Ngengozi rm -rf okanye Shift-Cima kwiLinux, macOS, okanye Windows: Ukunyuswa kwakhona kokuFunda-Kuphela¶

Ukubukela ngengozi rm -rf, find -delete, git clean -fdx, okanye iiWindows Shift+Delete cima ugcino lwedatha yemveliso ebalulekileyo, ikhowudi yemvelaphi, okanye iifayile zobuqu ngaphandle kokuzithumela kwiRecycle Bin okanye iFowulda yeNkunkuma ixhokonxa ukothuka kwangoko. Nangona kunjalo, akukho nanye rm -rf nokuba Shift+Delete eneneni ikhupha amacandelo akho ogcino angaphantsi ngalo mzuzu ugqiba komyalelo: endaweni yoko, inkqubo yokusebenza iqhawuka lula ungeno lolawulo, ihlaziya ijenali yemetadata, kwaye iphawula ezozalathisi ze-inode okanye Itheyibhile yeFayile eyiNtloko (MFT) iirekhodi kunye neebhloko ze-bitmaps njengoko zikhoyo ukuze zisetyenziswe kwakhona. Yintoni etshabalalisa ngokusisigxina iifayile zakho ezicinyiweyo ngu umzuzwana ngamnye inkqubo yefayile ihleli inyuswe kufundo-bhala (rw) indlela* emva kocimo, njengabagcini benkqubo yangasemva (systemd-journald, rsyslog), iicache zebrawuza, umsebenzi wokutshintsha, kunye ne-SSD TRIM / discard imiyalelo bhala ngaphezulu ngokukhawuleza iibhloko ezisanda kukhululwa. Ukuba inkqubo yakho endaweni yoko iphethwe kukucofa ngokwasemzimbeni, amacandelo amabi, okanye isilawuli esifileyo, yima kwaye utshintshele kwisikhokelo sethu. hard drive ukusilela kunye kwakhona data, okanye ukuba i-slid-state drive yakho izitshixe ngenxa yokunxiba komlawuli, yabona I-SSD kunye ne-NVMe imowudi yokufunda kuphela ngokukhawuleza kunye ne-TRIM yokukhubaza ukuhlangula; malunga neempazamo zokufomatha ngokubanzi okanye imiba yekhadi lekhamera, dibana ucimo lwefayile ngempazamo, ifomathiwe drive, kunye nokubuyisela ifoto. Ukuba esi sehlo sibandakanya ukonakaliswa kolwaphulo-mthetho, ubuqhetseba, okanye ukucinywa kwenkqubo yokhuseleko lobomi, tsalela umnxeba kwinombolo yakho yexesha likaxakeka (911 eUnited States naseKhanada, 112 kwiManyano yaseYurophu, 999 eUnited Kingdom) okanye jonga uluhlu lwethu lwamazwe ngamazwe lwe amanani kaxakeka.

