Восстановление удаленных файлов

[dimas000]

говорят после формата ничего нельзя восстановить

сколько занимает форматирование многогигабайтного раздела? несколько секунд. отсюда вывод - фактически данные не уничтожаются, ну перетрется там таблица разделов в перовм секторе диска да n секторов в начале раздела. а восстановлялки могут работать, плюя на таблицу разделов или вообще без таковой...

[aventis]

слова.
по теме 0.
Хоть кто-нибудь, пошагово объяснит?
Какую программу поставить через центр приложений Ubuntu и что в ней делать?
Заранее благодарен.

[PbI6A]

Какую программу поставить через центр приложений Ubuntu и что в ней делать?

Ищешь по варезникам "Alkid boot cd", пишешь его на болванку и там в разделе меню "восстановление" находишь море восстанавливающего софта.

[dsma]

Вчера попробовал программу foremost и был приятно удивлен предложенным функционалом... но! Программа почему-то отказалась копировать в указанную папку найденные файлы. В чем может быть проблема?
Вот пример команды: sudo foremost -t ole -v -i /dev/sda -o /home/dsma/foremost
Вот пример найденных файлов -
Num    Name (bs=512)          Size    File Offset    Comment

*****0:   01047127.ole          51 KB      536129464    
************1:   03535103.ole          12 KB     1809972736    
2:   03535671.ole          12 KB     1810263552    
3:   03596447.xls           6 KB     1841380864    
4:   03596457.ole           3 KB     1841386048    
5:   03596503.doc           5 KB     1841409536    
Итог из терминала:
Finish: Thu Sep  9 12:19:37 2010
461 FILES EXTRACTED
ole:= 461
Папка /home/dsma/foremost полна папками с указанными типами, но все они пусты...
Ubuntu 10.4

[Alex_Tea]

Товарищи!

Что делать с foremost.conf, и какое он имеет значение в поиске?

Из него:

(Нажмите, чтобы показать/скрыть)

Foremost configuration file
#-------------------------------------------------------------------------
# Note the foremost configuration file is provided to support formats which
# don't have built-in extraction functions.  If the format is built-in to foremost
# simply run foremost with -t <suffix> and provide the format you wish to extract.
#
# The configuration file is used to control what types of files foremost
# searches for. A sample configuration file, foremost.conf, is included with
# this distribution. For each file type, the configuration file describes
# the file's extension, whether the header and footer are case sensitive,
# the maximum file size, and the header and footer for the file. The footer
# field is optional, but header, size, case sensitivity, and extension are
# not!
#
# Any line that begins with a '#' is considered a comment and ignored. Thus,
# to skip a file type just put a '#' at the beginning of that line
#

# Headers and footers are decoded before use. To specify a value in
# hexadecimal use \x[0-f][0-f], and for octal use \[0-3][0-7][0-7].  Spaces
# can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".
#
# To match any single character (aka a wildcard) use a '?'. If you need to
# search for the '?' character, you will need to change the 'wildcard' line
# *and* every occurrence of the old wildcard character in the configuration
# file. Don't forget those hex and octal values! '?' is equal to 0x3f and
# \063.
#
# If you would like to extract files without an extension enter the value
# "NONE" in the extension column (note: you can change the value of this
# "no suffix" flag by setting the variable FOREMOST_NOEXTENSION_SUFFIX
# in foremost.h and recompiling).
#
# The ASCII option will extract all ASCII printable characters before and after
# the keyword provided.
#
# The NEXT keyword after a footer instructs foremost to search forwards for data
# that starts with the header provided and terminates or is followed by data in
# the footer -- the footer data is not included in the output.  The data in the
# footer, when used with the NEXT keyword effectively allows you to search for
# data that you know for sure should not be in the output file.  This method for
# example, lets you search for two 'starting' headers in a document that doesn't
# have a good ending footer and you can't say exactly what the footer is, but
# you know if you see another header, that should end the search and an output
# file should be written.

# To redefine the wildcard character, change the setting below and all
# occurances in the formost.conf file.
#
#wildcard  ?
#
#        case    size    header            footer
#extension   sensitive   

Так, судя по первому абзацу, мне не надо ничего в конфиге прописывать, если я ищу "встроенные" в формост форматы (в частности, мне нужен avi)?
Или всё-таки должен? А тогда как? Создавать отдельный конфиг? Неясно.
Больше всего интересует ограничение файла по размеру. По умолчанию оно стоит или нет?

[Mister-X]

установил foremost, в терминале набрал sudo foremost. Стал происходить какой то процесс, который, как мне показалось, застопорился... Я закрыл терминал пренебрегая предупреждением о выполнении процесса. На следующий день, включив компьютер, я обнаружил, что диск D (NTFS) перестал определяться системой... Не определяется ни линуксом, ни окнами... Вопрос в следующем - мог ли foremost сотворить что-то плохое с моим диском???

