FreeBSD Data Rescue

出自KMU Wiki

(修訂版本間差異)

當前修訂版本

Using FreeBSD and Open-Source Tools to rescue data

在 FreeBSD 下使用搶救資料的工具

[編輯] UFS fsck -y failed

If fsck -y UFS failed

# fsck -y
...
UNKNOWN FILE TYPE I=8408063
UNEXPECTED SOFT UPDATE INCONSISTENCY
CLEAR? yes
fsck_4.2bsd: bad inode number 8408064 to nextinode

Try to mount UFS read-only

# mount -r /dev/daXs1d /mnt
# find /mnt -type f -and -size -1G -print > /root/T2
# tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"

If ls can not see any files or directories, you may try

/usr/ports/sysutils/ffs2recov
/usr/ports/sysutils/scan_ffs
/usr/ports/sysutils/sleuthkit
/usr/ports/sysutils/autopsy

Using autopsy

# autopsy localhost

using browser to connect http://localhost

add case -> add host -> add image -> ...

[編輯] Bad Partition Table

[編輯] Using testdisk to check and undelete partitions

Path: /usr/ports/sysutils/testdisk

Info: Tool to check and undelete partitions

WWW: https://www.cgsecurity.org/wiki/TestDisk

[編輯] Using magicrescue

/usr/ports/sysutils/magicrescue

magicrescue can rescue following file types (ls /usr/local/share/magicrescue/recipes/)

avi
flac
gzip
mp3-id3v1
perl
canon-cr2
gimp-xcf
jpeg-exif
mp3-id3v2
png
elf
gpl
jpeg-jfif
msoffice
zip

First to get the image of the disk or partition

# dd if=/dev/daX of=IMG_DIR/daX.img

Then using magicrescue to rescue MS-Office and JPEG files

# magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d OUTPUT_DIR IMG_DIR/daX.img

[編輯] Using foremost

[編輯] Using gpart

[編輯] Reference

magicrescue

取自"http://wiki.kmu.edu.tw/index.php/FreeBSD_Data_Rescue"

3個分類: 資訊處 | 圖書資訊處 | 資訊服務

 ==Bad Partition Table==
+===Using testdisk to check and undelete partitions===
+Path:   /usr/ports/sysutils/testdisk
+Info:   Tool to check and undelete partitions
+WWW:    https://www.cgsecurity.org/wiki/TestDisk
 ===Using magicrescue===
 [http://www.student.dtu.dk/~s042078/magicrescue/manpage.html magicrescue]
-[[Category:oit]] [[Category:資訊處]]
+[[Category:資訊處]] [[Category:圖書資訊處]] [[Category:資訊服務]]