Yenza oku ngoku¶

1. Cofa Ctrl+C ngoko nangoko ukuba ucimo lomyalelo usasebenza, kwaye SUKU vala naziphi na iifestile ezivulekileyo zesiphelo sendlela, abahleli bokubhaliweyo, abadlali bemidiya, okanye iidaemon zedatabase: Ukuba nayiphi na inkqubo esebenzayo (nginx, postgres, mysqld, vim, code, python, tail, okanye umdlali wevidiyo) isenayo ifayile ecinyiweyo evuliweyo kwinkumbulo, i Linux okanye i-macOS kernel igcina iibhloko zedatha yefayile injalo kwidiski de loo nkqubo ivale inkcazo yefayile yayo. Ukuvala usetyenziso okanye ukuqalisa kwakhona umatshini ngoku kuya kukhulula ngoko nangoko inani lereferensi (i_nlink == 0) kwaye uqalise ukuhanjiswa kwebhloko yokwenyani.
2. Phambi kokunyuswa okanye ukucima iLinux, jonga /proc/<pid>/fd/ ngoku ukuhlangula naziphi na iifayile ezicinyiweyo ezisagcinwe zivuliwe yinkqubo esebenzayo: Qhuba sudo lsof +L1 (edwelisa zonke iifayile ezivuliweyo ezinobalo lwekhonkco olungaphantsi ko-1, okuthetha ukuba zazingadityaniswanga ngu rm ngelixa lisavuliwe) kwaye ngoko nangoko ukhuphele imixholo yazo ekrwada ngaphandle kwe-RAM/kernel cache kwi drive eyahlukileyo okanye /dev/shm (tmpfs RAM disk) usebenzisa cp /proc/<pid>/fd/<fd_number> /dev/shm/rescued_file.
3. Khupha kwakhona isahlulelo esichaphazelekayo Funda-Kuphela (ro) ngoko nangoko ukuze i-OS kernel ingakwazi ukubhala enye i-byte yelog zejenali okanye iifayile zeTemp kwiibhloko ezingabiwanga:
4. Kwi Linux (ext4, XFS, Btrfs): Baleka sudo mount -o remount,ro /path/to/mountpoint (umzekelo, sudo mount -o remount,ro /home okanye sudo mount -o remount,ro /).
5. Ukuba mount -o remount,ro iyasilela nge mount point is busy kwingcambu yakho (/) ulwahlulo: Qalisa i-kernel ekhawulezileyo yokufunda-kuphela kwakhona ngeMagic SysRq ngokubaleka echo u | sudo tee /proc/sysrq-trigger (enyanzela zonke iindlela zefayile ezinyusiweyo ukuba ziphinde zifundeke-kuphela ngokukhawuleza ngaphandle kweenkqubo zokubulala okanye ukulinda ukuvulwa kwezitshixo).
6. ** Kwi-macOS (APFS / HFS+)**: Baleka sudo diskutil mount readOnly /Volumes/TargetVolume yemithamo engeyo-yokuqala, okanye ukuba iifayile bezikwiprayimari yakho Data umthamo (/System/Volumes/Data), ngoko nangoko nyanzelisa ukucima umbane ngokubamba i-ID yokuChukumisa / iqhosha laMandla imizuzwana eli-10 ukumisa iSpotlight yangasemva (mds_stores) kunye fseventsd uyabhala.
7. KwiWindows (NTFS / ReFS): Ukuba iifayile ezicinyiweyo bezikwi drive yesibini (D:, E:), vula i-Administrator Command Prompt kwaye utshixe ivolumu yokufunda kuphela nge diskpart (select volume D, attributes volume set readonly). Ukuba iifayile bezivuliwe C:\, musa ukucima iWindows ngokuqhelekileyo (ukuvalwa okuqhelekileyo kubhala amakhulu eemegabytes zehives yobhaliso, iilog zesiganeko, kunye nohlaziyo lwefayile yephepha ngaphezulu kwekhululiwe MFT amaqela); endaweni yoko, tsala intambo yamandla edesktop okanye ubambe iqhosha lamandla elaptop phantsi imizuzwana eli-10 ukusika amandla ngoko nangoko.
8. ** Thintela SSD TRIM (discard / UNMAP) ukusuka kuqanda kumaphepha ombane angabiwanga**: Ukuba uqhubo yiNVMe okanye SATA SSD kwaye yanyuswa ngokuqhubekayo discard (okanye ukuba iWindows/macOS isebenza ngokucwangcisiweyo TRIM ngoko nangoko xa kucinywa ifayile), ukusika amandla okanye ukunyuswa kwakhona ro ngokukhawuleza imisa i-OS ekufoleni ukongeza NVME_DSM_ATTR_DEALLOCATE imiyalelo, kunye nokubeka i-SSD kwi-USB-to-NVMe i-adapter yebhulorho engadluliyo TRIM ngexesha lokubuyisela lithintela ukuqokelelwa kwenkunkuma ngasemva komlawuli ekusuleni iibhloko ezinokubuyiswa.
9. Qalisa kwi-USB ephilayo yangaphandle (Ubuntu Live, SystemRescue, okanye WinPE) kwaye uthelekise isahlulelo sebit-for-bit kwidrive yokugcina yangaphandle usebenzisa ddrescue phambi kokusebenzisa nasiphi na isixhobo esingacimiyo: Ungaze ubaleke ext4magic, extundelete, testdisk, photorec, okanye ntfsundelete ngqo kwimo yokubhala ngokuchasene nexhoba lokuqhuba; soloko unomfanekiso wesixhobo sebhlokhi (sudo ddrescue -d -r0 /dev/nvme0n1p2 /mnt/external/disk_image.raw /mnt/external/rescue.map) kwaye uqingqe iifayile zakho kumfanekiso okanye ubhale iifayile ezifunyenwe ngokungqongqo kwidiski ebonakalayo yesibini.
10. Jonga imifanekiso efihlakeleyo yefayile yendawo (Btrfs, ZFS, LVM, ii-macOS APFS Time Machine snapshots yendawo, kunye Windows Volume Shadow Copies) phambi kokuchitha iiyure bekrola amacandelo ekrwada: Iisistim ezininzi zigcina ngokuzolileyo iireferensi zebhloko yeatom-in-time (tmutil listlocalsnapshots / kwi-macOS, vssadmin list shadows kwiWindows, zfs list -t snapshot, okanye btrfs subvolume list -s /) ezivumela ngoko nangoko 100 ekhulwini ukufunyanwa kwakhona rm -rf okanye Shift+Delete abalawuli ngaphandle kokuchukumisa amaqela akrwada angabiwanga.

Umthi wesigqibo: ukuvavanywa kwangoko emva kwengozi rm -rf okanye Shift+Delete¶

Landela lo mthi wesigqibo kwimizuzwana yokuqala engama-60 yokufumana ucimo ukuze ugcine eyona pesenti iphezulu yeebhloko zedatha ezingadityaniswanga:

flowchart TD
    Start["Ngengozi rm -rf, fumana -delete, okanye Shift+Delete Iphunyeziwe"] --> OpenCheck{"Ngaba nayiphi na iNkqubo yokuBaleka (i-DB, umhleli, iseva, umsila) isenayo iFayile ecinyiweyo?"}

    OpenCheck -->|"Ewe (Linux / macOS isasebenza)"| ProcRescue["INYATHELO 1: Qhuba i-sudo lsof + L1 Ngokukhawuleza kwaye Khuphela iiNkcazo zeFayile ezivuliwe ukusuka / proc/PID/fd/N ukuya RAM Disk (/dev/shm) okanye USB yangaphandle"]
    OpenCheck -->|"Hayi (okanye zonke iiFayile zivaliwe)"| SnapCheck{"Ngaba uMqulu uyaSebenzisa i-ZFS, i-Btrfs, i-APFS yasekuhlaleni i-Snapshots, okanye i-Windows Shadow Copies?"}

    ProcRescue --> FreezeOS["INYATHELO 2: Kwangoko Khulisa yonke iDiski ebhalayo"]
    SnapCheck -->|"Ewe: I-CoW Snapshot ikhona"| FreezeOS
    SnapCheck -->|"Hayi: Standard ext4, XFS, okanye NTFS Ngaphandle kwezifinyezo"| FreezeOS

    FreezeOS --> OSBranch{"Yeyiphi iNkqubo yokuSebenza kunye neSahlulo esibethwe?"}

    OSBranch -->|"Linux Non-Root (/ikhaya, / data)"| RemountRO["Qhuba: sudo nyuka -o remount,ro /mountpoint"]
    OSBranch -->|"Ingcambu yeLinux (/) Ukwahlulahlula"| SysRqRO["Baleka: echo u | sudo tee / proc/sysrq-trigger (Kernel Emergency Read-Only Remount)"]
    OSBranch -->|"Windows C: Qhuba okanye iMacOS Boot APFS"| HardPower["MUSA ukuVala Ngokuqhelekileyo: Bamba iqhosha laMandla iSekondi ezili-10 okanye Tsala intambo yamandla ukunqanda iLog/Ifayile yePhepha ibhala"]
    OSBranch -->|"ISekondari yangaphandle okanye i-Data Drive"| UnmountSec["Hlula ukunyuswa / Seta iVolumu yokuFunda-kuphela Kwangoko kwaye ukhuphe uqhagamshelo kwi-Drive"]

