取消删除：拒绝访问，因为NTFS卷已经完全打开

我需要恢复从pratition中删除的一些文件。

ben@ben-V5-171:~$ sudo ntfsundelete /dev/sdb1 Access is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command. You can use force option to avoid this check, but this is not recommended and may lead to data corruption. ben@ben-V5-171:~$ fuser /dev/sdb1 ben@ben-V5-171:~$ sudo fuser /dev/sdb1 ben@ben-V5-171:~$ lsof /dev/sdb1 ben@ben-V5-171:~$ sudo lsof /dev/sdb1 lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/ben/.gvfs Output information may be incomplete. ben@ben-V5-171:~$ 

Answer 1

我不得不手动umount我的驱动器。 它变成了vfat fs，所以最后，在我的情况下恢复文件的最好方法是这样的：

 ben@ben-V5-171:~/tmp/flash$ sudo dd if=/dev/sdb1 of=fl.img bs=1024 ben@ben-V5-171:~/tmp/flash$ tsk_recover -e fl.img files/