CN104794025B - The method of rapid verification storage device - Google Patents

The method of rapid verification storage device Download PDF

Info

Publication number
CN104794025B
CN104794025B CN201510204245.0A CN201510204245A CN104794025B CN 104794025 B CN104794025 B CN 104794025B CN 201510204245 A CN201510204245 A CN 201510204245A CN 104794025 B CN104794025 B CN 104794025B
Authority
CN
China
Prior art keywords
file
cluster
information
storage device
directory entry
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201510204245.0A
Other languages
Chinese (zh)
Other versions
CN104794025A (en
Inventor
梁效宁
许超明
朱星海
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
SICHUAN XLY INFORMATION SAFETY TECHNOLOGY Co Ltd
Original Assignee
SICHUAN XLY INFORMATION SAFETY TECHNOLOGY Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by SICHUAN XLY INFORMATION SAFETY TECHNOLOGY Co Ltd filed Critical SICHUAN XLY INFORMATION SAFETY TECHNOLOGY Co Ltd
Priority to CN201510204245.0A priority Critical patent/CN104794025B/en
Publication of CN104794025A publication Critical patent/CN104794025A/en
Application granted granted Critical
Publication of CN104794025B publication Critical patent/CN104794025B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Abstract

The invention discloses a kind of method of rapid verification storage device, belong to electronic evidence-collecting data and save field from damage, comprise the following steps:S1. each parameter information of storage device, including specific data structure are parsed;S2. judge whether the data structure of storage device is specific data structure, if it is skips to S3, otherwise skips to S5 according to the S1 parameter informations parsed.Beneficial effects of the present invention are as follows:The present invention is using segmentation check algorithm, only need to extract the value and deviation post in the MBR of storage device, partition boot record, root, whole subdirectory items and other all meta data file regions when saving the disk for having specific data structure from damage, therefore storage device data is largely saved from damage, the validity and reliability of electronic evidence has been ensured, and the purpose of rapid verification storage device can be reached.

Description

The method of rapid verification storage device
Technical field
The invention belongs to electronic evidence-collecting data to save field from damage, and in particular to a kind of method of rapid verification storage device.
Background technology
Electronic evidence-collecting is also known as computer forensics or computor method medical science, be study how to computer, network intrusions with The science and technology that the evidence of crime is obtained, saved from damage, analyzed and shown.With the extensive use and popularization of computer, utilize Cyber-net or crime using cyber-net as tool target are becoming increasingly rampant, and electronic evidence-collecting can be in strike and right Resist in this kind digitlization process of commission of crime and play critical effect.
Electronic data is saved from damage, and to follow common evidence saves rule from damage.The particularity of electronic data makes its security method With particularity, it is mainly reflected in notarization and saves from damage.The instantaneity and fugitiveness of electronic data are saved from damage to electronic data notarization Program proposes higher requirement.With the further development of electronic technology, the notarization of future electronic data is saved from damage and can built Based on network notarization center, a set of separate procedure saved from damage different from traditional evidence notarization is developed.
At home, about computer forensics in terms of research and practice it is mostly be using some external conventional forensic tools, Also lacking more in-depth study in the flow of computer forensics, the preservation system and method for evidence are also perfect not to the utmost, so as to The reliability, validity, confidence level for causing Computer forensics be not high.
The full name of MD5 algorithms is Message-Digest algorithm 5, is a kind of based on producing digital signature The widely used hash algorithm in calculation machine security fields.Its effect is to allow Large Copacity information to be signed with digital signature software A kind of form of secrecy is ' compressed ' into before private key, i.e., it is " byte serial " of a random length is irreversible by one Character string converts algorithmic transformation into the string of one 128.The principle of MD5 algorithms be to input information carry out initialization process after, It is grouped with 512 to handle input information, each group of subgroup for being divided into 16 32 again, by a series of change After changing processing, four 32 packets of output, then the hashed value for one 128 being generated after this four 32 packet concatenations.Use MD5 algorithms can effectively prevent information to be tampered, forge detecting the integrality of data and palm off, to ensure the number of storage device According in censorship, completely consistent and data are effectively reliable.
