使用手术刀恢复odt文件

Question

现在，我正在处理一个从它的文件夹中消失的odt文件(不要问我为什么)。

~$ df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda4       91317328  72333904  14321716  84% /
none                   4         0         4   0% /sys/fs/cgroup
udev             1955444         4   1955440   1% /dev
tmpfs             393112      1212    391900   1% /run
none                5120         0      5120   0% /run/lock
none             1965552       276   1965276   1% /run/shm
none              102400        48    102352   1% /run/user
/dev/sda2      393654268 262304760 131349508  67% /media/lucas/F2DC2A2CDC29EC13

~$ mkdir ~/Desktop/scalpel_recovered_files/

~$ sudo scalpel /dev/sda4 -b -o ~/Desktop/scalpel_recovered_files/
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
       to maintain forensic soundness, this is not allowed.
Aborting.

~$ 

Answer 1

好的，我已经恢复了文件:)！

对于那些感兴趣的人，一步步地：

1.sudo apt-获取安装手术刀

2.您可能必须根据需要恢复的文件扩展名修改scalpel.conf文件。因此，在我的例子中，我添加到文件的末尾(我使用nano编辑文件)：

#---------------------------------------------------------------------
# OPENOFFICE FILES
#---------------------------------------------------------------------
    odt y   20000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.textPK META-INF/manifest.xmlPK????????????????????
    ods y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.spreadsheetPK  META-INF/manifest.xmlPK????????????????????
    odp y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.presentationPK META-INF/manifest.xmlPK????????????????????
#    odg y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.graphicsPK META-INF/manifest.xmlPK????????????????????
#    odc y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.chartPK    META-INF/manifest.xmlPK????????????????????
#    odf y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.formulaPK  META-INF/manifest.xmlPK????????????????????
#    odi y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.imagePK    META-INF/manifest.xmlPK????????????????????
#    odm y   10000000    PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.text-masterPK  META-INF/manifest.xmlPK????????????????????
#    sxw y   10000000    PK????????????????????????????mimetypeapplication/vnd.sun.xml.writerPK  META-INF/manifest.xmlPK????????????????????

3.我的Ubuntu安装在/dev/sda4 4分区上: scalpel /dev/sda4 4 -b -o ~/Desktop/scalpel_recovered_files/

4.现在访问~/Desktop/scalpel_recovered_files/ (我不得不使用sudo su)

5.你会看到audit.txt文件和另一堆文件夹被手术刀雕刻了他在扫描过程中发现的任何文件。

root@K55VD:/home/lucas/Desktop/scalpel_recovered_files# dir
audit.txt  odp-2-0  ods-1-0  odt-0-0

6.于是我打开ODT-0并开始浏览odt文件。它们是根据最近的数字编号的。在浏览了前5个odt文件之后，我找到了丢失的文件。