    RemountRO --> LiveBoot["INYATHELO 3: I-Boot External SystemRescue Live USB kunye ne-Clone Partition kunye ne-ddrescue kwi-Drive yangaphandle"]
    SysRqRO --> LiveBoot
    HardPower --> LiveBoot
    UnmountSec --> LiveBoot

    LiveBoot --> FSRecovery{"Khetha iNdlela yoBuyiselo ngesixokelelwano seFayile"}
    FSRecovery -->|"ext4 / ext3"| ExtRec["Ijenali ye-Inode yoBuyiselo: ext4magic / extundelete / debugfs"]
    FSRecovery -->|"XFS / APFS / Unjournaled"| CarveRec["Umsayino kunye neNtloko / uMzobo oMazantsi: ifotorec / i-scalpel / phambili / xfs_irecover"]
    FSRecovery -->|"NTFS (Windows)"| NtfsRec["MFT Record Parsing: ntfsundelete / TestDisk / UFS Explorer / DMDE"]

Kutheni imizuzwana nganye inyusiwe Funda-Bhala (rw) itshabalalisa iifayile ezicinyiweyo¶

Ukuqonda ukuba kutheni ukunyuswa kwakhona kwangoko okanye ukunqunyulwa kwamandla sisigqibo sobomi okanye sokufa kwidatha yakho, jonga ukuba yintoni inkqubo yefayile yangoku eyilungisayo xa ubaleka. unlink() (rm) okanye DeleteFileW() (Shift+Delete):

1. Kwenzeka ntoni ngaphakathi ext4, XFS, APFS, kwaye NTFS ngexesha lokucinywa¶

Xa ifayile icinyiwe, akukho nkqubo yokusebenza yabathengi ichitha idiski ye-I / O i-bandwidth yokubhala i-zeroes ngaphezu kwe-10 gigabyte (10.7 billion byte) database okanye ifayile yevidiyo. Endaweni yoko, umqhubi wenkqubo yefayile uguqula kuphela izakhiwo ezincinci zemetadata:

2. I-SSD TRIM (Discard / Deallocate) Ixesha Bomb¶

Kwi-hard drive ejikelezayo (HDD), amacandelo ahlala efundeka de abhalwe ngaphezulu. Kwi-SSD (SATA okanye NVMe), xa inkqubo yefayile ikhupha i TRIM okanye Deallocate umyalelo: - Uninzi lwabalawuli beNVMe baphumeza Deterministic Funda iZero emva kweTRIM (DRAT / DZAT), uyabuya 0x00000000 (bonke ooziro) ukusuka kuLuhlu lweNguqulelo oludanyazayo (FTL) kwangoko emva kokufumana TRIM, nangaphambi kokuba ingqokelela yenkunkuma ye-NAND iqhube. - Kutheni iinkqubo zeLinux zihlala ziphila TRIM: Unikezelo oluninzi lweLinux (Ubuntu, Debian, Fedora, RHEL) musa ukwenza ixesha lokunyuka eliqhubekayo discard ngokungagqibekanga; basebenza isibali-xesha ngeveki (fstrim.timer). Ukuba uphinda ukhwele funda-kuphela (ro) ** ngaphambili fstrim.timer iyasebenza**, i-SSD ayikayifumani ezobhloko.

Inqanaba loku-1: Ukuhlangula iifayile ezicinyiweyo ezisagcinwe zivuliwe yinkqubo esebenzayo (/proc/<pid>/fd/)¶

Ngaphambi kokuba uqalise kwakhona, uhlise, okanye uvale ifestile enye kwi-Linux okanye i-macOS, ** khangela izichazi zefayile ezivulekileyo **. Kwiinkqubo zePOSIX, rm iminxeba unlink(). I-kernel ilandelela izinto zokubala ezimbini kwi-inode nganye: 1. i_nlink: Ungeniso olukwi-disk olukhomba kwi-inode. 2. i_count: Iinkqubo ezisebenzayo ezibambe i-inode evulekile kwinkumbulo.

Umgaqo wegolide wePOSIX: Ikernel ayinakukhulula i-inode okanye ihlukanise iibhloko zediski kude kube ZOMBINI i_nlink == 0 KUNYE i_count == 0. Ukuba i-database ecinyiweyo, i-log, ividiyo, okanye ifayile yekhowudi isavuliwe kuyo nayiphi na inkqubo, ** i-100 ipesenti yaloo fayile ihlala injalo kwidiski **.

Inyathelo ngenyathelo /proc/<pid>/fd/ ukukhutshwa kwiLinux¶

1. **Fumana zonke iifayile ezicinyiweyo ezisagcinwe zivuliwe ngayo nayiphi na inkqubo **:

   sudo lsof +L1
   

   (Okanye hluza ngegama lefayile: sudo lsof | grep -i "(deleted)" | grep -i "filename")
2. Funda i lsof imiqolo yemveliso:

   COMMAND    PID     USER   FD   TYPE DEVICE  SIZE/OFF   NLINK    NODE NAME
   postgres  4182 postgres   14u   REG  259,2 524288000       0 1839204 /var/lib/postgresql/16/main/base/16384/16399 (deleted)
   

   Qaphela i PID (4182) kwaye ukhulule unobumba olandelayo (u, r, w) ukusuka FD (14u -> 14).
3. ** Khuphela ifayile ekrwada ngaphandle /proc/<pid>/fd/<fd_num> kwi-RAM (/dev/shm) okanye uqhubo lwangaphandle**: Ungaze ubhale ifayile ehlangulweyo emva kwisahlulelo esichaphazelekayo. Bhalela ku /dev/shm (idiski ye-RAM) okanye idrayivu ye-USB yangaphandle:

   mkdir -p /dev/shm/rescued_files
   sudo cp /proc/4182/fd/14 /dev/shm/rescued_files/16399_recovered
   