However, in actual applications, with the huge expansion of company information and data, the problem of this method is exposed, is The complexity of reduction and the data management of efficiency, but the importance for saving data from damage has irreplaceable importance, needs badly method Appropriate modification and supplement are made, to be more suitable for applying needs.
Technical term explanation used herein:
LBA:Logical Block Address (logical block addresses), it is a kind of simple addressing mode, since 0 Numbering carrys out positioning logic block, and the LBA value of the first block is 0, and the LBA value of the second block is 1, by that analogy.
Cluster number:The numbering of cluster, is generally numbered from 1, and cluster is windows system minimum data MMU memory management units.
Fat tables:File allocation table (fat) is the table that file management system is used for distributing disk physical space to each file Lattice, log file are stored in the position of disk.
Directory entry:Most important data structure, wherein depositing the filename about subdirectory or file, attribute, starting The information such as cluster number, time value and content size.
BPB:It is the abbreviation of BIOS parameter blocks, it is located in the boot sector of storage device.
The content of the invention
, can be effective in view of the deficiencies of the prior art, the present invention provides a kind of method of rapid verification storage device Solves the problems such as Large Volume Data carries out the too low efficiency that MD5 verifications are saved from damage, complex management.
To solve problem above, the technical solution adopted by the present invention is as follows:A kind of method of rapid verification storage device, bag Include following steps:
S1. each parameter information of storage device, including specific data structure, described specific data structure bag are parsed Include specific file system structure and specific monitor video structure;
Described specific file system structure has:fat12、fat16、fat32、ntfs、ext2、ext3、ext4、xfs、 Jfs, hfs and hfs+.
Described specific monitor video structure has:Haikang, big China, Chinese nation, sharp photopic vision news, Supreme Being regard treasured, wave-particle, WFS2/ 3/4th, the monitor video data format that blueness is interspace, intelligence is led and dragon uses depending on peace manufacturer.
S2. judge whether the data structure of storage device is specific data structure according to the S1 parameter informations parsed, such as Fruit is to skip to S3, otherwise skips to S5;
S3. the value of parameters in specific data structure is extracted, and records its deviation post;
S4. S6 is skipped to after being reconfigured to the specific data structure of extraction according to the order in storage device;
S5. without special construction then using totally it is byte-by-byte verified after skip to S6;
S6. the file after new file or S5 after being reconfigured to S4 are examined carries out MD5 verifications;
S7. MD5 values caused by verification are preserved, and preserve storage device position corresponding to each parameter simultaneously.
Preferably, S1 specific method is preceding 3 sectors in reading storage device, and parse the number stored in sector According to.
Preferably, when described specific file system structure is fat32, then storage is extracted in fat32 structures The MBR of equipment, partition boot record, fat tables 1, fat tables 2, root, the value and bits of offset of whole subdirectory items Put.
Preferably, as the promising ntfs of described specific file system structure, then master is extracted in ntfs structures and drawn Lead record, partition boot record, meta data file, the value and deviation post of all mtf list items.
Preferably, S3 is specifically further comprising the steps of:
S311. cluster information where reading current file clip directory from the root list item of file system;
S312. after jumping to the cluster number, directory entry information all under the cluster number is read one by one;
Whether the filename S313. contrasted in directory entry is consistent with the filename of the file to be opened, parses in directory entry File attribute information, and matched with the file that current mouse is chosen, if mismatching, skip to S312 continue to read it is next Directory entry information is matched, and otherwise skips to S314;
S314. after the match is successful, directory entry details are read, obtain file storage location and document size information;
S315. the usage record that corresponding this document storage location is recorded in fat tables is read, and obtains its LBA information;
S316. file access time or the modification time information in directory entry are updated, and is write back.
