LINUX.ORG.RU

восстановление удаленных файлов в ФС ext3


0

2

У меня Ubuntu Desktop 9.04, /dev/sdb1/ или /media/disk0/ это флешка FAT16
/dev/sda6/ - файл. cистема ext3 c файлами , монтируется в корень /

Подскажите, что нужно еще foremost для того, чтобы он начал работать?
Хочу восстановить некоторые удаленные файлы.
Программа ожидает ввод.
sudo foremost -T -t gif -v -i /dev/sdb1/ -o /media/disk0/empty/ -c /usr/local/etc/foremost.conf


Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus

Audit File



Foremost started at Sat Mar 5 00:12:57 2011

Invocation: foremost -T -t gif -v -i /dev/sdb1/ -o /media/disk0/empty/ -c /usr/local/etc/foremost.conf

Output directory: /media/disk0/empty_Sat_Mar__5_00_12_57_2011

Configuration file: /usr/local/etc/foremost.conf

Processing: stdin

|------------------------------------------------------------------

File: stdin

Start: Sat Mar 5 00:12:57 2011

Length: Unknown



Num    Name (bs=512)    Size    File Offset    Comment




******----------*

Попробовал
ext3grep
в man написано
Restoring all files from the ext3 partition/file /backup/sda1:

ext3grep --restore-all /backup/sda1

получил

vl@vl-desktop:~$ sudo ext3grep --restore-all /dev/sda6


Running ext3grep version 0.10.1

WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.

Number of groups: 884

Minimum / maximum journal block: 14418434 / 14451749

Loading journal descriptors... sorting... done

The oldest inode block that is still in the journal, appears to be from 1299239151 = Fri Mar 4 13:45:51 2011

Journal transaction 597177 wraps around, some data blocks might have been lost of this transaction.

Number of descriptors in journal: 29972; min / max sequence numbers: 595055 / 598351

Writing output to directory RESTORED_FILES/

Finding all blocks that might be directories.

D: block containing directory start, d: block containing more directory entries.

Each plus represents a directory start that references the same inode as a directory start that we found previously.



Searching group 0: DDdd

Searching group 1: ddd

Searching group 2: dddddddddd

Searching group 3: d

Searching group 4:

Searching group 5:

Searching group 6:

Searching group 7:

Searching group 8:

Searching group 9:

Searching group 10:

…..........
WARNING: extended directory at 14160392 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

179873 (76 times)

183253 (1 time)

253457 (1 time)

Could not find an inode for extended directory at 14160392, disregarding it's contents.

Could not find an inode for extended directory at 14161952, disregarding it's contents.

Could not find an inode for extended directory at 14161953, disregarding it's contents.

Cannot find a directory block for inode 183678.

Cannot find a directory block for inode 2843767.

WARNING: extended directory at 14165291 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

179873 (76 times)

183253 (1 time)

253457 (1 time)

Could not find an inode for extended directory at 14165291, disregarding it's contents.

Cannot find a directory block for inode 183712.

WARNING: extended directory at 14165297 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

179873 (61 times)

260317 (1 time)

Could not find an inode for extended directory at 14165297, disregarding it's contents.

Cannot find a directory block for inode 183678.

Cannot find a directory block for inode 2843767.

WARNING: extended directory at 14165307 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

179873 (76 times)

183253 (1 time)

253457 (1 time)

Could not find an inode for extended directory at 14165307, disregarding it's contents.

Cannot find a directory block for inode 183712.

WARNING: extended directory at 14165309 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

Cannot find a directory block for inode 4039155.

WARNING: extended directory at 14421853 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

3858572 (1 time)

3858610 (3 times)

3858767 (1 time)

3858915 (2 times)

Could not find an inode for extended directory at 14423642, disregarding it's contents.

Could not find an inode for extended directory at 14423646, disregarding it's contents.

Could not find an inode for extended directory at 14423649, disregarding it's contents.

Segmentation fault


Директория RESTORED_FILES в моей домашней папке создается, но она пуста.
Что не так?


> /dev/sda6/ - файл. cистема ext3 c файлами , монтируется в корень /
Запустите photorec/foremost/ext3grep с livecd, например, http://sysresccd.org/

AITap ★★★★★
()

> У меня Ubuntu Desktop 9.04, /dev/sdb1/ или /media/disk0/ это флешка FAT16

/dev/sda6/ - файл. cистема ext3 c файлами , монтируется в корень /

sdb1 раньше была ext3 или я чего-то не понимаю? Файлы были удалены или раздел отфарматирован (в этом случае можно testdisk).

Если ваше религиозное чувство допустит, можно попробовать `r-studio'.

n01r ★★
()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.