4. ** Khulula iifayile ezininzi ezicinyiweyo kwisiseko sedatha okanye isikhongozeli (PID=4182) kwilophu enye**:

   sudo mkdir -p /dev/shm/rescued_db
   for fd in /proc/4182/fd/*; do
     target=$(sudo readlink "$fd")
     if echo "$target" | grep -q "(deleted)"; then
       fd_num=$(basename "$fd")
       clean_name=$(echo "$target" | sed 's/ (deleted)//; s/\//_/g')
       sudo cp "$fd" "/dev/shm/rescued_db/fd_${fd_num}${clean_name}"
     fi
   done
   

5. Izithinteli zokuhlangula kunye neMbali yeNgingqi ye-IDE (vim, VS Code, Cursor, JetBrains):
6. Sukuvala iithebhu zomhleli ezivulekileyo: Gcina izithinteli ezivulekileyo ngokuthe ngqo /dev/shm okanye ubhontsi wokuqhuba.
7. ** IKhowudi ye-VS / Isalathisi / iMbali yeNdawo ye-VSCodium **: Igcina iikopi ezizenzekelayo ezinesitampu sazo zonke iifayile ezigciniweyo ngaphakathi -/.config/Code/User/History/ (Linux), -/Library/Application Support/Code/User/History/ (macOS), okanye %APPDATA%\Code\User\History\ (IWindows), ngaphandle ngokupheleleyo kwifolda yeprojekthi yakho. Nasemva koko rm -rf -/my-project okanye git clean -fdx, iifayile zakho zekhowudi zihlala zilungile ngaphakathi User/History/ kunye ne entries.json bonakalisa imephu yefayile nganye emva kwindlela yayo yoqobo.
8. JetBrains IDEs (IntelliJ, PyCharm, WebStorm): Igcina imbali ezenzekelayo ngaphakathi -/.cache/JetBrains/<IDE>/LocalHistory/.
9. Git (git reset --hard okanye git branch -D nge .git/ iphelele): Baleka git reflog okanye git fsck --lost-found ngokukhawuleza ukubuyisela ama-blobs ajingayo ngaphakathi .git/objects/.

Inqanaba lesi-2: Ukufriza inkqubo yefayile Funda-Kuphela (ro) ngaphandle kokubhala ngaphezulu iibhloko ezingabiwanga¶

Nje ukuba ukhuphe naziphi na izichazi zefayile ezivulekileyo ukusuka /proc (okanye ingqinisiswe akukho nanye), into ephambili yakho kwangoko kukumisa inkqubo yokusebenza ekubhaleni icandelo elinye elongezelelweyo kwisahlulelo.

1. Linux: Ukunyuswa kwakhona kweSahlulo seDatha vs. Root (/) Ukwahlula ukufunda-kuphela¶

• Imeko A: Iifayile ezicinyiweyo bezikwicandelo elahlukileyo (/home, /var, /data, /mnt/storage):
• Zama ngoko nangoko ucoceko lokufunda-kuphela kwakhona:

  sudo mount -o remount,ro /home
  

• Ukuba mount utsho mount point is busy, chonga kwaye umise iinkqubo zokubhala (sudo fuser -vm /home ilandelwa ngu sudo fuser -km -TERM /home), emva koko uqalise kwakhona ngokukhawuleza sudo mount -o remount,ro /home.
• Imeko B: Iifayile ezicinyiweyo bezikwi Root (/) ulwahlulo (okanye awukwazi ukubulala iinkqubo ezixakekileyo): Musa ukubaleka sudo reboot okanye sudo shutdown -h now, kuba eqhelekileyo systemd ukuvala bhala iimegabytes ze journald zikhuni zokuvala, imbewu random, kunye neefayile karhulumente inkonzo ngqo kwi /. Endaweni yoko, qala i- Linux Kernel Magic SysRq Emergency Read-Only Remount:

  echo 1 | sudo tee /proc/sys/kernel/sysrq
  echo s | sudo tee /proc/sysrq-trigger
  echo u | sudo tee /proc/sysrq-trigger
  

• s (Emergency Sync): Ugutyulo olusalindileyo kwindlela yefayile yemetadata ukuze ibhloko enkulu ihambelane.
• u (Emergency Remount Read-Only): Inyusa ngenkani yonke indlela yefayile enyusiweyo kumatshini njenge Funda-Kuphela (ro) ngaphakathi kwekernel, nokuba iinkqubo ziseneefayile ezivulekele ukubhalwa. Qinisekisa ukuba / ngoku ifundwa kuphela nge grep " / " /proc/mounts.

2. Ukwenza umfanekiso we-Remote Cloud Server (AWS EC2, GCP, DigitalOcean, Hetzner) ngaphezulu kweSSH¶

Ukuba ubaleke ngempazamo rm -rf kwiseva yelifu ekude apho ungenako ukuplaga kwi-USB drive: 1. Qalisa i-Magic SysRq yokufunda-kuphela kwakhona (echo s > /proc/sysrq-trigger && echo u > /proc/sysrq-trigger). Iseshoni yakho ekhoyo ye-SSH ihlala iphila kuba i-SSH isebenza kwi-RAM kwaye /dev/pts (devpts) yiRAM yenyani yendlela yefayile yepseudo-terminal. 2. Kumaqonga elifu (AWS EC2, GCP, Azure, DigitalOcean), ngoko nangoko thatha i-atomic EBS / Block Volume Snapshot ukusuka kwikhonsoli yelifu, okanye umise umzekelo, ukhuphe ivolumu yengcambu, kwaye uyincamathisele kukufunda kuphela (/dev/xvdf) kuhlangulo olucocekileyo lwe-VM. 3. Kwiseva ekude yentsimbi engenanto, sasaza umfanekiso okrwada ocinezelweyo wesahlulelo sokufunda kuphela esinomkhenkce ngokuthe ngqo kwi-SSH kwindawo yakho yokusebenza:

ssh root@remote-server-ip "dd if=/dev/nvme0n1p2 bs=4M status=progress | zstd -1" > ~/rescued_partition.img.zst

