主页 / unix / 问题 / 789970
Accepted
Fravadona
Asked: 2025-01-22 17:27:35 +0800 CST

在 Linux 上执行 `wipefs` 后恢复已删除的字节

  • 772

重新安装 Linux 机器后，我无意中wipefs -a在安装程序 pendrive 上运行了：

$ wipefs -a /dev/sd?
/dev/sda: 8 bytes were erased at offset 0x00010040 (btrfs): 5f 42 48 52 66 53 5f 4d
/dev/sdb: 8 bytes were erased at offset 0x00010040 (btrfs): 5f 42 48 52 66 53 5f 4d
...
/dev/sdw: 8 bytes were erased at offset 0x00010040 (btrfs): 5f 42 48 52 66 53 5f 4d
/dev/sdx: 8 bytes were erased at offset 0x00010040 (btrfs): 5f 42 48 52 66 53 5f 4d
/dev/sdy: 5 bytes were erased at offset 0x00008001 (iso9660): 43 44 30 30 31
/dev/sdy: 2 bytes were erased at offset 0x000001fe (dos): 55 aa
/dev/sdy: 8 bytes were erased at offset 0x00000200 (gpt): 45 46 49 20 50 41 52 54
/dev/sdy: calling ioctl to re-read partition table: Success

由于wipefs输出包含偏移量和已删除字节的内容，因此似乎可以恢复/dev/sdy。您将如何做？

linux

1 个回答

  1. Best Answer

    首先，在再次触摸受影响区域之前，请先复制该区域/dev/sdy：

    dd if=/dev/sdy bs=65536 count=1 of=sdy.back

    然后，恢复原始数据：

    printf '\x55\xaa\x45\x46\x49\x20\x50\x41\x52\x54' | dd bs=1 seek=$((16#1fe)) of=/dev/sdy
printf '\x43\x44\x30\x30\x31' | dd bs=1 seek=$((16#8001)) of=/dev/sdy

    （如果需要可以sudo在前面添加dd）。0x200 紧跟在 0x1FE 处的两个字节之后，因此可以一次性写入十个字节。

    • 6

相关问题