[73]

У меня Ubuntu Desktop 9.04, /dev/sdb1/ или  /media/disk0/ это флешка FAT16
/dev/sda6/ - файл. cистема ext3 c файлами , монтируется в корень /

Подскажите, что нужно  еще foremost для того, чтобы он начал работать?
Хочу восстановить некоторые удаленные файлы.
Программа ожидает ввод.

Код: [Выделить]

sudo foremost -T -t gif -v -i /dev/sdb1/ -o /media/disk0/empty/ -c /usr/local/etc/foremost.conf


(Нажмите, чтобы показать/скрыть)

Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus

Audit File

Foremost started at Sat Mar  5 00:12:57 2011

Invocation: foremost -T -t gif -v -i /dev/sdb1/ -o /media/disk0/empty/ -c /usr/local/etc/foremost.conf

Output directory: /media/disk0/empty_Sat_Mar__5_00_12_57_2011

Configuration file: /usr/local/etc/foremost.conf

Processing: stdin

|------------------------------------------------------------------

File: stdin

Start: Sat Mar  5 00:12:57 2011

Length: Unknown

 

Num    Name (bs=512)          Size    File Offset    Comment

Попробовал
ext3grep
в man написано
  Restoring all files from the ext3 partition/file /backup/sda1:

       ext3grep --restore-all /backup/sda1

получил

Код: [Выделить]

vl@vl-desktop:~$ sudo ext3grep --restore-all /dev/sda6


(Нажмите, чтобы показать/скрыть)

Running ext3grep version 0.10.1

WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.

WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state.

Number of groups: 884

Minimum / maximum journal block: 14418434 / 14451749

Loading journal descriptors... sorting... done

The oldest inode block that is still in the journal, appears to be from 1299239151 = Fri Mar  4 13:45:51 2011

Journal transaction 597177 wraps around, some data blocks might have been lost of this transaction.

Number of descriptors in journal: 29972; min / max sequence numbers: 595055 / 598351

Writing output to directory RESTORED_FILES/

Finding all blocks that might be directories.

D: block containing directory start, d: block containing more directory entries.

Each plus represents a directory start that references the same inode as a directory start that we found previously.



Searching group 0: DDdd

Searching group 1: ddd

Searching group 2: dddddddddd

Searching group 3: d

Searching group 4:

Searching group 5:

Searching group 6:

Searching group 7:

Searching group 8:

Searching group 9:

Searching group 10:

…..........
WARNING: extended directory at 14160392 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  179873 (76 times)

  183253 (1 time)

  253457 (1 time)

Could not find an inode for extended directory at 14160392, disregarding it's contents.

Could not find an inode for extended directory at 14161952, disregarding it's contents.

Could not find an inode for extended directory at 14161953, disregarding it's contents.

Cannot find a directory block for inode 183678.

Cannot find a directory block for inode 2843767.

WARNING: extended directory at 14165291 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  179873 (76 times)

  183253 (1 time)

  253457 (1 time)

Could not find an inode for extended directory at 14165291, disregarding it's contents.

Cannot find a directory block for inode 183712.

WARNING: extended directory at 14165297 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  179873 (61 times)

  260317 (1 time)

Could not find an inode for extended directory at 14165297, disregarding it's contents.

Cannot find a directory block for inode 183678.

Cannot find a directory block for inode 2843767.

WARNING: extended directory at 14165307 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  179873 (76 times)

  183253 (1 time)

  253457 (1 time)

Could not find an inode for extended directory at 14165307, disregarding it's contents.

Cannot find a directory block for inode 183712.

WARNING: extended directory at 14165309 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  179873 (61 times)

  260317 (1 time)


Could not find an inode for extended directory at 14405998, disregarding it's contents.

WARNING: extended directory at 14406407 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  150758 (65 times)

  182913 (1 time)

Could not find an inode for extended directory at 14406407, disregarding it's contents.

WARNING: extended directory at 14406408 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  150758 (57 times)

  182912 (1 time)

Could not find an inode for extended directory at 14406408, disregarding it's contents.

Extended directory at 14406409 belongs to inode 150758 (from 62 linked directories).

Extended directory at 14406410 belongs to inode 150758 (from 60 linked directories).

WARNING: extended directory at 14406411 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  150758 (66 times)

  182928 (1 time)


Could not find an inode for extended directory at 14421815, disregarding it's contents.

Cannot find a directory block for inode 3885730.

WARNING: extended directory at 14421827 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  3858767 (6 times)

  3858915 (3 times)

  3923969 (1 time)

Could not find an inode for extended directory at 14421827, disregarding it's contents.