Inqanaba lesi-3: Kujongwa iKopi-on-Bhala efihliweyo (CoW) ii-snapshots kunye neekopi zeShadow phambi kokukrola¶

Phambi kokuskena iiterabytes zamacandelo angabiwanga, jonga ukuba isixokelelwano sakho esisebenzayo sizenzele ngokuzenzekelayo isifinyezo sendawo efihliweyo ngexesha:

1. macOS: Umatshini weXesha laseKhaya APFS Snapshots (tmutil)¶

Nokuba idrayivu yakho yangaphandle yoMatshini weXesha ikhutshiwe kwiiveki, iMacOS irekhoda ngokuzenzekelayo ** ngeyure iAPFS yasekhaya Khuphela-uBhala izifinyezo ** kwi-SSD yakho yangaphakathi (com.apple.TimeMachine.YYYY-MM-DD-HHMMSS.local) nanini na uMatshini weXesha uqwalaselwe okanye ngaphambi kohlaziyo lwe-macOS: 1. Dwelisa zonke izifinyezo zasekhaya kwiSitena:

tmutil listlocalsnapshots /
tmutil listlocalsnapshots /System/Volumes/Data

mkdir -p /tmp/apfs_rescue
sudo mount_apfs -o ro -s com.apple.TimeMachine.2026-10-31-140000.local /System/Volumes/Data /tmp/apfs_rescue
ls -la /tmp/apfs_rescue/Users/yourname/

2. Windows 10 / 11 / Iseva: Iikopi zesithunzi seVolume (VSS)¶

1. Vula i-Umyalelo we-Administrator Prompt kwaye uqhube:

   vssadmin list shadows
   

2. Ukuba ikopi yesithunzi (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1) iphambi kwakho Shift+Delete, yidibanise nefolda kwaye ukhuphele iifayile zakho kwi-USB drive:

   mklink /d C:\ShadowRescue \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
   

3. Linux: Btrfs, ZFS, kwaye LVM Izifinyezo¶

• Vula Btrfs (Fedora, openSUSE, Synology, Timeshift/Snapper systems): Qhuba sudo btrfs subvolume list -s / kwaye uhlole /.snapshots/ okanye /run/timeshift/backup/timeshift-btrfs/snapshots/.
• Vula ZFS (Ubuntu ZFS, Proxmox, TrueNAS): Qhuba zfs list -t snapshot kwaye ukhuphele iifayile ngqo ukusuka /path/to/dataset/.zfs/snapshot/.

Isigaba 4: Inyathelo ngenyathelo Inode, Journal, kunye neMFT yoBuyiselo ngeFayilesystem¶

Ukuba akukho nkcazelo yefayile evuliweyo (/proc/<pid>/fd/) kwaye akukho snapshot sele sikhona, ukuqala kwi SystemRescue okanye Ubuntu Live USB, ncamathela i-USB hard drive yangaphandle (/mnt/external), kwaye wenze ikloni yesuntswana-ye-bit yesahlulelo sexhoba esinganyuswanga (/dev/nvme0n1p2) kuqala:

sudo ddrescue -f -n /dev/nvme0n1p2 /mnt/external/victim_partition.img /mnt/external/ddrescue.log

1. Ukuchacha kwi ext4 / ext3 kwi Linux (ext4magic kwaye extundelete)¶

Nini rm -rf icima iifayile kwi ext4, i-kernel ikhupha umgama wezalathisi zomthi ngaphakathi kwetafile ye-inode engundoqo. Nangona kunjalo, ext4's jbd2 ijenali (idla ngokuba yi-128 megabytes ukuya kwi-1,024 megabytes ngobukhulu) igcina iikopi zembali zeebhloko ze-inode ezisanda kulungiswa. Okoko unyukile kwakhona ro ngaphambi kokuba umsebenzi wediski onzima usonge ijenali yeringi buffer, ext4magic ikhupha i-inode yokucinywa kwangaphambili kwijenali kwaye iphinda iphinde yakhe iifayile zakho ngamagama oqobo efayile kunye nemithi yolawulo ingaguquki.

1. Baleka ext4magic ukubuyisela zonke iifayile ezicinyiweyo kwiiyure ezi-2 zokugqibela (-a) ngaphakathi kwendlela ezalanayo (-f): (Shiya i-slash ekhokelayo yendawo yentaba phakathi -f: ze /home/kmyers/project kwingcambu / isahlulo, dlula -f home/kmyers/project; ukuba /home kukwahlulahlula kwayo, kudlule -f kmyers/project)

   mkdir -p /mnt/external/recovered_ext4
   sudo ext4magic /mnt/external/victim_partition.img \
     -a $(date -d "2 hours ago" +%s) \
     -f home/kmyers/project \
     -R -d /mnt/external/recovered_ext4
   

2. Enye indlela: Baleka extundelete ngokuchasene nomfanekiso:

   cd /mnt/external
   sudo extundelete /mnt/external/victim_partition.img --restore-directory home/kmyers/project
   

2. Ukufumana kwakhona kwiWindows NTFS emva Shift+Delete (TestDisk kwaye ntfsundelete)¶

Ngokungafaniyo ext4, IiWindows NTFS AYIziro ngaphandle izikhombisi zobungakanani bebhloko (Data Runs) ngaphakathi kweTheyibhile yeFayile eyiNtloko ($MFT) rekhoda xa ifayile icinyiwe. Xa ucofa Shift+Delete kwi-NTFS, i-1,024-byte $MFT ungeno lujikelezisa iflegi yeheader ukusuka 0x01 (Ekusetyenzisweni) ukuya 0x00 (Icinyiwe). Yalo $FILE_NAME uphawu kunye $DATA uluhlu lokubaleka lweqela luhlala lukwipesenti ezili-100 lugqibelele de enye ifayile iphinde isebenzise loo nto $MFT indawo yokubeka:

1. ** Ukusebenzisa TestDisk ye-NTFS yangoko nangoko $MFT ukurhoxisa ngeendlela ezigcweleyo zesiqulathi seefayili**:

   sudo testdisk /mnt/external/victim_partition.img
   

   Khetha [ Proceed ] -> [ EFI GPT ] -> [ Advanced ] -> qaqambisa isahlulelo se-NTFS -> [ Undelete ]. Layisha kwifolda yakho, cofa a ukukhetha iifayile ezicinyiweyo, kwaye ucinezele C (inkunzi C) ukuzikhuphela ku /mnt/external/recovered_ntfs/.
2. ** Ukusebenzisa ntfsundelete (ntfs-3g)**:

   sudo ntfsundelete /mnt/external/victim_partition.img -t 2d
   sudo ntfsundelete /mnt/external/victim_partition.img -u -m "*" -d /mnt/external/recovered_ntfs
   

3. Ukuchacha kwi XFS, APFS, okanye iiJenali eziBhalwe ngaphezulu nge-Raw Block Carving (PhotoRec kwaye grep -a -b)¶

Xa izikhombisi ze-inode zimkile (ezinje nge XFS, APFS, okanye i ext4 isahlulo esisongiwe ijenali), buyisela idatha ngokuskena iibhloko ezingabiwanga eziyi-4,096-byte (4 kilobyte) ukwenzela iiheader/footers zefayile okanye iintambo zombhalo ezizodwa:

Indlela yokusebenzisa grep -a -b + dd ukuhlangula ikhowudi yemvelaphi ecinyiweyo okanye .env iifayile ngaphantsi kwemizuzu emi-2¶

Ukuba ucime ikhowudi yomthombo, .env iimfihlo, okanye amanqaku angaphantsi kwe-32 kilobytes ngobukhulu: 1. Khangela i umtya owahlukileyo ngaphakathi kwefayile ecinyiweyo kwaye uprinte kanye byte offset (-b):

LC_ALL=C grep -a -b -o "def calculate_invoice_tax" /mnt/external/victim_partition.img

dd if=/mnt/external/victim_partition.img bs=4096 skip=11789795 count=30 status=none > /mnt/external/rescued_code_block.txt

Inqanaba lesi-5: Ukuthintela intlekele yexesha elizayo rm -rf kwaye Shift+Delete iingozi¶

• ** Faka endaweni yokunxibelelana rm nge trash-cli kwaye rm -I --preserve-root=all**: Faka trash-cli (trash-put, trash-list, trash-restore) kunye nesiteketiso rm ukuya rm -I --preserve-root=all kwi /etc/bash.bashrc kwaye -/.zshrc ngoko ke ukucinywa okuphindaphindiweyo ngempazamo kukhawuleza kube kanye ngaphambi kokuba kuqhawuke i-inodes.
• Khusela abalawuli ababalulekileyo bemveliso ngeLinux Uphawu Olungenakuguquleka (chattr +i): Nditsho root (sudo rm -rf) ayikwazi ukucima okanye ukuguqula ulawulo okanye ifayile ephawulweyo sudo chattr +i /path/to/critical_config ade abaleke umlawuli sudo chattr -i.
• Yenza iKopi-on-Bhala yasekuhlaleni ngokuzenzekela (CoW) Izifinyezo (Btrfs / ZFS / APFS / Windows Shadow Copies): Sebenzisa Snapper okanye Timeshift kwi Btrfs, sanoid kwi ZFS, okanye kabini-imihla ngemihla iikopi zesithunzi soMqulu kwiWindows (SystemPropertiesProtection.exe).
• **Gcina i-Automated 3-2-1 Backups kunye noGcino oluNgaguqukiyo lwangaphandle **: Landela isikhokelo sethu ukuze i-computer backups, isicwangciso se-3-2-1, kunye nokubuyisela intlekele usebenzisa restic okanye borgbackup ngoovimba be-append-kuphela ekude.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Ngelixa ukucinywa kwefayile ngempazamo kwikhompyuter yakho kuyimeko yongxamiseko yobugcisa kunokuba ibe ngumba wamapolisa, ucimo ngengozi okanye olukhohlakeleyo oluchaphazela iinkqubo zokhathalelo lwempilo, iziseko zophuhliso zikamasipala, ubungqina obusemthethweni phantsi komyalelo wokugcinwa kwenkundla, okanye idatha yobuqu elawulwayo inokuxhokonxa ingxelo yesiganeko esisinyanzelo:

