![Scalpel 恢复未显示任何恢复文件](https://linux22.com/image/1138319/Scalpel%20%E6%81%A2%E5%A4%8D%E6%9C%AA%E6%98%BE%E7%A4%BA%E4%BB%BB%E4%BD%95%E6%81%A2%E5%A4%8D%E6%96%87%E4%BB%B6.png)
昨晚(大约 10 小时前)我错误地删除了一些 .odt 文件,我必须恢复这些文件,因为它们对我来说非常重要。为此,我使用了 scalepel,并输入了以下命令:
scalpel /dev/sda2 -b -o ~/Desktop/fhghghg
我在 sda2 中删除了文件,除此以外我没有其他分区。所以我在桌面上创建了一个文件夹。这个过程花了 2 个小时才完成:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
Opening target "/dev/sda2"
Image file pass 1/2.
/dev/sda2: 33.2% |************ | 154.0 GB 1:27:29 ETA
/dev/sda2: 100.0% |*************************************| 463.5 GB 00:00 ETA
Carve lists built. Workload:
odt with header "\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x6d\x69\x6d\x65\x74\x79\x70\x65\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x76\x6e\x64\x2e\x6f\x61\x73\x69\x73\x2e\x6f\x70\x65\x6e\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x74\x65\x78\x74\x50\x4b" and footer "\x4d\x45\x54\x41\x2d\x49\x4e\x46\x2f\x6d\x61\x6e\x69\x66\x65\x73\x74\x2e\x78\x6d\x6c\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f" --> 193 files
ods with header "\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x6d\x69\x6d\x65\x74\x79\x70\x65\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x76\x6e\x64\x2e\x6f\x61\x73\x69\x73\x2e\x6f\x70\x65\x6e\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x73\x70\x72\x65\x61\x64\x73\x68\x65\x65\x74\x50\x4b" and footer "\x4d\x45\x54\x41\x2d\x49\x4e\x46\x2f\x6d\x61\x6e\x69\x66\x65\x73\x74\x2e\x78\x6d\x6c\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f" --> 14 files
odp with header "\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x6d\x69\x6d\x65\x74\x79\x70\x65\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x76\x6e\x64\x2e\x6f\x61\x73\x69\x73\x2e\x6f\x70\x65\x6e\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x70\x72\x65\x73\x65\x6e\x74\x61\x74\x69\x6f\x6e\x50\x4b" and footer "\x4d\x45\x54\x41\x2d\x49\x4e\x46\x2f\x6d\x61\x6e\x69\x66\x65\x73\x74\x2e\x78\x6d\x6c\x50\x4b\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f" --> 26 files
Carving files from image.
Image file pass 2/2.
/dev/sda2: 100.0% |*************************************| 463.5 GB 00:00 ETAProcessing of image file complete. Cleaning up...
Done.
Scalpel is done, files carved = 233, elapsed = 7178 seconds.