Cannot find a directory block for inode 4039180.

Cannot find a directory block for inode 4039178.

WARNING: extended directory at 14421843 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  3858610 (1 time)

  3858767 (3 times)

  3858915 (2 times)

Could not find an inode for extended directory at 14421843, disregarding it's contents.

Could not find an inode for extended directory at 14421844, disregarding it's contents.

Cannot find a directory block for inode 4039160.

Cannot find a directory block for inode 4039195.

Cannot find a directory block for inode 4039165.

Cannot find a directory block for inode 4039157.

Cannot find a directory block for inode 4039155.

WARNING: extended directory at 14421853 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  3858572 (1 time)

  3858610 (3 times)

  3858767 (1 time)

  3858915 (2 times)

Could not find an inode for extended directory at 14421853, disregarding it's contents.

Could not find an inode for extended directory at 14421854, disregarding it's contents.

Cannot find a directory block for inode 4039176.

Extended directory at 14421856 belongs to inode 3858767 (from 2 unlinked directories).

Could not find an inode for extended directory at 14421857, disregarding it's contents.

Cannot find a directory block for inode 4039166.

Cannot find a directory block for inode 4039190.

Cannot find a directory block for inode 4039162.

Could not find an inode for extended directory at 14421859, disregarding it's contents.

Could not find an inode for extended directory at 14421860, disregarding it's contents.

Cannot find a directory block for inode 4039182.

Cannot find a directory block for inode 4039174.

Cannot find a directory block for inode 4039163.

Cannot find a directory block for inode 4039156.

Extended directory at 14421862 belongs to inode 3858767 (from 2 unlinked directories).

Could not find an inode for extended directory at 14421863, disregarding it's contents.

Could not find an inode for extended directory at 14421877, disregarding it's contents.

Could not find an inode for extended directory at 14421887, disregarding it's contents.

Cannot find a directory block for inode 4039177.

Cannot find a directory block for inode 4039159.

Cannot find a directory block for inode 4039158.

Extended directory at 14421888 belongs to inode 3858767 (from 3 unlinked directories).

Could not find an inode for extended directory at 14421889, disregarding it's contents.

Cannot find a directory block for inode 4039157.

Cannot find a directory block for inode 4039168.

Cannot find a directory block for inode 4039157.

Cannot find a directory block for inode 4039161.

Extended directory at 14421893 belongs to inode 3858767 (from 3 unlinked directories).

Could not find an inode for extended directory at 14421894, disregarding it's contents.

Could not find an inode for extended directory at 14421895, disregarding it's contents.

Cannot find a directory block for inode 3885733.

Cannot find a directory block for inode 4039172.

Cannot find a directory block for inode 4039196.

WARNING: extended directory at 14421896 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  3858600 (1 time)

  3858767 (2 times)

Could not find an inode for extended directory at 14421896, disregarding it's contents.

Cannot find a directory block for inode 4039164.

Cannot find a directory block for inode 4039199.

WARNING: extended directory at 14421897 has entries that appear to be directories, but their parent directory inode is not consistent! I can't make this decision for you. You will have to manually pick an inode for this block number. The inodes that I found are (although ALL could be wrong):

  3858609 (1 time)

  3858610 (2 times)

  3858915 (1 time)

Could not find an inode for extended directory at 14421897, disregarding it's contents.

Extended directory at 14421976 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422000 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422109 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422308 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422458 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422482 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422663 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422700 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422708 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422731 belongs to inode 3631003 (from 24 linked directories).

Extended directory at 14422770 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422796 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422827 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422837 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422884 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422918 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14422929 belongs to inode 3631003 (from 25 linked directories).

Could not find an inode for extended directory at 14422957, disregarding it's contents.

Could not find an inode for extended directory at 14422961, disregarding it's contents.

Could not find an inode for extended directory at 14422964, disregarding it's contents.

Extended directory at 14422996 belongs to inode 3631003 (from 26 linked directories).

Extended directory at 14423005 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14423007 belongs to inode 3631003 (from 26 linked directories).

Extended directory at 14423090 belongs to inode 3631003 (from 25 linked directories).

Could not find an inode for extended directory at 14423130, disregarding it's contents.

Could not find an inode for extended directory at 14423137, disregarding it's contents.

Could not find an inode for extended directory at 14423138, disregarding it's contents.

Extended directory at 14423152 belongs to inode 3631003 (from 26 linked directories).

Extended directory at 14423169 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14423171 belongs to inode 3631003 (from 26 linked directories).

Extended directory at 14423419 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14423450 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14423466 belongs to inode 3631003 (from 27 linked directories).

