Ubuntu 20.04 机器的 /home 分区中有一个包含备份文件的文件夹被意外删除。文件夹中的所有文件都是同一事物(Minecraft 世界)的备份(zip),但日期不同。由于这足以恢复 30 个最新文件中的其中一个,因此我们认为至少恢复其中一个文件的可能性很大。
我从 fstab 中删除了 /home (这是一个单独的挂载),启用 root 登录,重新启动计算机并以 root 身份登录。我首先尝试使用恢复文件extundelete
,它似乎找到了该文件,但无法恢复它。我尝试了几个丢失的文件并得到了相同的输出:
root@arne:~# extundelete /dev/sdb1 --restore-file 'TBS_world-2021-10-09.zip'
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 4456 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
Failed to restore file TBS_world-2021-10-09.zip
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name | Inode number | Deleted status
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
接下来我尝试了ext4magic
,它清楚地检测到了423个已删除的文件:
root@arne:~# ext4magic /dev/sdb1 -H -a 1640202942 -b 1640203868
Filesystem in use: /dev/sdb1
<...snip...>
|-----------d_time Histogram----------------- after -------------------- Wed Dec 22 20:55:42 2021
1640203034 : 0 | | Wed Dec 22 20:57:14 2021
1640203126 : 0 | | Wed Dec 22 20:58:46 2021
1640203218 : 0 | | Wed Dec 22 21:00:18 2021
1640203310 : 0 | | Wed Dec 22 21:01:50 2021
1640203402 : 0 | | Wed Dec 22 21:03:22 2021
1640203494 : 0 | | Wed Dec 22 21:04:54 2021
1640203586 : 0 | | Wed Dec 22 21:06:26 2021
1640203678 : 423 |**************************************************| Wed Dec 22 21:07:58 2021
1640203770 : 0 | | Wed Dec 22 21:09:30 2021
1640203862 : 0 | | Wed Dec 22 21:11:02 2021
<...snip...>
ext4magic : EXIT_SUCCESS
尝试查找任何文件都会给出有希望的输出,但实际上恢复文件却表示找不到它:
root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip -l
Filesystem in use: /dev/sdb1
Using internal Journal at Inode 8
Inode found "albin/Backups/TBS_world-2021-10-10.zip" 18350376
Inode 18350376 is a directory but not found after 1640359705 and before 1640446105
ext4magic : EXIT_SUCCESS
root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip
Filesystem in use: /dev/sdb1
Error: Filename "albin/Backups/TBS_world-2021-10-10.zip" not found in Filesystem
if "albin/Backups/TBS_world-2021-10-10.zip" deleted, use InodeNr or try Journaling options
运行testdisk
显示已删除的目录,但内容无法访问。它说文件系统可能已损坏。
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <[email protected]>
https://www.cgsecurity.org
1 P Linux filesys. data 2048 1167943679 1167941632
Directory /albin/Backups
No file found, filesystem may be damaged.
知道为什么会出现这些错误吗?所有工具看起来都很有希望,但最终却失败了。至少有一个丢失的文件应该仍然存在而没有损坏,这似乎是合理的。我不明白为什么我会收到这些错误。