Question

现在，我正在处理一个从其文件夹中消失的odt文件（不要问我原因）。

lucas@lucas-K55VD:~$ df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda4       91317328  72333904  14321716  84% /
none                   4         0         4   0% /sys/fs/cgroup
udev             1955444         4   1955440   1% /dev
tmpfs             393112      1212    391900   1% /run
none                5120         0      5120   0% /run/lock
none             1965552       276   1965276   1% /run/shm
none              102400        48    102352   1% /run/user
/dev/sda2      393654268 262304760 131349508  67% /media/lucas/F2DC2A2CDC29EC13

lucas@lucas-K55VD:~$ mkdir ~/Desktop/scalpel_recovered_files/

lucas@lucas-K55VD:~$ sudo scalpel /dev/sda4 -b -o ~/Desktop/scalpel_recovered_files/
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.
Aborting.

lucas@lucas-K55VD:~$

Answer 1

好的，我已设法恢复文件:) !!!!

对于那些感兴趣的人一步一步：

1.sudo apt-get install scalpel

2.您可能必须修改scalpel.conf文件，具体取决于您需要恢复的文件扩展名。所以在我的情况下，我添加到文件的末尾（我用nano编辑文件）：

#---------------------------------------------------------------------
# OPENOFFICE FILES
#---------------------------------------------------------------------
    odt y   20000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.textPK META-INF/manifest.xmlPK????????????????????
    ods y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.spreadsheetPK  META-INF/manifest.xmlPK????????????????????
    odp y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.presentationPK META-INF/manifest.xmlPK????????????????????
#    odg y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.graphicsPK META-INF/manifest.xmlPK????????????????????
#    odc y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.chartPK    META-INF/manifest.xmlPK????????????????????
#    odf y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.formulaPK  META-INF/manifest.xmlPK????????????????????
#    odi y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.imagePK    META-INF/manifest.xmlPK????????????????????
#    odm y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.text-masterPK  META-INF/manifest.xmlPK????????????????????
#    sxw y   10000000    PK????????????????????????????mimetypeapplication/vnd.sun.xml.writerPK  META-INF/manifest.xmlPK????????????????????

3.我的Ubuntu安装在/ dev / sda4分区上： sudo scalpel / dev / sda4 -b -o~ / Desktop / scalpel_recovered_files /

4.现在访问〜/ Desktop / scalpel_recovered_files /（我不得不使用sudo su）

5.您将看到audit.txt文件和另一堆文件夹是scalpel已经雕刻了他在扫描过程中找到的任何文件。

root@lucas-K55VD:/home/lucas/Desktop/scalpel_recovered_files# dir
audit.txt  odp-2-0  ods-1-0  odt-0-0

6.所以我打开我的odt-0-0并开始浏览odt文件。它们根据最新编号。浏览完前5个odt文件后，我找到了丢失的文件。

使用手术刀恢复odt文件

1 个答案: