linux系统坏恢复数据_为什么Linux系统有时无法恢复Windows的数据？

最新推荐文章于 2022-08-08 16:56:46 发布

culunyi0802

最新推荐文章于 2022-08-08 16:56:46 发布

阅读量215

点赞数

文章标签： python linux java 大数据多线程

原文链接：https://www.howtogeek.com/163757/why-can-linux-systems-sometimes-recover-data-windows-cant/

版权

linux系统坏恢复数据

Why is it that you can use a Linux-based computer or Linux Live CD to recover data Windows could not?

为什么可以使用基于Linux的计算机或Linux Live CD来恢复Windows无法恢复的数据？

Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.

今天的“问答”环节由SuperUser提供，它是Stack Exchange的一个分支，该社区是由社区驱动的Q＆A网站分组。

问题 (The Question)

SuperUser reader Philip Allgaier wants to know why he was able to recover data with a Linux Live CD that was reported as unrecoverable in Windows:

超级用户读者Philip Allgaier想知道为什么他能够使用据报道在Windows中不可恢复Linux Live CD恢复数据：

Background: Earlier this year I had a problem with a SSD drive that Windows would recognize anymore. But eventually a bootable Parted Magic 2012-10-10 did the trick. See this solved thread. One question stuck with me from that moment…

背景：今年早些时候，我遇到了Windows可以再识别的SSD驱动器问题。但最终，可启动的Parted Magic 2012-10-10成功了。请参阅此已解决的线程。从那时起，我一直有一个问题……

Question: I am aware that Linux is generally a bit more technical and raw, but can someone roughly outline why a Linux system (or in fact only that particular one, since Ubuntu did not do the trick) is capable of still accessing/communicating with a half-corrupted device when Windows isn’t?

问题：我知道Linux通常是一些技术和原始的东西，但是有人可以粗略地概述一下为什么Linux系统(或者实际上只有那个特定的系统，因为Ubuntu没有做到这一点)仍然能够访问/通信。不是Windows时设备损坏了一半？

Do they just ignore any potential indicators that something might be wrong?

他们是否只是忽略任何可能表明存在问题的潜在指标？
Are there any concrete reasons at all?

是否有任何具体原因？
Was it just luck that this particular environment was able to get the SSD to response if only for a limited time?

难道这个特殊的环境能够在有限的时间内使SSD响应？

While it certainly could have been luck, there’s likely more than a few factors at play. Let’s investigate.

虽然这当然可以走运，但可能有很多因素在起作用。让我们调查一下。

答案 (The Answer)

SuperUser contributor Eike offers some potential explanations, beyond just luck, for his ability to save the data:

超级用户贡献者Eike除提供运气外，还提供了一些潜在的解释，以帮助他保存数据：

Usually this comes down to what, exactly, is being accessed and how, exactly, the device is failing. For instance, if the SSD in question is unable to retrieve, say, sector 5 and will start stalling as soon as anything reads sector 5, the difference may simply be due to what different systems automatically access once they recognize a new disk.

通常，这取决于访问的对象以及设备发生故障的方式。例如，如果所讨论的SSD无法检索到扇区5，并且一旦任何内容读取扇区5，它将开始停顿，则差异可能仅是由于不同的系统一旦识别到新磁盘便自动访问什么。

When Windows detects a new disk, it will read the partition table and automatically attempt to open any filesystems it knows how to read. If any of the structures/blocks being read during this “mounting”-process trigger your faulty SSD to go bye-bye, the difference with that specific linux distribution is simply that it may not automatically mount all the partitions in question, or may, when mounting, simply read a different subset of sectors (the implementation of NTFS in Linux is very different from the one in Windows — while the on-disk format is the same, it is up to the OS which structures it deems necessary to read. Windows may read secondary copies of the MFT, or it may start precaching some data and that could be the difference. Ubuntu is in a similar boat — it is not geared towards recovery out of the box, it will attempt to mount any filesystem it finds on newly discovered media, automatically. It is for this reason that specialized distributions geared towards recovery are a better bet, as they only do what you explicitly ask them to as opposed to doing things automatically.

Windows检测到新磁盘时，它将读取分区表并自动尝试打开它知道如何读取的任何文件系统。如果在此“挂载”过程中读取的任何结构/块触发您有故障的SSD告别，则与特定linux发行版的区别仅在于它可能不会自动挂载所有有问题的分区，或者挂载时，只需读取不同的扇区子集(Linux中NTFS的实现与Windows中的实现大不相同-磁盘上的格式相同，这取决于操作系统认为它需要读取的结构。 Windows可能会读取MFT的辅助副本，或者可能会开始预缓存一些数据，而这可能有所不同，Ubuntu处于类似的状态–它不适合立即恢复，它将尝试挂载发现的任何文件系统。因此，面向恢复的专业发行版是更好的选择，因为它们只会执行您明确要求的操作，而不是自动执行操作。

Of course, you may simply have gotten lucky, too. I don’t know enough about the failure mode of the SSD to say.

