我删除了 4TB 磁盘上的所有文件/dev/sdb1
。这是通过rsync --delete
命令完成的。
在停止之前,rsync 写入了大约 10GB 的数据。
当然磁盘上没有快照。
文件btrfs
系统已挂载到该/home/user/Downloads
文件夹。
所以我想知道是否有办法恢复数据。
到目前为止(卸载磁盘后)我已经尝试过:
- btrfs 恢复:
btrfs restore -i /dev/sdb1 /mnt/RESTORE/
其中只恢复了 10GB 的新文件。
- 我设法使其工作的
btrfs-undelete 脚本:
./btrfs.sh /dev/sdb1 /home/user/Downloads/* /mnt/RESTORE/
结果 :
[...]
Trying root 3001138823168... (1096/1103)
Trying root 853360640... (1097/1103)
Trying root 50626560... (1098/1103)
Trying root 31309824... (1099/1103)
Trying root 31129600... (1100/1103)
Trying root 30900224... (1101/1103)
Trying root 30818304... (1102/1103)
Trying root 30408704... (1103/1103)
Didn't find 'home/user/D*/*
- 我还尝试使用以下方法手动恢复文件
btrfs restore -t 3001556484096 /dev/sdb1 /mnt/RESTORE/
:
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1
Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1
Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1
Couldn't read tree root
Could not open root, trying backup super
btrfs-find-root -a /dev/sdb1
输出 :
Superblock thinks the generation is 96918
Superblock thinks the level is 1
[...]
Well block 3001381945344(gen: 94646 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 3001359089664(gen: 94635 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 853360640(gen: 94238 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
btrfs rescue super-recover -v /dev/sdb1
输出 :
All Devices:
Device: id = 1, name = /dev/sdb1
Before Recovering:
[All good supers]:
device name = /dev/sdb1
superblock bytenr = 65536
device name = /dev/sdb1
superblock bytenr = 67108864
device name = /dev/sdb1
superblock bytenr = 274877906944
[All bad supers]:
All supers are valid, no need to recover
所以任何帮助将不胜感激:)
更新 1:
不幸的是,我只能恢复少数损坏的文件。这是我在btrfs-undelete 脚本之后所做的。
- 将每个 ID 获取到
/tmp/ID
文件中:
btrfs-find-root -a /dev/sdb1 2>&1 | grep ^Well | sed -r -e 's/Well block ([0-9]+).*/\1/' | sort -rn > /tmp/ID
- 从 ID 恢复我能做的一切:
for i in $(cat /tmp/ID) ; do mkdir /mnt/RESTORE/"$i"; btrfs restore -o -iv -t "$i" /dev/sdb1 /mnt/RESTORE/"$i" 2>&1; done
我想现在唯一的办法就是找一个文件恢复软件...
如前所述,我最终使用了文件恢复软件。我尝试了EaseUS Data Recovery Wizard和UFS Explorer Standard Recovery v9.13,因为它们都应该与btrfs兼容。
我们可以免费试用这两种软件(在此模式下只有扫描可用,这使我们可以查看是否可以恢复某些东西)。
根据我的经验,UFS Explorer是更好的解决方案。事实上,在扫描之后,它能够列出已删除文件的原始名称和目录树。
EaseUS Data Recovery Wizard能够恢复文件,但大多数文件没有正确命名,并且不尊重原始目录组织。
因此,对我来说最好的解决方案是UFS Explorer Standard Recovery。个人执照的费用约为70 美元:
https://www.ufsexplorer.com/ufs-explorer-standard-recovery/