在桌面文件夹中,我得到了带有锁定图标的文件夹(因为我已经在根模式下运行了所有命令),并且它只有一个文件审计文本.我没有得到任何 odt 文件,并且文件夹也有锁定图标。
问题是,“ls -l fhghghg/”显示:
total 28
-rw-r--r-- 1 root root 12713 Jul 4 12:59 audit.txt
drwxr-xr-x 2 root root 4096 Jul 4 12:58 odp-2-0
drwxr-xr-x 2 root root 4096 Jul 4 12:58 ods-1-0
drwxr-xr-x 2 root root 4096 Jul 4 12:59 odt-0-0
在“ cat fhghghg/audit.txt ”上显示:
Scalpel version 1.60 audit file
Started at Mon Jul 4 10:59:22 2016
Command line:
scalpel /dev/sda2 -b -o /root/Desktop/fhghghg
Output directory: /root/Desktop/fhghghg
Configuration file: /etc/scalpel/scalpel.conf
Opening target "/dev/sda2"
The following files were carved:
File Start Chop Length Extracted From
00000000.odt 165150720 NO 66578 sda2
00000001.odt 1549533184 NO 175449 sda2
00000002.odt 1558052864 NO 72438 sda2
00000003.odt 33336066048 NO 66656 sda2
00000004.odt 35885285376 NO 67311 sda2
00000005.odt 112145858560 NO 74935 sda2
00000006.odt 174892515328 NO 356733 sda2
00000207.odp 223076155392 NO 1603418 sda2
00000208.odp 223283773440 NO 1603418 sda2
00000211.odp 245120432145 NO 131 sda2
00000210.odp 245120381927 NO 131 sda2
00000209.odp 245120365543 NO 131 sda2
00000195.ods 245120432301 NO 131 sda2
00000194.ods 245120381771 NO 131 sda2
00000193.ods 245120365387 NO 131 sda2
00000009.odt 245120432457 NO 123 sda2
00000008.odt 245120381623 NO 123 sda2
00000007.odt 245120365239 NO 123 sda2
00000010.odt 245957844992 NO 57678 sda2
00000013.odt 245990367232 NO 51457 sda2
00000012.odt 245989691392 NO 50606 sda2
00000011.odt 245989638144 NO 50606 sda2
00000015.odt 246002446336 NO 57673 sda2
00000014.odt 245998026752 NO 57673 sda2
00000022.odt 246127157248 NO 61235 sda2
00000021.odt 246126817280 NO 60494 sda2
00000020.odt 246126682112 NO 59831 sda2
00000019.odt 246126301184 NO 59549 sda2
00000018.odt 246126145536 NO 59230 sda2
00000017.odt 246126084096 NO 59230 sda2
00000016.odt 246125953024 NO 58893 sda2
00000029.odt 246242107392 NO 60355 sda2
00000028.odt 246242045952 NO 60355 sda2
00000027.odt 246241820672 NO 60568 sda2
00000026.odt 246241746944 NO 60568 sda2
00000025.odt 246241685504 NO 60568 sda2
00000024.odt 246241480704 NO 59879 sda2
00000023.odt 246241296384 NO 56023 sda2
00000031.odt 246270717952 NO 60781 sda2
00000030.odt 246270656512 NO 60781 sda2
00000032.odt 246350348288 NO 59050 sda2
00000219.odp 246512517120 NO 21647 sda2
00000218.odp 246512447488 NO 21647 sda2
00000217.odp 246512422912 NO 21647 sda2
00000216.odp 246512398336 NO 21472 sda2
00000215.odp 246512373760 NO 21472 sda2
00000214.odp 246512222208 NO 22227 sda2
00000213.odp 246512197632 NO 22227 sda2
00000212.odp 246511828992 NO 26766 sda2
00000035.odt 246659334144 NO 56871 sda2
00000034.odt 246659186688 NO 56871 sda2
00000033.odt 246658629632 NO 56809 sda2
00000038.odt 247273463808 NO 51310 sda2
00000037.odt 247273123840 NO 28399 sda2
00000036.odt 247273095168 NO 28399 sda2
00000041.odt 247275417600 NO 64670 sda2
00000040.odt 247275237376 NO 41323 sda2
