从损坏的F2FS分区修复或恢复文件？

Question

我有一个缺少超级块的f2fs分区。我制作了一个磁盘映像，这样就不会破坏试图修复的原始分区。

sd-repair# fsck.f2fs sd128.img 
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 249737216 (121942 MB)
    Can't find a valid F2FS superblock at 0x0
    Can't find a valid F2FS superblock at 0x1

Testdisk不支持F2FS。

我不知道是否有一种重写超级块的方法，我想恢复我的文件或修复文件系统。

下面是我认为是F2FS超级块的六边形，来自一个好的分区。

10 20 F5 F2 01 00 07 00 09 00 00 00 03 00 00 00 0C 00 00 00 09 00 
00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 
E1 0F 00 00 FF 0F 00 00 02 00 00 00 02 00 00 00 12 00 00 00 08 00 
00 00 E1 0F 00 00 00 02 00 00 00 02 00 00 00 06 00 00 00 0A 00 00 
00 2E 00 00 00 3E 00 00 03 00 00 00 01 00 00 00 02 00 00 00 31 8B 
E4 FB 13 D1 42 26 A5 07 EA 8A B6 70 A9 45 

这是我在坏粒子上发现的六边形

10 20 F5 F2 01 00 07 00 09 00 00 00 03 00 00 00 0C 00 00 00 09 00 
00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 46 DC 01 00 00 00 00 
31 ED 00 00 22 EE 00 00 02 00 00 00 06 00 00 00 72 00 00 00 77 00 
00 00 31 ED 00 00 00 02 00 00 00 02 00 00 00 06 00 00 00 12 00 00 
00 F6 00 00 00 E4 01 00 03 00 00 00 01 00 00 00 02 00 00 00 16 CD 
C2 62 53 10 46 17 A5 B7 41 C6 8E AA 33 D5 73 00 64 00 2D 00 65 00 
78 00 74 00 

超级块似乎没问题，不同之处在于1是128 GB的部分，其他的是8 GB的部分。我不知道如何判断超级块是否位于错误分区上的正确位置。据我所知，那里的偏移量不匹配。但我不太擅长十六进制编辑，所以我不知道如何比较那里的抵消。

更新:超级块的偏移量是错误的，在0x600或3扇区。我从磁盘映像中删除了前512字节。现在fsck.f2fs显示

sd-repair# fsck.f2fs -f trim_sd.img 
Info: Force to fix corruption
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 249704447 (121925 MB)
Info: MKFS version
  "Linux version 3.4.0-CM-g87d27dd (Adam@TheKeurig) (gcc version 4.9 20150123 (prerelease) 
(GCC) ) #6 SMP PREEMPT Sat Dec 17 21:28:57 CET 2016"

Info: FSCK version
  from "Linux version 4.9.0-3-amd64 (debian-kernel@lists.debian.org) 
(gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) 
#1 SMP Debian 4.9.30-2 (2017-06-12)"
     to "Linux version 4.9.0-3-amd64 (debian-kernel@lists.debian.org)
(gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2 (2017-06-12)"

Info: superblock features = 0 : 
Info: superblock encrypt level = 0, salt = 00000000000000000000000000000000
Info: total FS sectors = 249704448 (121926 MB)
[f2fs_crc_valid: 477] CRC validation failed: cal_crc = 4076150800, blk_crc = 0 buff_size = 0x0
[f2fs_crc_valid: 477] CRC validation failed: cal_crc = 4076150800, blk_crc = 0 buff_size = 0x0
[f2fs_do_mount:1945] Can't find valid checkpoint

据我所知，分区已经转移，这可能与分区表有关。所有的数据似乎都完好无损。Is正在使用ms-dos分区表。

Answer 1

根据您想要恢复的内容，您可以尝试cat sd128.img | strings [options] | grep -C10 [pattern for recovery]。不过，这太可怕了。但可以给你一个线索，你的数据可能从哪里开始。

这一页关于SSD的法医维基可能是有用的阅读，虽然它主要涉及FTL (闪存过渡层)的复杂性，它将系统可见块设备映射到SSD中的许多存储芯片，并自动执行磨损均衡、坏块跟踪、背景优化等。