Preferably, S3 is specifically further comprising the steps of:
S321. when storage device writes file, cluster number where the root of storage write-in file or folder is first obtained Information;
S322. the content of current directory item is read according to S321 cluster information, judges whether the directory entry is occupied, if Do not have occupied, write new data;
S323. judge whether byte is normal labeled, only when the first byte of directory entry is 0xE5 or 0x00, represent the mesh Record item is not used, and can write data;If so, then skip to S3212;If it is not, then skip to S324;
S324. next directory entry is skipped to;
S325. directory entry number in cluster is calculated, judges whether this directory entry exceeds the catalogue item number per cluster;If so, then jump To S326;If it is not, then skip to S322;
S326. current cluster content is read, verifies the state record information on this cluster in fat tables;
S327. end mark, whether current directory item is judged in cluster tail, if so, then skipping to S329;If it is not, skip to S328;
S328. the content of end mark is assigned to current cluster number, continues to read the content of the directory entry, skip to S321;
S329. verify and update the status information for recording the cluster in fat tables;
S3210. the position of next free cluster is read;
S3211. the content of next free cluster is read, skips to S323;
S3212. the directory entry information of file or folder is built, and is write;
S3213. the cluster state that this document or file use in fat tables is updated;
S3214. by file content write corresponding in cluster number;
S3215. judge whether file writes, if so, then skipping to S3219;If it is not, then skip to S3216;
S3216. current cluster number is obtained, by the lower cluster positional information of current cluster, preparation continues to write to data;
S3217. the positional information of next free cluster in fat tables is read;
S3218. the content information of free cluster in fat tables is read, and judges whether its preceding 4byte is all 0x00, if jumping To S3213, S3217 is otherwise skipped to;
S3219. after completing write-in, fat tables and its backup information are updated;
S3220. it is successfully written file or folder.
The beneficial effects of the invention are as follows:The present invention is saving the magnetic that has specific data structure from damage using segmentation check algorithm MBR, partition boot record, root, whole subdirectory items and the other all members of extraction storage device are only needed during disk The value and deviation post in data file region, therefore largely save storage device data from damage, ensure electronics card According to validity and reliability, and the purpose of rapid verification storage device can be reached.
Brief description of the drawings
Fig. 1 is the general flow chart of rapid verification storage device;
Fig. 2 is the detailed construction logic chart of fat32 subregions;
Fig. 3 is the flow chart for reading file or file;
Fig. 4 is the flow chart for writing file or file.
Embodiment
For the objects, technical solutions and advantages of the present invention are more clearly understood, develop simultaneously embodiment referring to the drawings, right The present invention is described in further details.
A kind of method of rapid verification storage device, as shown in figure 1, comprising the following steps:
S1. each parameter information of storage device, including specific data structure, described specific data structure bag are parsed Include specific file system structure and specific monitor video structure;
S2. judge whether the data structure of storage device is specific data structure according to the S1 parameter informations parsed, such as Fruit is to skip to S3, otherwise skips to S5;
S3. the value of parameters in specific data structure is extracted, and records its deviation post;
S4. S6 is skipped to after being reconfigured to the specific data structure of extraction according to the order in storage device;
S5. without special construction then using totally it is byte-by-byte verified after skip to S6, this step is prior art;
S6. the file after new file or S5 after being reconfigured to S4 are examined carries out MD5 verifications, and this step is existing skill Art;
S7. MD5 values caused by verification are preserved, and preserve storage device position corresponding to each parameter simultaneously, this value can be made For the reference point verified next time, so that whether verification equipment information is by falsification.