00000039.odt 247275192320 NO 41323 sda2
00000042.odt 256493486080 NO 71190 sda2
00000043.odt 322483257344 YES 20000000 sda2
00000044.odt 323462103040 NO 363314 sda2
00000045.odt 325778538496 NO 67994 sda2
00000053.odt 332444651520 NO 64830 sda2
00000052.odt 332444585984 NO 64830 sda2
00000051.odt 332444241920 NO 64511 sda2
00000050.odt 332444176384 NO 64511 sda2
00000049.odt 332443537408 NO 44640 sda2
00000048.odt 332443492352 NO 44640 sda2
00000047.odt 332443267072 NO 29643 sda2
00000046.odt 332443234304 NO 29643 sda2
00000220.odp 332484366336 NO 45772 sda2
00000055.odt 333043331072 NO 13661 sda2
00000054.odt 333043277824 NO 13866 sda2
00000057.odt 333158961152 NO 35778 sda2
00000056.odt 333158924288 NO 35778 sda2
00000060.odt 335705534464 NO 57135 sda2
00000059.odt 335705477120 NO 57135 sda2
00000058.odt 335705059328 NO 56871 sda2
00000221.odp 349310341120 NO 45772 sda2
00000062.odt 354530766848 NO 13661 sda2
00000061.odt 354530713600 NO 13866 sda2
00000063.odt 354655182848 NO 51457 sda2
00000065.odt 361309286400 NO 10258 sda2
00000064.odt 361309274112 NO 10258 sda2
00000222.odp 372202671259 NO 131 sda2
00000196.ods 372202671102 NO 131 sda2
00000066.odt 372202670953 NO 123 sda2
00000067.odt 374029000704 NO 43955 sda2
00000068.odt 374137524224 NO 28259 sda2
00000071.odt 374502830080 NO 56941 sda2
00000070.odt 374501724160 NO 56941 sda2
00000069.odt 374501666816 NO 56941 sda2
00000072.odt 374532067328 NO 56941 sda2
00000073.odt 377623543808 NO 76407 sda2
00000074.odt 381290549248 NO 57673 sda2
00000080.odt 381299466240 NO 48719 sda2
00000079.odt 381299417088 NO 48719 sda2
00000078.odt 381295329280 NO 57673 sda2
00000077.odt 381295267840 NO 57678 sda2
00000076.odt 381295206400 NO 57678 sda2
00000075.odt 381294149632 NO 57553 sda2
00000082.odt 381444202496 NO 59210 sda2
00000081.odt 381444141056 NO 59210 sda2
00000087.odt 381517520896 NO 51310 sda2
00000086.odt 381517467648 NO 51310 sda2
00000085.odt 381516627968 NO 59210 sda2
00000084.odt 381516201984 NO 42408 sda2
00000083.odt 381516156928 NO 42408 sda2
00000088.odt 381567524864 NO 57678 sda2
00000091.odt 381682532352 NO 51592 sda2
00000090.odt 381682438144 NO 51592 sda2
00000089.odt 381682319360 NO 47849 sda2
00000093.odt 381723653557 YES 20000000 sda2
00000092.odt 381723607138 YES 20000000 sda2
00000095.odt 382001963008 NO 32712 sda2
00000094.odt 382001913856 NO 19858 sda2
00000097.odt 382751465472 NO 61253 sda2
00000096.odt 382751404032 NO 61253 sda2
00000099.odt 382850899968 NO 29191 sda2
00000098.odt 382850867200 NO 29191 sda2
00000105.odt 382906286080 NO 57015 sda2
00000104.odt 382906150912 NO 57015 sda2
00000103.odt 382906093568 NO 57015 sda2
00000102.odt 382906028032 NO 56949 sda2
00000101.odt 382905970688 NO 56949 sda2
00000100.odt 382905847808 NO 11858 sda2
00000225.odp 384853735445 NO 131 sda2
00000224.odp 384853314443 NO 131 sda2
00000223.odp 384853304473 NO 131 sda2
