列出已删除的文件并访问已删除文件的数据。
我试图读取文件系统块的块,但它显示的分区大小为0。
下面是我的python代码
import os
BLOCK_SIZE = 4096
DELETED_FILE_SIGNATURE = b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0'
def list_deleted_files(partition_path):
deleted_files = []
partition_size = os.stat(partition_path).st_size
with open(partition_path, 'rb') as f:
num_blocks = partition_size // BLOCK_SIZE
print(num_blocks)
for block_number in range(num_blocks):
block_data = f.read(BLOCK_SIZE)
if DELETED_FILE_SIGNATURE in block_data:
file_offset = block_data.index(DELETED_FILE_SIGNATURE)
path_start = block_data.rfind(b'\0', 0, file_offset) + 1
path_end = block_data.index(b'\0', file_offset)
path = block_data[path_start:path_end].decode('utf-8')
deleted_files.append(path)
return deleted_files
partition_path = '/dev/nvme0n1p6'
deleted_files = list_deleted_files(partition_path)
print(deleted_files)
输出显示块数为0。
如何正确读取分区?
另一种方法
import os
partition_path = '/dev/nvme0n1p6'
for root, dirs, files in os.walk(partition_path):
for file in files:
file_path = os.path.join(root, file)
if os.path.islink(file_path) and not os.path.exists(file_path):
print(f"Deleted file found: {file_path}")
但它以for循环的0次迭代结束
1条答案
按热度按时间bfrts1fy1#
不应该使用
os.stat
,而应该使用os.statvfs
。您可以使用
f_blocks
和f_bsize
读取分区。这与命令行相同: