BTRFS 无需快照即可恢复已删除的文件

2024-6-12 • tag-icon

BTRFS 无需快照即可恢复已删除的文件

我删除了 4TB 磁盘上的所有文件/dev/sdb1。这是通过rsync --delete命令完成的。

在停止之前，rsync 写入了大约 10GB 的数据。

当然磁盘上没有快照。

文件btrfs系统已安装到该/home/user/Downloads文件夹。

所以我想知道是否有办法恢复数据。

到目前为止（卸载磁盘后）我已经尝试过：

btrfs 恢复：

btrfs restore -i /dev/sdb1 /mnt/RESTORE/

只恢复了10GB的新文件。

这btrfs-取消删除脚本我设法让它发挥作用： ./btrfs.sh /dev/sdb1 /home/user/Downloads/* /mnt/RESTORE/

结果：

[...]
Trying root 3001138823168... (1096/1103)
Trying root 853360640... (1097/1103)
Trying root 50626560... (1098/1103)
Trying root 31309824... (1099/1103)
Trying root 31129600... (1100/1103)
Trying root 30900224... (1101/1103)
Trying root 30818304... (1102/1103)
Trying root 30408704... (1103/1103)
Didn't find 'home/user/D*/*

我还尝试使用以下命令手动恢复文件btrfs restore -t 3001556484096 /dev/sdb1 /mnt/RESTORE/：

parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super

btrfs-find-root -a /dev/sdb1输出：

Superblock thinks the generation is 96918
Superblock thinks the level is 1
[...]
Well block 3001381945344(gen: 94646 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 3001359089664(gen: 94635 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 853360640(gen: 94238 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1

btrfs rescue super-recover -v /dev/sdb1输出：

All Devices:
        Device: id = 1, name = /dev/sdb1

Before Recovering:
        [All good supers]:
                device name = /dev/sdb1
                superblock bytenr = 65536

                device name = /dev/sdb1
                superblock bytenr = 67108864

                device name = /dev/sdb1
                superblock bytenr = 274877906944

        [All bad supers]:

All supers are valid, no need to recover

因此，任何帮助将不胜感激:)

更新1：

不幸的是，我只能恢复一些损坏的文件。这是我按照以下步骤所做的btrfs-取消删除脚本。

将每个 ID 获取到/tmp/ID文件中：

btrfs-find-root -a /dev/sdb1 2>&1 | grep ^Well | sed -r -e 's/Well block ([0-9]+).*/\1/' | sort -rn > /tmp/ID

我可以从 ID 恢复一切：

for i in $(cat /tmp/ID) ; do mkdir /mnt/RESTORE/"$i"; btrfs restore -o -iv -t "$i" /dev/sdb1 /mnt/RESTORE/"$i" 2>&1; done

我想现在唯一的办法就是找到一个文件恢复软件......

答案1

正如前面所讨论的，我最终使用了文件恢复软件。我试过易我数据恢复向导和UFS Explorer 标准恢复 v9.13因为两者应该兼容BTFS。

我们可以免费尝试这两个软件（在此模式下仅提供扫描，这使我们可以查看是否可以恢复某些内容）。

在我的经验中UFS 浏览器是更好的解决方案。事实上，在扫描后，它能够列出已删除的文件及其原始名称和目录树。

易我数据恢复向导能够恢复文件，但其中大多数文件没有正确命名，并且不尊重原始目录组织。

所以，对我来说最好的解决方案是UFS Explorer 标准恢复。费用约为70$对于个人许可证：

https://www.ufsexplorer.com/ufs-explorer-standard-recovery/

相关内容