FreeBSD Data Rescue

出自KMU Wiki

在2009年6月22日 (一) 10:16所做的修訂版本 (編輯) Cch (對話 | 貢獻) (→MSDOSFS/NTFS) ←上一個		當前修訂版本 (2018年10月30日 (二) 09:27) (編輯) (撤銷) Cch (對話 | 貢獻)
(15個中途的修訂版本沒有顯示。)
第1行：		第1行：
-	在 FreeBSD 利用自由軟體搶救檔案	+	Using FreeBSD and Open-Source Tools to rescue data
-	==FreeBSD UFS==	+	在 FreeBSD 下使用搶救資料的工具
-	fsck -y	+	==UFS fsck -y failed==
-	UNKNOWN FILE TYPE I=8408063	+	If fsck -y UFS failed
-	UNEXPECTED SOFT UPDATE INCONSISTENCY	+
-	CLEAR? yes	+
-	fsck_4.2bsd: bad inode number 8408064 to nextinode	+
-	mount -r	+	<pre>
-	find home -type f -and -size -1G -print > /root/T2	+	# fsck -y
-	tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"	+	...
		+	UNKNOWN FILE TYPE I=8408063
		+	UNEXPECTED SOFT UPDATE INCONSISTENCY
		+	CLEAR? yes
		+	fsck_4.2bsd: bad inode number 8408064 to nextinode
		+	</pre>
-	萬一檔案系統 ls 時已無任何檔案或目錄，則可再試試幾個工具程式	+	Try to mount UFS read-only
		+
		+	<pre>
		+	# mount -r /dev/daXs1d /mnt
		+	# find /mnt -type f -and -size -1G -print > /root/T2
		+	# tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"
		+	</pre>
		+
		+	If ls can not see any files or directories, you may try
	* /usr/ports/sysutils/ffs2recov		* /usr/ports/sysutils/ffs2recov
第21行：		第31行：
	* /usr/ports/sysutils/autopsy		* /usr/ports/sysutils/autopsy
-	e.g. 使用 autopsy	+	Using autopsy
-	sudo autopsy localhost	+	<pre>
-	add case -> add host -> add image -> ...	+	# autopsy localhost
		+	using browser to connect http://localhost
-	==MSDOSFS/NTFS==	+	add case -> add host -> add image -> ...
		+	</pre>
-	Partition Table 壞了或重新分割後想找回原分割區下的檔案	+	==Bad Partition Table==
		+
		+	===Using testdisk to check and undelete partitions===
		+
		+	Path: /usr/ports/sysutils/testdisk
		+
		+	Info: Tool to check and undelete partitions
		+
		+	WWW: https://www.cgsecurity.org/wiki/TestDisk
		+
		+
		+	===Using magicrescue===
	/usr/ports/sysutils/magicrescue		/usr/ports/sysutils/magicrescue
-	magicrescue 可救的檔案類型有 (ls /usr/local/share/magicrescue/recipes/)	+	magicrescue can rescue following file types (ls /usr/local/share/magicrescue/recipes/)
		+
		+	* avi
		+	* flac
		+	* gzip
		+	* mp3-id3v1
		+	* perl
		+	* canon-cr2
		+	* gimp-xcf
		+	* jpeg-exif
		+	* mp3-id3v2
		+	* png
		+	* elf
		+	* gpl
		+	* jpeg-jfif
		+	* msoffice
		+	* zip
		+
		+	<pre>
		+	First to get the image of the disk or partition
		+
		+	# dd if=/dev/daX of=IMG_DIR/daX.img
-	avi flac gzip mp3-id3v1 perl	+	Then using magicrescue to rescue MS-Office and JPEG files
-	canon-cr2 gimp-xcf jpeg-exif mp3-id3v2 png	+
-	elf gpl jpeg-jfif msoffice zip	+
-	e.g.	+	# magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d OUTPUT_DIR IMG_DIR/daX.img
-	將欲搶救的硬碟拆下，用 USB-to-ATA/SATA 轉接器	+	</pre>
-	magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d ~/output /dev/da0	+
-	或 (避免多次讀取 /dev/da0)	+
-	dd if=/dev/da0 of=/big/da0img	+
-	magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d ~/output /big/da0img	+
-	參考資料︰	+	===Using foremost===
-	http://www.student.dtu.dk/~s042078/magicrescue/manpage.html	+	===Using gpart===
-	參考資料中有提到︰	+	==Reference==
-	Partition Table 不見了，可考據用 gpart 重建	+	[http://www.student.dtu.dk/~s042078/magicrescue/manpage.html magicrescue]
-	foremost (/usr/ports/sysutils/foremost) 認識更多類型的檔案，但判斷檔案實際大小的能力較弱。	+	[[Category:資訊處]] [[Category:圖書資訊處]] [[Category:資訊服務]]

---

當前修訂版本

Using FreeBSD and Open-Source Tools to rescue data

在 FreeBSD 下使用搶救資料的工具

目錄 1 UFS fsck -y failed 2 Bad Partition Table 2.1 Using testdisk to check and undelete partitions 2.2 Using magicrescue 2.3 Using foremost 2.4 Using gpart 3 Reference

[編輯] UFS fsck -y failed

If fsck -y UFS failed

# fsck -y
...
UNKNOWN FILE TYPE I=8408063
UNEXPECTED SOFT UPDATE INCONSISTENCY
CLEAR? yes
fsck_4.2bsd: bad inode number 8408064 to nextinode

Try to mount UFS read-only

# mount -r /dev/daXs1d /mnt
# find /mnt -type f -and -size -1G -print > /root/T2
# tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"

If ls can not see any files or directories, you may try

• /usr/ports/sysutils/ffs2recov
• /usr/ports/sysutils/scan_ffs
• /usr/ports/sysutils/sleuthkit
• /usr/ports/sysutils/autopsy

Using autopsy

# autopsy localhost

using browser to connect http://localhost

add case -> add host -> add image -> ...

[編輯] Bad Partition Table

[編輯] Using testdisk to check and undelete partitions

Path: /usr/ports/sysutils/testdisk

Info: Tool to check and undelete partitions

WWW: https://www.cgsecurity.org/wiki/TestDisk

[編輯] Using magicrescue

/usr/ports/sysutils/magicrescue

magicrescue can rescue following file types (ls /usr/local/share/magicrescue/recipes/)

• avi
• flac
• gzip
• mp3-id3v1
• perl
• canon-cr2
• gimp-xcf
• jpeg-exif
• mp3-id3v2
• png
• elf
• gpl
• jpeg-jfif
• msoffice
• zip

First to get the image of the disk or partition

# dd if=/dev/daX of=IMG_DIR/daX.img

Then using magicrescue to rescue MS-Office and JPEG files

# magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d OUTPUT_DIR IMG_DIR/daX.img

[編輯] Using foremost

[編輯] Using gpart

[編輯] Reference

magicrescue