00000199.ods 384853735601 NO 131 sda2
00000198.ods 384853314599 NO 131 sda2
00000197.ods 384853304629 NO 131 sda2
00000108.odt 384853735757 NO 123 sda2
00000107.odt 384853314755 NO 123 sda2
00000106.odt 384853304785 NO 123 sda2
00000109.odt 385009569792 NO 15531 sda2
00000110.odt 385024008192 NO 15531 sda2
00000228.odp 385027400495 NO 131 sda2
00000227.odp 385027375919 NO 131 sda2
00000226.odp 385027334959 NO 131 sda2
00000202.ods 385027400651 NO 131 sda2
00000201.ods 385027376075 NO 131 sda2
00000200.ods 385027335115 NO 131 sda2
00000117.odt 385036374016 NO 26925 sda2
00000116.odt 385036345344 NO 26925 sda2
00000115.odt 385036181504 NO 25976 sda2
00000114.odt 385036152832 NO 25976 sda2
00000113.odt 385027400807 NO 123 sda2
00000112.odt 385027376231 NO 123 sda2
00000111.odt 385027335271 NO 123 sda2
00000120.odt 385904201728 NO 64812 sda2
00000119.odt 385903742976 NO 55075 sda2
00000118.odt 385903685632 NO 55075 sda2
00000121.odt 386372194304 NO 64812 sda2
00000122.odt 403871420416 NO 67490 sda2
00000132.odt 404601462784 NO 57673 sda2
00000131.odt 404601217024 NO 57673 sda2
00000130.odt 404600008704 NO 57553 sda2
00000129.odt 404599341056 NO 57507 sda2
00000128.odt 404599107584 NO 56863 sda2
00000127.odt 404598841344 NO 56475 sda2
00000126.odt 404598251520 NO 55470 sda2
00000125.odt 404598013952 NO 55262 sda2
00000124.odt 404597506048 NO 54883 sda2
00000123.odt 404597243904 NO 54435 sda2
00000134.odt 406155063296 NO 48578 sda2
00000133.odt 406155014144 NO 48578 sda2
00000135.odt 423825518592 NO 23473 sda2
00000137.odt 436442365952 NO 76178 sda2
00000136.odt 436442234880 NO 76178 sda2
00000139.odt 437631172608 NO 53630 sda2
00000138.odt 437631115264 NO 53630 sda2
00000144.odt 444455059456 NO 61235 sda2
00000143.odt 444454821888 NO 60494 sda2
00000142.odt 444454592512 NO 59831 sda2
00000141.odt 444454440960 NO 59549 sda2
00000140.odt 444454223872 NO 58893 sda2
00000145.odt 457728016384 NO 13661 sda2
00000229.odp 458216093969 NO 131 sda2
00000203.ods 458216093812 NO 131 sda2
00000146.odt 458216093663 NO 123 sda2
00000147.odt 458279878656 NO 76178 sda2
00000149.odt 459706834944 NO 57548 sda2
00000148.odt 459706773504 NO 57548 sda2
00000151.odt 459865214976 NO 59050 sda2
00000150.odt 459865088000 NO 60355 sda2
00000152.odt 460304388096 NO 43955 sda2
00000153.odt 460356788224 NO 43955 sda2
00000158.odt 460393865216 NO 43955 sda2
00000157.odt 460389191680 NO 60568 sda2
00000156.odt 460389015552 NO 59879 sda2
00000155.odt 460388745216 NO 56023 sda2
00000154.odt 460388577280 NO 33454 sda2
00000159.odt 460509990912 NO 60355 sda2
00000161.odt 460847316992 NO 75503 sda2
00000160.odt 460847185920 NO 75503 sda2
00000230.odp 460892059921 NO 131 sda2
00000204.ods 460892059764 NO 131 sda2
00000162.odt 460892059615 NO 123 sda2
00000164.odt 461019455488 NO 9790 sda2
00000163.odt 461019443200 NO 9790 sda2
00000167.odt 461272621056 NO 59563 sda2