The specific data structure that can be matched at present has:
File system structure:fat12、fat16、fat32、ntfs、ext2、ext3、ext4、xfs、jfs、hfs、hfs+;
Monitor video structure:Haikang, big China, Chinese nation, sharp photopic vision news, Supreme Being regard treasured, wave-particle, WFS2/3/4, blue interspace, intelligence The monitor video data format that neck, dragon use depending on peace Deng50Yu Jia manufacturers;
Embodiment 1:
Here described in detail by taking fat32 as an example, be illustrated in figure 2 the detailed construction logic chart of fat32 subregions, pass through fat Table and directory entry are managed to the All Files of storage, and to read or write file each time can all cause fat tables or mesh The renewal of item information is recorded, so only needing to extract MBR, partition boot record, the fat of storage device in fat32 structures Table 1, fat tables 2, root, the value and deviation post of whole subdirectory items, Fig. 3 and Fig. 4 illustrate in detail read file and Write the process of file.
Embodiment 2:
Similarly, in ntfs structures, write-in file or reading file will also result in the multinomial mft list items in structure each time Renewal, again may be by extract MBR, partition boot record, meta data file, all mft list items value with Deviation post.
Read file and write the detailed process of file, as shown in Figure 3 and Figure 4:
1 reads file or folder
The reading of file or folder can change the attribute information of file or folder, so as to change the number of storage device According to detailed in Example 3;
2 write-in file or folders
The write-in of file or folder can equally change the attribute information of file or folder, so as to change storage device Data, detailed in Example 4.
Embodiment 3, as shown in Figure 3:
11 current directory clusters number
Cluster information where reading current file clip directory from the root list item of file system;
12 each directory entries
After jumping to the cluster number, directory entry information all under the cluster number is read one by one;
Whether the filename in 13 contrast directory entries is consistent with the filename of the file to be opened
The file attribute information in directory entry is parsed, and is matched with the file that current mouse is chosen, if mismatching, Skip to 12 and continue to read next directory entry information and matched, until the match is successful, otherwise skip to 14;
14 read directory entry information
After the match is successful, directory entry details are read, obtain the information such as file storage location and file size;
15 obtain the cluster number and LBA value of the storage of fat list files
The usage record that corresponding this document storage location is recorded in fat tables is read, and obtains its LBA information;
16 renewal directory informations
The information such as file access time or the modification time in directory entry are updated, and are write back.
Embodiment 4, as shown in Figure 4:
21 read current root cluster number
When storage device writes file, the letter of cluster number where first obtaining the root of storage write-in file or folder Breath;
22 read the content under current directory cluster
Judge whether the directory entry is occupied according to the information of cluster number, it is new in the write-in of this position to judge whether
Data;
23 judge whether byte is normal labeled
Only when the first byte of directory entry is 0xE5 (E5H) or 0x00 (00H), represents that the directory entry is not used, can write Enter data;If so, then skip to 211;If it is not, then skip to 24;
24 skip to next directory entry;
25 calculate directory entry number in cluster
Judge whether this directory entry exceeds the catalogue item number per cluster;If so, then skip to 26;If it is not, then skip to 22;
26 read current cluster content
Verify the state record information in FAT table on this cluster;
27 end marks
Whether current directory item is judged in cluster tail, if so, then skipping to 29;If it is not, skip to 28;
The content of end mark is assigned to current cluster number by 28
Continue to read the content of the directory entry, skip to 21;
29 update the tufted state
Verify and update the status information for recording the cluster in FAT table;
210 read the position of next free cluster;
211 read the content of next free cluster, skip to 23;
The directory entry information of 212 structure file or folders, and write;
The cluster state that this document or file use in 213 renewal fat tables;
214 by file content write corresponding in cluster number;
215 judge whether file writes, if so, then skipping to 219;If it is not, then skip to 216;
216 obtain current cluster number, and by the lower cluster positional information of current cluster, preparation continues to write to data;
217 read the positional information of next free cluster in fat tables;
218 read the content information of free cluster in fat tables, and judge whether its preceding 4byte is all 0x00,
If skipping to 213,217 are otherwise skipped to;
After 219 complete write-in, fat tables and its backup information are updated;
220 are successfully written file or folder.