Extended directory at 14423479 belongs to inode 3631003 (from 25 linked directories).

Extended directory at 14423480 belongs to inode 3631003 (from 27 linked directories).

Could not find an inode for extended directory at 14423642, disregarding it's contents.

Could not find an inode for extended directory at 14423646, disregarding it's contents.

Could not find an inode for extended directory at 14423649, disregarding it's contents.

Segmentation fault

Директория RESTORED_FILES в моей домашней папке создается, но она пуста.
Что не так?

[gaudin]

http://linuxopen.ru/2010/01/19/obzor-programm-vosstanovlenija.html

[Vitsliputsli]

Вы что, восстанавливаете файлы с примонтированного раздела, да еще и системного, да еще и на тот же самый раздел?..

[Иной]

foremost восстанавливает очень даже результативно (Ubuntu 10.04, ext4).
следует помнить:
1-для складирования восстановленных файлов надо указывать пустую папку
2-файлы видно только из-под рута (для обычного пользователя папка выглядит пустой) - надо после сделать chmod
3-файлы ODT восстанавливаются замечательно, лежат в виде zip-архивов (ищем по характерной структуре архива, архив открываем затем в libreoffice)

 man foremost читать обязательно

[PbI6A]

Не восстанавливает .bz2 и .7z То есть основные пользовательские архивы с важными вещами не восстановить

[CuJIbBEP]

Что то этот foremost вообще ничего не восстанавливает...
Нечаянно удалил папку с фильмами с диска с ext3 указал ему откуда куда восстанавливать и процесс длился 12 часов (ну в той папке было достаточно много фильмов) и в итоге ничего нету....
Вот часть лога в конце привожу:

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]


foundat=TWIMC/TWIMC.xmlUT
9255: 487848586.zip      67 KB 249778476032
foundat=BlockList.xmlUT
foundat=H1B/UT
foundat=H1B/Pictures/UT
foundat=H1B/Pictures/2000001B00000CD200000CED63AA5866.svmUT
foundat=H1B/content.xmlUT
foundat=H1B/styles.xmlUT
foundat=H1C/UT
foundat=H1C/content.xmlUT
foundat=H1C/styles.xmlUT
foundat=H1N/UT
foundat=H1N/content.xmlUT
foundat=H1N/styles.xmlUT
foundat=HB/UT
foundat=HB/Pictures/UT
foundat=HB/Pictures/2000001B00000CD200000CED63AA5866.svmUT
foundat=HB/content.xmlUT
foundat=HB/styles.xmlUT
foundat=HC/UT
foundat=HC/content.xmlUT
foundat=HC/styles.xmlUT
foundat=HLB/UT
foundat=HLB/content.xmlUT
foundat=HLB/styles.xmlUT
foundat=HLC/UT
foundat=HLC/content.xmlUT
foundat=HLC/styles.xmlUT
foundat=HLN/UT
foundat=HLN/content.xmlUT
foundat=HLN/styles.xmlUT
foundat=HN/UT
foundat=HN/content.xmlUT
foundat=HN/styles.xmlUT
foundat=HRB/UT
foundat=HRB/Pictures/UT
foundat=HRB/Pictures/2000001B00000CD200000CED63AA5866.svmUT
foundat=HRB/content.xmlUT
foundat=HRB/styles.xmlUT
foundat=HRC/UT
foundat=HRC/content.xmlUT
foundat=HRC/styles.xmlUT
foundat=HRN/UT
foundat=HRN/content.xmlUT
foundat=HRN/styles.xmlUT
foundat=META-INF/UT
foundat=META-INF/manifest.xmlUT
foundat=mimetypeUT
foundat=PT1/UT
foundat=PT1/content.xmlUT
foundat=PT1/styles.xmlUT
foundat=PT2/UT
foundat=PT2/content.xmlUT
foundat=PT2/styles.xmlUT
9256: 487848722.zip      52 KB 249778545664
***|
Finish: Tue May 31 22:48:12 2011

9257 FILES EXTRACTED

jpg:= 9
gif:= 378
rif:= 18
htm:= 176
ole:= 3
zip:= 63
exe:= 5
png:= 8605
------------------------------------------------------------------

Foremost finished at Tue May 31 22:48:12 2011
silver@silver-U:~$ 62;9;c

Он вроде как закончил но видео в списке восстановленных файлов нет так же...
Давал такую команду:

Код: [Выделить]

sudo foremost -v -i /dev/sdc -o /madia/2Tb
Скальпель тоже ерунду выдает:

Код: [Выделить]

silver@silver-U:~$ sudo scalpel /dev/sdc -o /madia/2Tb
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.
Aborting.

[dimas000]

ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.

английским языком тебе говорят, что выходная папка пустой должна быть