ubuntu - 使用手术刀恢复 odt 文件

Question

现在，我正在处理一个从其文件夹中消失的 odt 文件(不要问我为什么)。

~$ df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda4       91317328  72333904  14321716  84% /
none                   4         0         4   0% /sys/fs/cgroup
udev             1955444         4   1955440   1% /dev
tmpfs             393112      1212    391900   1% /run
none                5120         0      5120   0% /run/lock
none             1965552       276   1965276   1% /run/shm
none              102400        48    102352   1% /run/user
/dev/sda2      393654268 262304760 131349508  67% /media/lucas/F2DC2A2CDC29EC13

~$ mkdir ~/Desktop/scalpel_recovered_files/

~$ sudo scalpel /dev/sda4 -b -o ~/Desktop/scalpel_recovered_files/
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.
Aborting.

~$ 

Answer 1

好的，我已经设法恢复文件:) !!!!
对于那些有兴趣的人一步一步:
1.sudo apt-get 安装手术刀
2.您可能需要根据您需要恢复的文件扩展名修改scanpel.conf 文件。所以在我的情况下，我添加到文件的末尾(我使用 nano 来编辑文件):

#---------------------------------------------------------------------
# OPENOFFICE FILES
#---------------------------------------------------------------------
    odt y   20000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.textPK META-INF/manifest.xmlPK????????????????????
    ods y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.spreadsheetPK  META-INF/manifest.xmlPK????????????????????
    odp y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.presentationPK META-INF/manifest.xmlPK????????????????????
#    odg y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.graphicsPK META-INF/manifest.xmlPK????????????????????
#    odc y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.chartPK    META-INF/manifest.xmlPK????????????????????
#    odf y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.formulaPK  META-INF/manifest.xmlPK????????????????????
#    odi y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.imagePK    META-INF/manifest.xmlPK????????????????????
#    odm y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.text-masterPK  META-INF/manifest.xmlPK????????????????????
#    sxw y   10000000    PK????????????????????????????mimetypeapplication/vnd.sun.xml.writerPK  META-INF/manifest.xmlPK????????????????????

3.我的 Ubuntu 安装在/dev/sda4 分区:
sudo 手术刀/dev/sda4 -b -o ~/Desktop/scalpel_recovered_files/
4.现在访问~/Desktop/scalpel_recovered_files/(我不得不使用sudo su)
5.你会看到audit.txt文件和另外一堆文件夹，里面有手术刀在扫描过程中发现的任何文件。

root@K55VD:/home/lucas/Desktop/scalpel_recovered_files# dir
audit.txt  odp-2-0  ods-1-0  odt-0-0

6.所以我打开了我的odt-0-0 并开始浏览odt 文件。它们根据最近的编号进行编号。浏览前 5 个 odt 文件后，我找到了丢失的文件。