FreeBSD Data Rescue

出自KMU Wiki

(修訂版本間差異)
跳轉到: 導航, 搜索
在2009年6月22日 (一) 10:16所做的修訂版本 (編輯)
Cch (對話 | 貢獻)
(MSDOSFS/NTFS)
←上一個
當前修訂版本 (2018年10月30日 (二) 09:27) (編輯) (撤銷)
Cch (對話 | 貢獻)

 
(15個中途的修訂版本沒有顯示。)
第1行: 第1行:
-FreeBSD 利用自由軟體搶救檔案 +Using FreeBSD and Open-Source Tools to rescue data
-==FreeBSD UFS==+FreeBSD 下使用搶救資料的工具
- fsck -y+==UFS fsck -y failed==
- UNKNOWN FILE TYPE I=8408063+If fsck -y UFS failed
- UNEXPECTED SOFT UPDATE INCONSISTENCY+
- CLEAR? yes+
- fsck_4.2bsd: bad inode number 8408064 to nextinode+
- mount -r+<pre>
- find home -type f -and -size -1G -print > /root/T2+# fsck -y
- tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"+...
 +UNKNOWN FILE TYPE I=8408063
 +UNEXPECTED SOFT UPDATE INCONSISTENCY
 +CLEAR? yes
 +fsck_4.2bsd: bad inode number 8408064 to nextinode
 +</pre>
-萬一檔案系統 ls 時已無任何檔案或目錄,則可再試試幾個工具程式+Try to mount UFS read-only
 + 
 +<pre>
 +# mount -r /dev/daXs1d /mnt
 +# find /mnt -type f -and -size -1G -print > /root/T2
 +# tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"
 +</pre>
 + 
 +If ls can not see any files or directories, you may try
* /usr/ports/sysutils/ffs2recov * /usr/ports/sysutils/ffs2recov
第21行: 第31行:
* /usr/ports/sysutils/autopsy * /usr/ports/sysutils/autopsy
- e.g. 使用 autopsy+Using autopsy
- sudo autopsy localhost+<pre>
- add case -> add host -> add image -> ...+# autopsy localhost
 +using browser to connect http://localhost
-==MSDOSFS/NTFS==+add case -> add host -> add image -> ...
 +</pre>
-Partition Table 壞了或重新分割後想找回原分割區下的檔案+==Bad Partition Table==
 + 
 +===Using testdisk to check and undelete partitions===
 + 
 +Path: /usr/ports/sysutils/testdisk
 + 
 +Info: Tool to check and undelete partitions
 + 
 +WWW: https://www.cgsecurity.org/wiki/TestDisk
 + 
 + 
 +===Using magicrescue===
/usr/ports/sysutils/magicrescue /usr/ports/sysutils/magicrescue
-magicrescue 可救的檔案類型有 (ls /usr/local/share/magicrescue/recipes/)+magicrescue can rescue following file types (ls /usr/local/share/magicrescue/recipes/)
 + 
 +* avi
 +* flac
 +* gzip
 +* mp3-id3v1
 +* perl
 +* canon-cr2
 +* gimp-xcf
 +* jpeg-exif
 +* mp3-id3v2
 +* png
 +* elf
 +* gpl
 +* jpeg-jfif
 +* msoffice
 +* zip
 + 
 +<pre>
 +First to get the image of the disk or partition
 + 
 +# dd if=/dev/daX of=IMG_DIR/daX.img
-avi flac gzip mp3-id3v1 perl +Then using magicrescue to rescue MS-Office and JPEG files
-canon-cr2 gimp-xcf jpeg-exif mp3-id3v2 png +
-elf gpl jpeg-jfif msoffice zip+
- e.g.+# magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d OUTPUT_DIR IMG_DIR/daX.img
- 將欲搶救的硬碟拆下,用 USB-to-ATA/SATA 轉接器+</pre>
- magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d ~/output /dev/da0+
- 或 (避免多次讀取 /dev/da0)+
- dd if=/dev/da0 of=/big/da0img+
- magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d ~/output /big/da0img+
-參考資料︰+===Using foremost===
-http://www.student.dtu.dk/~s042078/magicrescue/manpage.html+===Using gpart===
-參考資料中有提到︰+==Reference==
-Partition Table 不見了,可考據用 gpart 重建+[http://www.student.dtu.dk/~s042078/magicrescue/manpage.html magicrescue]
-foremost (/usr/ports/sysutils/foremost) 認識更多類型的檔案,但判斷檔案實際大小的能力較弱。+[[Category:資訊處]] [[Category:圖書資訊處]] [[Category:資訊服務]]

當前修訂版本

Using FreeBSD and Open-Source Tools to rescue data

在 FreeBSD 下使用搶救資料的工具

目錄

[編輯] UFS fsck -y failed

If fsck -y UFS failed

# fsck -y
...
UNKNOWN FILE TYPE I=8408063
UNEXPECTED SOFT UPDATE INCONSISTENCY
CLEAR? yes
fsck_4.2bsd: bad inode number 8408064 to nextinode

Try to mount UFS read-only

# mount -r /dev/daXs1d /mnt
# find /mnt -type f -and -size -1G -print > /root/T2
# tar -T /root/T2 -cf - | ssh admin@bak "cat > host-home.tar"

If ls can not see any files or directories, you may try

  • /usr/ports/sysutils/ffs2recov
  • /usr/ports/sysutils/scan_ffs
  • /usr/ports/sysutils/sleuthkit
  • /usr/ports/sysutils/autopsy

Using autopsy

# autopsy localhost

using browser to connect http://localhost

add case -> add host -> add image -> ...

[編輯] Bad Partition Table

[編輯] Using testdisk to check and undelete partitions

Path: /usr/ports/sysutils/testdisk

Info: Tool to check and undelete partitions

WWW: https://www.cgsecurity.org/wiki/TestDisk


[編輯] Using magicrescue

/usr/ports/sysutils/magicrescue

magicrescue can rescue following file types (ls /usr/local/share/magicrescue/recipes/)

  • avi
  • flac
  • gzip
  • mp3-id3v1
  • perl
  • canon-cr2
  • gimp-xcf
  • jpeg-exif
  • mp3-id3v2
  • png
  • elf
  • gpl
  • jpeg-jfif
  • msoffice
  • zip
First to get the image of the disk or partition

# dd if=/dev/daX of=IMG_DIR/daX.img

Then using magicrescue to rescue MS-Office and JPEG files

# magicrescue -r msoffice -r jpeg-jfif -r jpeg-exif -d OUTPUT_DIR IMG_DIR/daX.img

[編輯] Using foremost

[編輯] Using gpart

[編輯] Reference

magicrescue