Files deleted by mistake in Linux recovery (stuck everywhere, not verified)

12 Linux Recovery Tools

Computer crashes, hard disk crashes, and a huge amount of money is spent on an emergency protector ...... This is the dark side of computers.

The time has been walking like this, walking around, maybe some days back. It is meaningless to be so worried about the loss caused by computer damage. On the contrary, using the right tool will minimize the loss.

Do you accidentally delete your commemorative image? When installing a new system, delete partition tables? Cannot read data in the old CD? Don't worry ~ We will recommend some free system emergency tools to free you from your helplessness ~~ :>

You can use the Package Manager to install the following programs and search for the program name to install them. Let's just give a brief introduction. For details, refer to the various software introductions ~~

1. photorec-recover lost data from various crashed Media

You don't have to erase your hard disk data. An "RM" command may help you if it is improperly used ~~ Haha ~ The graphical environment is just a matter of fact, and you can restore the data you accidentally deleted. But how can I restore the holiday photos on my CF card?

 

 

Photorec: restores and deletes files about a week ago. It supports over 300 popular file formats, including ZIP, HTML, PDF, and jpg. No matter what file system, supports hard disk, USB, memory card, iPods, etc., can read data on fat, NTFS, ext2/3 and HFS + partition.

2. e2fscktools-check and correct the File System

This tool detects and fixes ext2, ext3, and ext4 file systems. For other file systems, you can use XFS _ repair, jfs_fsck, and fsck. resiserfs for detection and repair.

 

E2fsck: You can use e2fsck to mark the disk partition.

3. ntfsresize-Change the NTFS partition size.

Generally, mainstream Linux versions include this version, which helps you change the size of Windows 32-bit 64-bit partition. It can detect the error of the nifs partition and increase or decrease the file system.

4. fsarchiver-copy the entire Partition

An effective way to avoid disk damage is to do a good job.Backup. This tool can compress data and save space. Backup data is in read-only format.

5. chntpw-reset the Windows Password

If you forget the Windows Password, use the chntpw tool to reset the password.

6. sfdisk-backup partition table

If you install multiple systems, it is easy to cause confusion in partition tables. This tool is bound to various Linux Release versions and can be used to back up, edit, and restore partition tables.

 

Use sfdisk-D/dev/SDA> sda_table.txt to back up the partition table; sfdisk/dev/SDA <sda_table.txt to restore the partition table.
If raid is installed, use sfdisk-D/dev/SDA | sfdisk/dev/SDB to back up the partition table.

7. ddrescue-rebuilding damaged disk

Reading Errors often occur in older hard disks.

Use ddrescue to back up and destroy the disk, and then try to fix the backup.

8. Rsync-Remote Backup

You can use grsync for backup.

9. Gag-advanced boot program

If multiple systems are installed and MBR is easily damaged, you can switch to the gag boot program.

Install gag in the primary partition or logical partition to guide nine different operating systems. The configuration is simple.

 

Although it is a graphical interface, most operations still rely on the keyboard.

10. inquisitor-hard disk test

Test the hard disk from time to solve the problem early. Inquisitor live CD has many modules to test various things, such as hard disk, hard disk controller, USB, CPU, memory and so on.

11. chkrootkit-Detects rootkits

Use this tool to detect installation conditions with many well-known rootkits and scan intruders.

12. md5deep-search for lost files

If your system leaks, intruders may use malicious files instead of the original files. Use md5deep to record the system file hash directory. Use this tool to find the lost file through hash.

 

 

Restore deleted files in Linux

1. Restore the delete object operation in the ext3 File System: (1) Peter @ Peter-LAPTOP :~ $ Sudo ext3grep/dev/sdb1 -- ls -- inode 2 Query all deleted files in the/dev/sdb1 file system. The content is as follows: Runningext3grep version 0.10.1 warning: I don't know what ext3_feature_compat_ext_attr is. warning: ext3_feature_incompat_recover is set. this either means that yourpartition is still mounted, and/or the file system is in an uncleanstate. numberof groups: 16 loadinggroup metadata... done minimum/maximum journal block: 197095/205296 loadingjournal descriptors... sorting... done theoldest inode block that is still in the journal, appears to be from1280903562 = Wed Aug 4 14:32:42 2010 numberof descriptors in Journal: 55; min/MAX sequence numbers: 6/17 inodeis allocated records. stage2... done thefirst block of the directory is 610. inode2 is directory "". directoryblock 610 :. -- file type in dir_entry (r = regular file, D = directory, L = symlink) |. -- D: deleted; R: reallocated iindxnext | inode | deletion time mode file name ===============================+ -------------- data-from-inode ------ + ----------- + ========== 0 1 D 2 drwxr-XR-X. 1 2 D 2 drwxr-XR-x .. 2 end d 11 drwx ------ lost + found 3 end R 12 d 1280906562 Wed Aug 4 15:22:42 2010 rrw-r -- ABC 4 end D 69841 D 1280906556 Wed Aug 4 15:22:36 2010 drwxr-XR-x text (2) Peter @ Peter-LAPTOP :~ $ Sudo ext3grep/dev/sdb1 -- restore-file ABC # restore file name to ABC (3) Peter @ Peter-LAPTOP :~ $ Sudo ext3grep/dev/sdb1-restore-all # restore all deleted files and directories. Note: The recovered files or directories are stored in the restored_files directory of the current directory. 2. Restore the deleted files from the NTFS file system. Step 1: Install ntfsprogs Sudoapt-Get install ntfsprogs Step 2: unmount the NTFS partition of the accidentally deleted file Peter @ Peter-LAPTOP :~ $ Sudo umount/Media/ufdisk/ Step 3: view the files deleted in the last day Peter @ Peter-LAPTOP :~ $ Sudo ntfsundelete/dev/sdb1-T 1d Inode flags % age date size filename --------------------------------------------------------------- 16 F... 0% 2010-08-04 0 <none> 17 F... 0% 2010-08-04 0 <none> 18 F... 0% 2010-08-04 0 <none> 19 F... 0% 2010-08-04 0 <none> 20 F... 0% 2010-08-04 0 <none> 21 f... 0% 2010-08-04 0 <none> 22 f... 0% 2010-08-04 0 <none> 23 f... 0% 2010-08-04 0 <none> 68 FR .. 100% 2010-08-04 13 <none> Fileswith potentially recoverable content: 1 Step 4: Restore Files with inode 68 Peter @ Peter-LAPTOP :~ $ Sudo ntfsundelete/dev/sdb1-u-I 68-d test/ Inode flags % age date size filename --------------------------------------------------------------- 68 FR .. 0% 2010-08-04 13 <none> Undeleted '(null) 'successfully. Step 5: After successful recovery, the recovered file in this example is the test/unknow file. Is it correct.