☰

取消删除：由于 NTFS 卷已以独占方式打开，因此访问被拒绝

tag-icon • tag-icon ntfs undelete
取消删除：由于 NTFS 卷已以独占方式打开，因此访问被拒绝

我需要恢复一些从 pratiion 中删除的文件。

ben@ben-V5-171:~$ sudo ntfsundelete /dev/sdb1
Access is denied because the NTFS volume is already exclusively opened.
The volume may be already mounted, or another software may use it which
could be identified for example by the help of the 'fuser' command.
You can use force option to avoid this check, but this is not recommended
and may lead to data corruption.
ben@ben-V5-171:~$ fuser /dev/sdb1
ben@ben-V5-171:~$ sudo fuser /dev/sdb1
ben@ben-V5-171:~$ lsof /dev/sdb1
ben@ben-V5-171:~$ sudo lsof /dev/sdb1
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/ben/.gvfs
      Output information may be incomplete.
ben@ben-V5-171:~$

答案1

我必须手动恢复umount我的驱动器。它变成了 vfat fs，所以最后，在我的情况下恢复文件的最佳方法是这个：

ben@ben-V5-171:~/tmp/flash$ sudo dd if=/dev/sdb1 of=fl.img bs=1024
ben@ben-V5-171:~/tmp/flash$ tsk_recover -e fl.img files/

相关内容