• I-United States neKhanada:
• UKhuseleko kuBomi obuNgxamisekileyo / uKucinywa kweZibonelelo eziBalulekileyo: Cofa 911 ukuba inkqubo yosula ichaphazela ukhathalelo lwesigulane esibhedlele, ukuthunyelwa kongxamiseko, okanye ulawulo lokhuseleko lwemizi-mveliso.
• I-Arhente yoKhuseleko lwe-cybersecurity kunye ne-Infrastructure Security Agency (CISA) (US): Xela ukutshatyalaliswa kwesiseko sesiseko esibalulekileyo okanye ukonakaliswa kwangaphakathi okukrokrelekayo e 1-844-Say-CISA (1-844-729-2472) okanye cisa.gov/report.
• Iziko laseKhanada loKhuseleko lweCyber: Qhagamshelana 1-833-CYBER-88 (1-833-292-3788) kwiziganeko ezibalulekileyo zeziseko ezingundoqo.
• United Kingdom:
• Iinkonzo zikaNgxamiseko: Cofa 999 (okanye 101 ngokunika ingxelo yamapolisa angeyongozi ukuba ucimo lubandakanye ukusetyenziswa gwenxa kwekhompyutha okungagunyaziswanga phantsi koMthetho obizwa ngokuba yiComputer Miuse Act 1990*).
• I-Ofisi yoMkomishinala woLwazi (ICO): Ukuba ukucinywa ngengozi kutshabalalisa ngokusisigxina idatha yobuqu ngaphandle kokubuyiselwa kogcino (olubandakanya i-Availability Breach phantsi kwe-UK GDPR), hlola ukuba ngaba isaziso kwi ICO (0303 123 1113) kwiiyure ezingama-72 ziyafuneka.
• IManyano yaseYurophu:
• Iinkonzo zikaNgxamiseko: Cofa 112 kuwo onke amazwe angamalungu e-EU.
• **Inqaku le-GDPR Inqaku le-33 lokufumaneka kweNgxelo yoLwaphulo-mthetho **: Ngaphantsi kweBhodi yoKhuseleko lweDatha yaseYurophu (EDPB) izikhokelo, ukutshatyalaliswa ngokusisigxina ngengozi kwedatha yomntu ngaphandle kokugcinwa kokugcinwa kwakhona kuhlelwe njenge-ukwaphulwa kwedatha yobuqu (ilahleko yokufumaneka) kwaye inokufuna ukunika ingxelo kuGunyaziwe woKhuseleko lweDatha kazwelonke (DPA) kwiiyure ezingama-72.
• I-Australia neNew Zealand:
• Iinkonzo zikaNgxamiseko: Cofa 000 eOstreliya okanye 111 eNew Zealand.
• Iziko loKhuseleko lweCyber yaseAustralia (ACSC): Fowuna 1300 CYBER1 (1300 292 371) kushishino okanye uncedo lweziseko ezingundoqo.
• Indiya kunye neAsia-Pacific:
• Indiya (CERT-In / Umnxeba weSizwe woNcedo kuLwaphulo-mthetho lwe-Cyber): Cofa 112 impendulo kaxakeka okanye 1930 kwiziganeko zolwaphulo-mthetho kwikhompyutha; Iziganeko zamashishini eziphantsi kwegunya le-CERT-In kufuneka zixelwe zingadlulanga iiyure ezi-6 ukuya incident@cert-in.org.in.

Imibuzo ebuzwa qho¶

Kutheni engazange extundelete okanye ext4magic fumana amagama wam efayile kwi ext4 nangona ndiyekile ukusebenzisa ikhompyuter ngokukhawuleza?¶

Xa ifayile icinyiwe Ext4, i-Linux kernel ngokukhawuleza ikhupha umgama wezalathisi zomthi ngaphakathi kwetafile ye-inode yediski ukuze inkqubo yefayile iyazi ukuba i-inode ayinamlinganiselo owabelweyo. Izixhobo ezifana ext4magic kwaye extundelete thembela ekufumaneni ikopi endala, yokucinywa kwangaphambili kwaloo inode ngaphakathi Ext4 ijenali (jbd2). Ukuba ifayile yenziwe yaza yacinywa ngaphandle kwe-inode yayo kutshanje idlula kwijenali, okanye ukuba imvelaphi enzima ibhala isongelwe i-128 MB ukuya kwi-1 GB yejenali yeringi yesithinteli phambi kokuba uphinde unyuswe ngokufunda-kuphela, ikopi yejenali ayisekho. Kwimeko apho, kufuneka utshintshele kwibhloko ekrwada yokukrola utyikityo (IfotoRec) okanye uphendlo lwebhayithi yombhalo ongenanto (grep -a -b), esiskena iibhloko zedatha ezingabiwanga ngokuthe ngqo ngaphandle kokufuna imetadata ye-inode.

Ngaba i-SSD TRIM soloko utshabalalisa rm -rf okanye Shift+Delete iifayile ngokukhawuleza?¶

Akusoloko, ngakumbi kwiLinux nakwiidrive zangaphandle. On Windows 10/11 kunye ne-macOS ene-NVMe SSD yangaphakathi, inkqubo yokusebenza ihlala ithumela i-inline. QAPHELA / Ukwaba umyalelo kumlawuli we-SSD ngaphakathi kwemizuzwana yocimo olusisigxina, olubangela i-SSD's Flash Translation Layer (FTL) ukubuyisela ooziro (I-DZAT) kwezobhloko. Nangona kunjalo, uninzi losasazo lweLinux (Ubuntu, Debian, Fedora, RHEL) lwenza hayi vula ixesha lokunyuka eliqhubekayo lahla ngokungagqibekanga; endaweni yoko, bayabaleka fstrim.timer kanye ngeveki. Ngaphaya koko, uninzi lwe-USB-to-SATA kunye ne-USB-to-NVMe ezivaliweyo zangaphandle azidluli. QAPHELA imiyalelo phezu USB Mass Storage (BOT), kunye nesoftware RAID / LVM / LUKS umaleko uhlala ebhloka lahla ukugqitha ngokungagqibekanga ngaphandle kokuba iqwalaselwe ngokucacileyo (`issue_discards = 1` okanye `allow-discards`).

Kuthekani ukuba isahlulelo sam seLinux sifihliwe nge LUKS (dm-crypt) okanye usetyenziso lwam lweWindows drive BitLocker: ndisakwazi ukukrola iifayile ezicinyiweyo?¶

Ewe, ukuba unegama lokugqithisa loguqulelo oluntsonkothileyo okanye iqhosha lokubuyisela kwaye uvule isikhongozeli ngendlela yokufunda kuphela. Ungaze ubaleke photorec, ext4magic, okanye testdisk ngokuchasene nesahlulelo somzimba esifihliweyo (/dev/nvme0n1p2), kuba umbhalo ofihliweyo ujongeka njengengxolo engakhethiyo. Endaweni yoko, qala kwi-USB ephilayo, vula isikhongozeli ngaphakathi imowudi yokufunda kuphela (ye-LUKS: I-sudo cryptsetup ivuliwe --readonly /dev/nvme0n1p2 crypt_rescue; yeBitLocker kwiLinux: isitshixo -r okanye uvule ukufunda-kuphela kwiWinPE), kunye nomfanekiso okanye uskene isixhobo semaphu esifihliweyo (/dev/mapper/crypt_rescue).

