopanya Mekhoa ea Forensic ho Karabelo ea Ketsahalo & SP 800-88 Rev. 1: Tataiso ea Tsamaiso ea Tsamaiso ea Mecha (ATA TRIM / NVMe Deallocate Behavior)*.
• Mokhatlo oa Linux Kernel (kernel.org): * Litokomane tsa Ext4 Filesystem (Thibela le Kabo ea Inode, jbd2 Ho ngola litaba, le procfs /proc/<pid>/fd/ File Descriptor Semantics) & Linux Magic System Request Key (sysrq.txt)*.
• CGSecurity (TestDisk & PhotoRec Litokomane tsa Molao) le ext4magic Bukana ea Litšupiso ea Upstream: Journal Inode Extraction and Unalloated Extent Carving on ext3/ext4 le NTFS Volumes.
• Cybersecurity and Infrastructure Security Agency (CISA) (United States): Karabelo ea Ketsahalo le Mekhoa e Molemo ka ho Fetisisa ea ho Boloka Bopaki bo sa Feleng/Bo sa Feleng Bopaki.
• European Union Agency for Cybersecurity (ENISA): * Tataiso e Ntle ea Boikoetliso bakeng sa Digital Forensics le Storage Media Preservation *.