00000166.odt 461272559616 NO 59563 sda2
00000165.odt 461270708224 NO 31029 sda2
00000169.odt 461319307264 NO 67556 sda2
00000168.odt 461317472256 NO 67556 sda2
00000231.odp 461651213650 NO 131 sda2
00000205.ods 461651213493 NO 131 sda2
00000170.odt 461651213344 NO 123 sda2
00000232.odp 461693155766 NO 131 sda2
00000206.ods 461693155609 NO 131 sda2
00000171.odt 461693155460 NO 123 sda2
00000172.odt 461904150528 NO 75194 sda2
00000173.odt 462387863552 NO 60861 sda2
00000174.odt 462430027776 NO 60861 sda2
00000176.odt 462503186432 NO 51859 sda2
00000175.odt 462503133184 NO 51859 sda2
00000181.odt 462513750016 NO 60756 sda2
00000180.odt 462513688576 NO 60756 sda2
00000179.odt 462512824320 NO 60655 sda2
00000178.odt 462512664576 NO 60655 sda2
00000177.odt 462512431104 NO 60069 sda2
00000186.odt 490980745216 NO 59253 sda2
00000185.odt 490980409344 NO 57755 sda2
00000184.odt 490979966976 NO 48092 sda2
00000183.odt 490979917824 NO 48092 sda2
00000182.odt 490979581952 NO 33107 sda2
00000190.odt 495273373696 NO 60073 sda2
00000189.odt 495272992768 NO 60193 sda2
00000188.odt 495272685568 NO 59253 sda2
00000187.odt 495272243200 NO 57755 sda2
00000192.odt 495414734848 NO 60073 sda2
00000191.odt 495414460416 NO 60193 sda2
Completed at Mon Jul 4 12:59:00 2016
但文件夹是空的,有锁图标。我现在不知道如何恢复我的文件。这对我非常重要,请帮帮我!我将不胜感激。
答案1
我以准确的格式恢复了所有文件。问题是我得到了同一个文件的多个副本,所以我必须选择最正确的那个。但我很高兴找到了它。
我所做的是:由于所有操作均使用超级用户。因此我使用了以下命令:
sudo su
输入密码后,我更改了目录,因为所有数据都在那里,但是是根形式。因此我将目录更改为:
cd ~/Desktop/fhghghg/
由于所有数据都存在,因此为了查看我的 odt 文件,我列出了所有存在的文件:
~/Desktop/fhghghg# ls -la
然后我收到以下回复:
total 56 drwxrwxrwx 5 root root 4096 Jul 4 12:58 . drwxr-xr-x 3 root root 4096 Jul 4 16:29 .. -rw-r--r-- 1 root root 12713 Jul 4 12:59 audit.txt drwxr-xr-x 2 root root 4096 Jul 4 12:58 odp-2-0 drwxr-xr-x 2 root root 4096 Jul 4 12:58 ods-1-0 drwxr-xr-x 2 root root 20480 Jul 4 16:52 odt-0-0
我发现我恢复的文件位于odt-0-0,因此我再次将目录更改为:
~/Desktop/fhghghg# cd ~/Desktop/fhghghg/odt-0-0/
我在那里列出了我的所有文件:
~/Desktop/fhghghg/odt-0-0# ls -all
然后得到以下回应:
total 68624 drwxr-xr-x 2 root root 20480 Jul 4 16:52 . drwxrwxrwx 5 root root 4096 Jul 4 12:58 .. -rw-r--r-- 1 root root 66578 Jul 4 12:58 00000000.odt -rw-r--r-- 1 root root 175449 Jul 4 12:58 00000001.odt -rw-r--r-- 1 root root 72438 Jul 4 12:58 00000002.odt -rw-r--r-- 1 root root 66656 Jul 4 12:58 00000003.odt -rw-r--r-- 1 root root 67311 Jul 4 12:58 00000004.odt -rw-r--r-- 1 root root 74935 Jul 4 12:58 00000005.odt -rw-r--r-- 1 root root 356733 Jul 4 12:58 00000006.odt -rw-r--r-- 1 root root 123 Jul 4 12:58 00000007.odt .. ..
因此我再次在 Libreoffice 的帮助下打开其中一个文件:
libreoffice 00000000.odt
然后打开了我的一个文件。然后我通过以下方式保存该文件的副本:
LibreOffice --> File --> Save as Copy --> File Systems --> Desktop
笔记:不要这样做 LibreOffice --> 文件 --> 另存为副本 --> 桌面
否则您将再次陷入麻烦,因为此“桌面”处于根模式,并且您将无法再次看到您的文件。
然后我在桌面屏幕上找到了第一个恢复的文件,但上面有一个锁图标,所以它是只读文件。要将其更改为可编辑模式,我使用了:
chmod 777 -R /home/(user_name)/Desktop/(file_name).odt
虽然经过一些艰苦的努力,但我最终恢复了我的文件。
笔记:所有命令都处于根模式。