<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <HTML> <HEAD> <META NAME="GENERATOR" CONTENT="SGML-Tools 1.0.9"> <TITLE>Linux Ext2fs Undeletion mini-HOWTO: Unmounting the file system</TITLE> <LINK HREF="Ext2fs-Undeletion-6.html" REL=next> <LINK HREF="Ext2fs-Undeletion-4.html" REL=previous> <LINK HREF="Ext2fs-Undeletion.html#toc5" REL=contents> </HEAD> <BODY> <A HREF="Ext2fs-Undeletion-6.html">Next</A> <A HREF="Ext2fs-Undeletion-4.html">Previous</A> <A HREF="Ext2fs-Undeletion.html#toc5">Contents</A> <HR> <H2><A NAME="sec-umount"></A> <A NAME="s5">5. Unmounting the file system</A></H2> <P>Regardless of which method you choose, the first step is to unmount the file system containing the deleted files. I strongly discourage any urges you may have to mess around on a mounted file system. This step should be performed <EM>as soon as possible</EM> after you realise that the files have been deleted; the sooner you can unmount, the smaller the chance that your data will be overwritten. <P>The simplest method is as follows: assuming the deleted files were in the <CODE>/usr</CODE> file system, say: <P> <BLOCKQUOTE><CODE> <PRE> # umount /usr </PRE> </CODE></BLOCKQUOTE> <P>You may, however, want to keep some things in <CODE>/usr</CODE> available. So remount it read-only: <P> <BLOCKQUOTE><CODE> <PRE> # mount -o ro,remount /usr </PRE> </CODE></BLOCKQUOTE> <P>If the deleted files were on the root partition, you'll need to add a <CODE>-n</CODE> option to prevent mount from trying to write to <CODE>/etc/mtab</CODE>: <P> <BLOCKQUOTE><CODE> <PRE> # mount -n -o ro,remount / </PRE> </CODE></BLOCKQUOTE> <P>Regardless of all this, it is possible that there will be another process using that file system (which will cause the unmount to fail with an error such as `Resource busy'). There is a program which will send a signal to any process using a given file or mount point: <CODE>fuser</CODE>. Try this for the <CODE>/usr</CODE> partition: <P> <BLOCKQUOTE><CODE> <PRE> # fuser -v -m /usr </PRE> </CODE></BLOCKQUOTE> <P>This lists the processes involved. Assuming none of them are vital, you can say <P> <BLOCKQUOTE><CODE> <PRE> # fuser -k -v -m /usr </PRE> </CODE></BLOCKQUOTE> <P>to send each process a <CODE>SIGKILL</CODE> (which is guaranteed to kill it), or for example, <P> <BLOCKQUOTE><CODE> <PRE> # fuser -k -TERM -v -m /usr </PRE> </CODE></BLOCKQUOTE> <P>to give each one a <CODE>SIGTERM</CODE> (which will normally make the process exit cleanly). <P> <P> <HR> <A HREF="Ext2fs-Undeletion-6.html">Next</A> <A HREF="Ext2fs-Undeletion-4.html">Previous</A> <A HREF="Ext2fs-Undeletion.html#toc5">Contents</A> </BODY> </HTML>