跳转到内容
来自 Arch Linux 中文维基

这篇文章列举了一系列在 Linux 下恢复数据的方法。

特别提示

三思而后行

这篇文章的某些内容需要扩充。

原因:适用于在正常硬盘上不小心删掉文件的情况,不适用于已经出现故障的硬盘。 (在 Talk:文件恢复 中讨论)

本文主要用于教学目的。如果你意外地删除或损坏了有价值且不可替代的数据,并且毫无数据恢复的经验的话,请立刻关闭你的电脑(只要长按电源键或直接拔插头即可,不要使用系统的关机功能),然后寻求专业人员的帮助。

警告:如果在没有完全理解下文内容的情况下就进行任何操作,很有可能会导致情况恶化。

故障的磁盘

在数据恢复的领域里,操作一个磁盘的镜像会比直接操作物理磁盘会更好些。总体上来说,一个坏掉的硬盘的情况会随着时间恶化。我们的目标应当是首先尽快地抢救出尽可能多的数据,并且抛弃故障的磁盘。ddrescuedd_rescue 工具与 dd 不同,它们会反复尝试从错误中恢复,并且从硬盘往返读取以抢救出数据。它们会保留日志文件,所以恢复过程中的暂停并不会损失进度。

参阅硬盘克隆

由类如 ddrescue 这样的工具创建的镜像文件可以像物理设备一样被挂载,并且安全地对其进行操作。请务必做好原始镜像的备份以便在恢复工作黄掉的时候重新做人。

本文或本章节的事实准确性存在争议。

原因: 虽然这是数据恢复公司博文中提出的内容,但过去 10 年中已有人对降温技巧提出反对。该段落自 2009 年起就基本未作修改,可能不适用于现代硬盘。(在 Talk:文件恢复 中讨论)


改善故障硬盘读取的一个久经考验的方法是保持硬盘清凉。在冰箱里放一会儿是个好主意,但不要让硬盘升温太快,因为这样会产生冷凝水。如果能在进行恢复工作的时候把硬盘放在冰箱里,并用线材连接电脑就再好不过了.

不要尝试对故障硬盘进行文件系统检查,这很可能会使情况变得更糟糕。请务必把它挂载为只读。

备份闪存介质或者小分区

在出问题的文件系统不大或硬盘空间足够的情况下,优先选择在镜像上进行操作,而不是在活跃分区上进行(与是否挂载无关)。类似 U 盘,相机,便携播放器,手机等闪存介质的设备通常镜像都足够小。

请务必阅读下列工具的 man 手册,以确保这些工具能够处理映像文件。

可以使用如下命令通过 dd 创建镜像:

# dd if=/dev/target_partition of=/home/user/partition.image

恢复数码相机

为使下一节提到的工具能正常在闪存设备上工作,需要将设备挂载为块设备(即出现在 /dev 下)。在图片传输协议(Picture Transfer,PTP)模式下工作的数码相机不会以该形式出现,而是由 libgphoto 和/或 libptp 透明处理。在这种情况下,“透明”意味着 PTP 设备不会被获取为块设备。不是所有相机都支持作为 PTP 模式替代的 USB 大容量存储设备(USB Mass Storage,UMS)模式。有些相机可以在菜单中切换这两种模式,具体信息请参考相机的用户手册。如果你的相机不支持 UMS 模式,就无法被作为块设备读取,唯一解决方法是将介质从相机中取出,然后使用读卡器连到电脑。

工具清单

See also Wikipedia:List of data recovery software#File Recovery

  • ddrutility — Compliment to GNU ddrescue. Find what files are related to the bad sectors and some special tools for NTFS. No longer actively supported.
https://sourceforge.net/projects/ddrutility/ || ddrutilityAUR
  • dvdisaster — Additional error protection for CD/DVD media.
https://sourceforge.net/projects/dvdisaster/ || dvdisasterAUR
  • Foremost — Console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. The headers and footers can be specified by a configuration file or command line switches can be used to specify built-in file types.
https://foremost.sourceforge.net/ || foremost
  • PhotoRec — File data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory.
https://www.cgsecurity.org/ || testdisk
  • R-Linux — A free file recovery utility for the Ext2/Ext3/Ext4 file systems.
https://www.r-studio.com/free-linux-recovery/ || r-linuxAUR
  • Scalpel — File carving and indexing application originally based on Foremost, although significantly more efficient. It allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media.
https://github.com/sleuthkit/scalpel || scalpel-gitAUR
  • TestDisk — Data recovery software primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).
https://www.cgsecurity.org/ || testdisk
  • xfs_undelete — Traverses the inode B+trees of each allocation group and tries to recover all files on an XFS filesystem marked as deleted.
https://github.com/ianka/xfs_undelete || xfs_undelete-gitAUR

TestDisk 和 PhotoRec

TestDisk and Photorec are both open-source data recovery utilities licensed under the terms of the GNU Public License (GPL).

TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error, such as the accidental deletion of partition tables. TestDisk detects numerous filesystem including NTFS, FAT12, FAT16, FAT32, exFAT, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS. It can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.

TestDisk allows to fix partition tables, recover deleted partitions, recover FAT32 boot sector from its backup, rebuild FAT12/FAT16/FAT32 boot sectors, fix FAT tables, rebuild NTFS boot sector and more.

PhotoRec is file recovery software designed to recover lost files including photographs (Hint: PhotographRecovery), videos, documents, archives from hard disks and CD-ROMs. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even with a re-formatted or severely damaged filesystems and/or partition tables.

安装

Install the testdisk package, which provides both TestDisk and PhotoRec.

用法

After running e.g. ddrescue to create image.img, photorec image.img will open a terminal UI where you can select what file types to search for and where to put the recovered files. There is very good documentation on their wiki.

Files recovered by photorec

The photorec utility stores recovered files with a random names(for most of the files) under a numbered directories, e.g. ./recup_dir.1/f872690288.jpg, ./recup_dir.1/f864563104_wmclockmon-0.1.0.tar.gz.

参考

e2fsck

e2fsck is the ext2/ext3 filesystem checker included in the base install of Arch. e2fsck relies on a valid superblock. A superblock is a description of the entire filesystem's parameters. Because this data is so important, several copies of the superblock are distributed throughout the partition. With the -b option, e2fsck can take an alternate superblock argument; this is useful if the main, first superblock is damaged.

To determine where the superblocks are, run dumpe2fs -h on the target, unmounted partition. Superblocks are spaced differently depending on the filesystem's blocksize, which is set when the filesystem is created.

An alternate method to determine the locations of superblocks is to use the -n option with mke2fs. Be sure to use the -n flag, which, according to mke2fs(8), "Causes mke2fs to not actually create a filesystem, but display what it would do if it were to create a filesystem. This can be used to determine the location of the backup superblocks for a particular filesystem, so long as the mke2fs parameters that were passed when the filesystem was originally created are used again. (With the -n option added, of course!)".

安装

Both e2fsck and dumpe2fs are included in the base Arch install as part of e2fsprogs.

See also e2fsck(8) and dumpe2fs(8).

Working with raw disk images

本文或本章节可能需要合并到QEMU

附注: 请提供模板的second参数以more detailed indications。(在 Talk:文件恢复 中讨论)

If you have backed up a drive using ddrescue or dd and you need to mount this image as a physical drive, see this section.

Mount the entire disk

To mount a complete disk image to the next free loop device, use the losetup command:

# losetup -f -P /path/to/image
提示:
  • The -f flag mounts the image to the next available loop device.
  • The -P flag creates additional devices for every partition.

See also QEMU#With loop module autodetecting partitions.

挂载分区

In order to be able to mount a partition of a whole disk image, follow the steps above.

Once the whole disk image is mounted, a normal mount command can be used on the loop device:

# mount /dev/loop0p1 /mnt/example

This command mounts the first partition of the image in loop0 to the folder to the mountpoint /mnt/example. Remember that the mountpoint directory must exist!

Getting disk geometry

Once the entire disk image has been mounted as a loopback device, its drive layout can be inspected.

使用 QEMU 来修复 NTFS

由于 Linux 下没有好的 NTFS 检查工具,包含一个或多个 NTFS 分区的硬盘需要使用 Windows 进行 chkdsk。 QEMU 可以在虚拟机中将 raw 原始磁盘映像作为物理硬盘使用:

# qemu -hda /path/to/primary.img -hdb /path/to/DamagedDisk.img

然后, 假设 Windows 被安装在 primary.img,它就可以用来检查 /path/to/DamagedDisk.img 上的分区。

警告:Do not use lower version of Windows to check NTFS partitions create by higher version of it, e.g. Windows XP can do damage to NTFS partitions created by Windows 8 by "fixing" metadata configuration that it does not support, resulting in damage/removal of these unsupported entries.

文本文件恢复

在块设备上有可能通过直接搜索找出被删掉的纯文本文件。你需要一段来自待恢复的文件中的比较独一无二的字符串。

使用 grep 在分区上直接筛选固定字符串(-F):

$ grep -a -C 200 -F 'Unique string in text file' /dev/sdXN > OutputFile

如果运气好的话,被删除文件的内容会出现在 OutputFile 中,可直接从文本的上下文中提取。

注意:-C -200 选项告诉 grep 打印每个匹配字符串的前后 200 行。也可以使用 -A-B 参数,分别会输出匹配字符串之后和之前的内容。如果你在寻找的文本很长,则需要视情况调整。

参阅