当然，您可能也很幸运。我对SSD的故障模式了解不足。

Linux generally does not ignore indicators that something is wrong. It will receive the same SCSI errors from the SATA chipset as Windows will — if you look at the kernel log, on a faulty disk you will see lots of error messages. It depends on what programs are actuallly accessing the disk what will happen next. If it’s software geared towards recovery, it may try to reread the same sector a limited number of times, it may skip it, etc. Usually the best bet is to get an image of the drive with as many sectors read cleanly as possible, and then try to recover your data from that image (doing any analysis directly on the drive is a bad idea usually since its condition may worsen and just because you were able to read something once, that does not mean you will be able to read it again.)

Linux通常不会忽略某些问题的指示。它会从SATA芯片组收到与Windows相同的SCSI错误-如果您查看内核日志，则在故障磁盘上，您会看到很多错误消息。这取决于哪些程序实际上正在访问磁盘，接下来将发生什么。如果它是用于恢复的软件，它可能会尝试在有限的时间内重新读取同一扇区，可能会跳过它，依此类推。通常最好的选择是获取驱动器的映像，其中包含尽可能多的干净读取的扇区，并且然后尝试从该映像恢复数据(直接在驱动器上进行任何分析通常是一个坏主意，因为它的状况可能会恶化，并且仅仅是因为您能够读取一次内容，但这并不意味着您将能够再次读取它)

Fellow contributor AthonSfere, offers another take on things:

研究员AthonSfere，提供了另一种观点：

A lot of it is the way the environment handles the file system, and the ACLs or the hard drive.

环境处理文件系统，ACL或硬盘驱动器的方式很多。

Windows is going to do everything it can on its own to obey its ACLs, and sectors marked as bad or empty. So NTFS or Fat partitions created and maintained in Windows as well as Windows MBRs will be handled by Windows as Windows marked it.

Windows将自行采取一切可能的措施来遵守其ACL，并将扇区标记为坏或空。因此，在Windows中创建和维护的NTFS或Fat分区以及Windows MBR将由Windows处理，因为Windows对其进行了标记。

Also, if the drive is failing the more you use it the more likely it is to encounter a major problem and the environment will crash. Then how the OS handles that comes into play, Windows will BSOD or reboot, the windows boot process will throw MBR messages, missing file messages (NTDLR.dll is missing or corrupt) and stop, because these bad files are required.

另外，如果驱动器出现故障，则您使用它的次数越多，则遇到主要问题的可能性就越大，环境将崩溃。然后，操作系统将如何发挥作用，Windows将进行BSOD或重新启动，Windows启动过程将引发MBR消息，丢失的文件消息(NTDLR.dll丢失或损坏)并停止，因为这些坏文件是必需的。

When you use a live disk, you are not relying on any of this. A bad MBR is bypassed because you boot off of the disk. A bad sector that corrupted the NTDLR.dll is not needed. Everything is on the disk. You can then attempt a read. If it encounters a ‘blank’ sector or bad bit, that environment handles it however it was programmed to do. Ubuntu likely would rather maintain normal OS behaviors and continue on with what is most likely to be happening. The sector is blank, do something else. That sector is bad, stay away, do not read again do not write or it will cause problems.

使用活动磁盘时，您无需依赖任何磁盘。坏MBR被绕过，因为您从磁盘启动。不需要损坏NTDLR.dll的坏扇区。一切都在磁盘上。然后，您可以尝试读取。如果遇到“空白”扇区或坏位，则可以通过编程来执行该环境。 Ubuntu可能宁愿维持正常的OS行为并继续最有可能发生的事情。该部门为空白，请执行其他操作。那个扇区不好，请远离，不要再读，不写，否则会造成问题。

A recovery platform however, is going to want to read all data. The file markers say the file should be on 0,5, 13…. if the filesystem reports 13 is missing, ignore the blank header and read the file anyway, or read the bad sector as best as it can and try to recover.

但是，恢复平台将要读取所有数据。文件标记说文件应该在0,5，13…上。如果文件系统报告13丢失，请忽略空白标头并以任何方式读取文件，或者尽最大可能读取坏扇区并尝试恢复。

Also, Windows CAN do alot of this with third party applications, Recuva can find alot of these “missing” files, for one. But you don’t want to be in an environment that may write back to the disk and cause true permanent loss.

而且，Windows可以使用第三方应用程序完成很多此任务，Recuva可以找到许多这些“缺失”文件。但是，您不希望处于可能写回到磁盘并造成真正永久损失的环境中。

I did simplify this, and add some interpretation, but it should fill in some blanks for what you are asking.

我确实简化了这个过程，并添加了一些解释，但是对于您所要询问的内容，它应该填写一些空白。

Have something to add to the explanation? Sound off in the the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.

有什么补充说明吗？在评论中听起来不对。是否想从其他精通Stack Exchange的用户那里获得更多答案？在此处查看完整的讨论线程。

http://superuser.com/questions/586666/why-can-linux-systems-sometime-recover-data-windows-cant-any-concrete-reasons