使用 Linux 文件恢复工具.pdfVIP

Linux rm -rf Linux inode Ubuntu 12.04 foremost extundeletetestdisk phtorec Linux Linux inode block Linux inodeinode inode blockblock inode inode inode linux ls – id inode ”root” inode 2, ”root” inode 2 1. # mount /dev/sdb2 /tmp 2. # ls -id /tmp 3. 2 /tmp inode 2 ext3 ext4 inode inode inode inode ext3 ext4 metadata metadata inode inode inode inode foremost extundelete formost data carvubgformost ddSafeback Encase formost formost Air Force Office of Special InvestigationsThe Center for Information Systems Security Studies and Research GPL Foremost avi, bmp, dll, doc, exe, gif, htm, jar, jpg, mbd, mov, mpg, pdf, png, ppt, rar, rif, sdw, sx, sxc, sxi, sxw, vis, wav, wmv, xls, zip Linux ext Linux debugfs ext3grepextundelete extundelete ext3ext4 / 0.2.0 foremost extundelete foremost ext2 ext3 vfatNTFSufsjfs extundelete ext3ext4 foremost foremost 1. #apt-get install foremost Linux / USB /dev/sdba1 png formost 1. #rm -f /dev/sdb1/photo1.png 2. #foremost -t png -i /dev/sdb1 output output png png png png output audit.txt 1. #foremost -v -T -t doc,pdf,jpg,gif -i /dev/sda6 -o /media/disk/Recove r output output /doc,/pdf,/jpg,/gif output audit.txt extundelete 1. #apt-get install extundelete Linux / extundelete e2fsprogs e2fslibs /dev/sdd1 /backupdate /delete del1.txt 1. # mkdir –p /backupdate/deldate 2. # mkfs.ext4 /dev/sdd1 3. # mount /dev/sdd1 /backupdate 4. #cd /backupdate/deldate 5. # touch del1.txt 6. # echo test 1 del1.txt 1. # md5sum del1.txt 2. 66fb6627dba4549db3224d del1.txt 1. # rm -fr /backupdate/*