Kutheni utsala intambo yamandla kwiWindows C:\ ikhuselekile emva kwengozi Shift+Delete kunokucofa "Cima"?¶

Xa ucofa Qala > Cima kwi-Windows, inkqubo yokusebenza yenza amakhulu eemegabytes zediski ebhalayo phambi kokucima: igungxula imiqolo yobhaliso, ibhala imisitho yokuvala .evtx iilog, ihlaziya i-USN Journal ($UsnJrnl), icoca okanye yenza ubungakanani kwakhona pagefile.sys, kwaye kwiinkqubo zokuQalisa ngokukhawuleza bhala ifayile yokufihla iigigabhayithi ezininzi (hiberfil.sys) ngokuthe ngqo kumaqela angabiwanga e-NTFS. Ezo zicinyiweyo zibhala rhoqo ukubhala ngaphezulu kweyona nto ingabiwanga $MFT iirekhodi kunye namaqela data akhululwe yakho Shift+Cima. Ukunyanzelisa ukucima umbane ngoko nangoko (ukubamba iqhosha lamandla kwimizuzwana ye-10 okanye ukutsala iplagi) kumisa yonke into ebhala ngokukhawuleza; I-NTFS iya kuhlala ifundeka ngokupheleleyo xa iqalwe kwi-Linux yokufunda kuphela okanye i-WinPE yokuhlangula i-USB.

Ndingayifumana njani kwakhona into ecinyiweyo .env ifayile, iqhosha le-SSH, okanye ifayile yekhowudi yemvelaphi leyo PhotoRec ingahoywa?¶

IfotoRec ijonga iiheader zebhayiyithi zomlingo (njenge %PDF, I-PNG, okanye PK yeefayile zeZIP/Ofisi), ngoko ihlala itsiba okanye igaqa kunye iifayile ezimfutshane ezingenanto-okubhaliweyo njenge .env uqwalaselo, ikhowudi yomthombo wePython/JavaScript, amanqaku eMarkdown, kunye nezitshixo zeSSH. Ukufumana kwakhona nayiphi na ifayile-okubhaliweyo okungenanto kumfanekiso wedisk okanye ulwahlulo lokufunda kuphela, sebenzisa LC_ALL=C grep -a -b -C 100 "UNIQUE_TEXT_FROM_FILE" /dev/nvme0n1p2 > /dev/shm/found.txt. Ukuba uyazi naliphi na igama eliguquguqukayo (elifana ne STRIPE_SECRET_KEY= okanye QALISA UVULA ISIQINISO SABUNCA), grep -a -b iskena amacandelo ekrwada kwiigigabytes ezininzi ngomzuzwana kwaye iprinte iibhloko zedisk ezizingqongileyo ngqo.

Ukuba ndibaleke ngempazamo rm -rf / okanye icinyiwe /usr okanye /lib kwiLinux kwaye ngoku akunjalo ls, cp, okanye sudo isebenza, ndiyiqhuba njani imiyalelo kwitheminali yam evulekileyo?¶

Ukuba wosule /umgqomo okanye /lib ngelixa ekhoyo bash okanye zsh i-terminal isavuliwe kwi-RAM, iibhinari zangaphandle ezifana /bin/ls okanye /bin/cp uya kusilela nge Akukho fayile okanye uvimba weefayili, kodwa i-shell eyakhelwe-ngaphakathi isasebenza ngokupheleleyo ngaphakathi kwe-RAM. Ungasebenzisa i-echo * endaweni ye ls, printf "%s\n" "$( /dev/shm/rescued endaweni ye cp, kwaye echo u > /proc/sysrq-trigger (ukuba iqokobhe lakho sele liyingcambu) ukuqala kwakhona i-kernel efundwayo kuphela ngaphambi kokucima kunye nokuqalela iSystemRescue Live USB.

Izikhokelo ezinxulumeneyo¶

• Ucimo lwefayile ngengozi, idrayivu efomathiweyo, kunye nokubuyisela ifoto
• I-SSD kunye ne-NVMe imowudi yokufunda kuphela ngequbuliso, i-0% yeebhloko ezisecaleni, kunye ne-TRIM ekhubazayo yokuhlangula.
• Ukungaphumeleli kwe-hard drive kunye nokubuyisela idatha
• Uluhlu lwe-NAS RAID luthotyiwe, ukungaphumeleli kwe-drive ezininzi, kunye ne-ZFS/Btrfs recovery
• Ukugcinwa kwekhompyuter, isicwangciso se-3-2-1, kunye nokubuyisela intlekele
• Amanani kaxakeka ngokwelizwe

Imithombo kunye nezikhokelo ezisemthethweni¶

• Iziko leSizwe leMigangatho kunye neTekhnoloji (NIST) (eUnited States): Ushicilelo oluKhethekileyo lwe-800-86: Isikhokelo sokuHlanganisa ubuChwephesha beForensic kwiMpendulo yezehlo kunye ne-SP 800-88 Rev. 1: Izikhokelo zeMedia Sanitization (ATA TRIM / NVMe Deallocate Behavior).
• Umbutho weLinux Kernel (kernel.org): Uxwebhu lweNkqubo yeFayile ye-Ext4 (Isithintelo kunye noLwabiwo lwe-Inode, jbd2 Ukubhalwa kweendaba, kunye procfs /proc/<pid>/fd/ ISemantics yesichazi seFayile) kunye neSitshixo seSicelo seNkqubo yomlingo yeLinux (sysrq.txt).
• CGSecurity (TestDisk & PhotoRec Amaxwebhu asemthethweni) kunye ext4magic Umqulu weReferensi oPhezulu: IJournal Inode Extraction kunye neNgcaciso engaBelwanga kwi-ext3/ext4 kunye ne-NTFS Volumes.
• I-Arhente yoKhuseleko lwe-Cybersecurity kunye ne-Infrastructure Security Agency (CISA) (eUnited States): Iimpendulo zezehlo kunye ne-Forensic Volatile/Non-Volatile Ubungqina bokuGcinwa kweZenzo eziGqwesileyo.
• I-Arhente yeManyano yaseYurophu yoKhuseleko kwiCybersecurity (ENISA): *IsiKhokelo esiLungileyo sokuSebenza kwi-Digital Forensics kunye nokuGcinwa kweMedia yokuGcina *.