跳至內容
出自 Arch Linux 中文维基

這篇文章列舉了一系列在 Linux 下恢復數據的方法。

特別提示

三思而後行

這篇文章的某些內容需要擴充。

原因:適用於在正常硬碟上不小心刪掉文件的情況,不適用於已經出現故障的硬碟。 (在 Talk:文件恢復 中討論)

本文主要用於教學目的。如果你意外地刪除或損壞了有價值且不可替代的數據,並且毫無數據恢復的經驗的話,請立刻關閉你的電腦(只要長按電源鍵或直接拔插頭即可,不要使用系統的關機功能),然後尋求專業人員的幫助。

警告:如果在沒有完全理解下文內容的情況下就進行任何操作,很有可能會導致情況惡化。

故障的磁碟

在數據恢復的領域裡,操作一個磁碟的鏡像會比直接操作物理磁碟會更好些。總體上來說,一個壞掉的硬碟的情況會隨著時間惡化。我們的目標應當是首先儘快地搶救出儘可能多的數據,並且拋棄故障的磁碟。ddrescuedd_rescue 工具與 dd 不同,它們會反覆嘗試從錯誤中恢復,並且從硬碟往返讀取以搶救出數據。它們會保留日誌文件,所以恢復過程中的暫停並不會損失進度。

參閱硬碟克隆

由類如 ddrescue 這樣的工具創建的鏡像文件可以像物理設備一樣被掛載,並且安全地對其進行操作。請務必做好原始鏡像的備份以便在恢復工作黃掉的時候重新做人。

本文或本章節的事實準確性存在爭議。

原因: 雖然這是數據恢復公司博文中提出的內容,但過去 10 年中已有人對降溫技巧提出反對。該段落自 2009 年起就基本未作修改,可能不適用於現代硬碟。(在 Talk:文件恢復 中討論)


改善故障硬碟讀取的一個久經考驗的方法是保持硬碟清涼。在冰箱裡放一會兒是個好主意,但不要讓硬碟升溫太快,因為這樣會產生冷凝水。如果能在進行恢復工作的時候把硬碟放在冰箱裡,並用線材連接電腦就再好不過了.

不要嘗試對故障硬碟進行文件系統檢查,這很可能會使情況變得更糟糕。請務必把它掛載為只讀。

備份快閃記憶體介質或者小分區

在出問題的文件系統不大或硬碟空間足夠的情況下,優先選擇在鏡像上進行操作,而不是在活躍分區上進行(與是否掛載無關)。類似 U 盤,相機,便攜播放器,手機等快閃記憶體介質的設備通常鏡像都足夠小。

請務必閱讀下列工具的 man 手冊,以確保這些工具能夠處理映像文件。

可以使用如下命令通過 dd 創建鏡像:

# dd if=/dev/target_partition of=/home/user/partition.image

恢復數位相機

為使下一節提到的工具能正常在快閃記憶體設備上工作,需要將設備掛載為塊設備(即出現在 /dev 下)。在圖片傳輸協議(Picture Transfer,PTP)模式下工作的數位相機不會以該形式出現,而是由 libgphoto 和/或 libptp 透明處理。在這種情況下,「透明」意味著 PTP 設備不會被獲取為塊設備。不是所有相機都支持作為 PTP 模式替代的 USB 大容量存儲設備(USB Mass Storage,UMS)模式。有些相機可以在菜單中切換這兩種模式,具體信息請參考相機的用戶手冊。如果你的相機不支持 UMS 模式,就無法被作為塊設備讀取,唯一解決方法是將介質從相機中取出,然後使用讀卡器連到電腦。

工具清單

See also Wikipedia:List of data recovery software#File Recovery

  • ddrutility — Compliment to GNU ddrescue. Find what files are related to the bad sectors and some special tools for NTFS. No longer actively supported.
https://sourceforge.net/projects/ddrutility/ || ddrutilityAUR
  • dvdisaster — Additional error protection for CD/DVD media.
https://sourceforge.net/projects/dvdisaster/ || dvdisasterAUR
  • Foremost — Console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. The headers and footers can be specified by a configuration file or command line switches can be used to specify built-in file types.
https://foremost.sourceforge.net/ || foremost
  • PhotoRec — File data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory.
https://www.cgsecurity.org/ || testdisk
  • R-Linux — A free file recovery utility for the Ext2/Ext3/Ext4 file systems.
https://www.r-studio.com/free-linux-recovery/ || r-linuxAUR
  • Scalpel — File carving and indexing application originally based on Foremost, although significantly more efficient. It allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media.
https://github.com/sleuthkit/scalpel || scalpel-gitAUR
  • TestDisk — Data recovery software primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).
https://www.cgsecurity.org/ || testdisk
  • xfs_undelete — Traverses the inode B+trees of each allocation group and tries to recover all files on an XFS filesystem marked as deleted.
https://github.com/ianka/xfs_undelete || xfs_undelete-gitAUR

TestDisk 和 PhotoRec

TestDisk and Photorec are both open-source data recovery utilities licensed under the terms of the GNU Public License (GPL).

TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error, such as the accidental deletion of partition tables. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS. It can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.

TestDisk allows to fix partition tables, recover deleted partitions, recover FAT32 boot sector from its backup, rebuild FAT12/FAT16/FAT32 boot sectors, fix FAT tables, rebuild NTFS boot sector and more.

PhotoRec is file recovery software designed to recover lost files including photographs (Hint: PhotographRecovery), videos, documents, archives from hard disks and CD-ROMs. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even with a re-formatted or severely damaged filesystems and/or partition tables.

安裝

Install the testdisk package, which provides both TestDisk and PhotoRec.

用法

After running e.g. ddrescue to create image.img, photorec image.img will open a terminal UI where you can select what file types to search for and where to put the recovered files. There is very good documentation on their wiki.

Files recovered by photorec

The photorec utility stores recovered files with a random names(for most of the files) under a numbered directories, e.g. ./recup_dir.1/f872690288.jpg, ./recup_dir.1/f864563104_wmclockmon-0.1.0.tar.gz.

參考

e2fsck

e2fsck is the ext2/ext3 filesystem checker included in the base install of Arch. e2fsck relies on a valid superblock. A superblock is a description of the entire filesystem's parameters. Because this data is so important, several copies of the superblock are distributed throughout the partition. With the -b option, e2fsck can take an alternate superblock argument; this is useful if the main, first superblock is damaged.

To determine where the superblocks are, run dumpe2fs -h on the target, unmounted partition. Superblocks are spaced differently depending on the filesystem's blocksize, which is set when the filesystem is created.

An alternate method to determine the locations of superblocks is to use the -n option with mke2fs. Be sure to use the -n flag, which, according to mke2fs(8), "Causes mke2fs to not actually create a filesystem, but display what it would do if it were to create a filesystem. This can be used to determine the location of the backup superblocks for a particular filesystem, so long as the mke2fs parameters that were passed when the filesystem was originally created are used again. (With the -n option added, of course!)".

安裝

Both e2fsck and dumpe2fs are included in the base Arch install as part of e2fsprogs.

See also e2fsck(8) and dumpe2fs(8).

Working with raw disk images

本文或本章節可能需要合併到QEMU

附註: 請提供模板的second參數以more detailed indications。(在 Talk:文件恢復 中討論)

If you have backed up a drive using ddrescue or dd and you need to mount this image as a physical drive, see this section.

Mount the entire disk

To mount a complete disk image to the next free loop device, use the losetup command:

# losetup -f -P /path/to/image
提示:
  • The -f flag mounts the image to the next available loop device.
  • The -P flag creates additional devices for every partition.

See also QEMU#With loop module autodetecting partitions.

掛載分區

In order to be able to mount a partition of a whole disk image, follow the steps above.

Once the whole disk image is mounted, a normal mount command can be used on the loop device:

# mount /dev/loop0p1 /mnt/example

This command mounts the first partition of the image in loop0 to the folder to the mountpoint /mnt/example. Remember that the mountpoint directory must exist!

Getting disk geometry

Once the entire disk image has been mounted as a loopback device, its drive layout can be inspected.

使用 QEMU 來修復 NTFS

由於 Linux 下沒有好的 NTFS 檢查工具,包含一個或多個 NTFS 分區的硬碟需要使用 Windows 進行 chkdsk。 QEMU 可以在虛擬機中將 raw 原始磁碟映像作為物理硬碟使用:

# qemu -hda /path/to/primary.img -hdb /path/to/DamagedDisk.img

然後, 假設 Windows 被安裝在 primary.img,它就可以用來檢查 /path/to/DamagedDisk.img 上的分區。

警告:Do not use lower version of Windows to check NTFS partitions create by higher version of it, e.g. Windows XP can do damage to NTFS partitions created by Windows 8 by "fixing" metadata configuration that it does not support, resulting in damage/removal of these unsupported entries.

文本文件恢復

在塊設備上有可能通過直接搜索找出被刪掉的純文本文件。你需要一段來自待恢復的文件中的比較獨一無二的字符串。

使用 grep 在分區上直接篩選固定字符串(-F):

$ grep -a -C 200 -F 'Unique string in text file' /dev/sdXN > OutputFile

如果運氣好的話,被刪除文件的內容會出現在 OutputFile 中,可直接從文本的上下文中提取。

注意:-C -200 選項告訴 grep 列印每個匹配字符串的前後 200 行。也可以使用 -A-B 參數,分別會輸出匹配字符串之後和之前的內容。如果你在尋找的文本很長,則需要視情況調整。

參閱