One of ordinary skill in the art will be appreciated that embodiment described here is to aid in reader and understands this hair Bright implementation, it should be understood that protection scope of the present invention is not limited to such especially statement and embodiment.Ability The those of ordinary skill in domain can be made according to these technical inspirations disclosed by the invention it is various do not depart from essence of the invention its Its various specific deformations and combination, these deformations and combination are still within the scope of the present invention.

Claims (6)

  1. A kind of 1. method of rapid verification storage device, it is characterised in that comprise the following steps:
    S1. each parameter information of storage device, including specific data structure are parsed;
    Specific data structure described in S1 includes specific file system structure and specific monitor video structure;Described Specific file system structure has:Fat12, fat16, fat32, ntfs, ext2, ext3, ext4, xfs, jfs, hfs and hfs+; Described specific monitor video structure has:Haikang, big China, Chinese nation, sharp photopic vision news, Supreme Being regard treasured, wave-particle, WFS2/3/4, blueness The monitor video data format that interspace, intelligence neck and dragon use depending on peace manufacturer;
    S2. judge whether the data structure of storage device is specific data structure according to the S1 parameter informations parsed, if S3 is then skipped to, otherwise skips to S5;
    S3. the value of parameters in specific data structure is extracted, and records its deviation post;
    S4. S6 is skipped to after being reconfigured to the specific data structure of extraction according to the order in storage device;
    S5. without special construction then using totally it is byte-by-byte verified after skip to S6;
    S6. the file after new file or S5 after being reconfigured to S4 are examined carries out MD5 verifications;
    S7. MD5 values caused by verification are preserved, and preserve storage device position corresponding to each parameter simultaneously.
  2. 2. according to the method for claim 1, it is characterised in that S1 specific method is preceding 3 fans in reading storage device Area, and parse the data stored in sector.
  3. 3. according to the method for claim 1, it is characterised in that when described specific file system structure is fat32, The MBR of storage device, partition boot record, fat tables 1, fat tables 2, root, complete is then extracted in fat32 structures The value and deviation post of portion's subdirectory item.
  4. 4. according to the method for claim 1, it is characterised in that as the described promising ntfs of specific file system structure When, then in ntfs structures extract MBR, partition boot record, meta data file, all MTF list items value and partially Pan position.
  5. 5. according to the method for claim 1, it is characterised in that S3 is specifically further comprising the steps of:
    S311. cluster information where reading current file clip directory from the root list item of file system;
    S312. after jumping to the cluster number, directory entry information all under the cluster number is read one by one;
    Whether the filename S313. contrasted in directory entry is consistent with the filename of the file to be opened, parses the text in directory entry Part attribute information, and matched with the file that current mouse is chosen, if mismatching, skip to S312 and continue to read next catalogue Item information is matched, and otherwise skips to S314;
    S314. after the match is successful, directory entry details are read, obtain file storage location and document size information;
    S315. the usage record that corresponding this document storage location is recorded in fat tables is read, and obtains its LBA information;
    S316. file access time or the modification time information in directory entry are updated, and is write back.
  6. 6. according to the method for claim 1, it is characterised in that S3 is specifically further comprising the steps of:
    S321. when storage device writes file, the letter of cluster number where first obtaining the root of storage write-in file or folder Breath;
    S322. according to S321 cluster information read current directory item content, judge whether the directory entry occupied, if not by Occupancy then writes new data;
    S323. judge whether byte is normal labeled, only when the first byte of directory entry is 0xE5 or 0x00, represent the directory entry It is not used, data can be write;If so, then skip to S3212;If it is not, then skip to S324;
    S324. next directory entry is skipped to;
    S325. directory entry number in cluster is calculated, judges whether this directory entry exceeds the catalogue item number per cluster;If so, then skip to S326;If it is not, then skip to S322;
    S326. current cluster content is read, verifies the state record information on this cluster in fat tables;
    S327. end mark, whether current directory item is judged in cluster tail, if so, then skipping to S329;If it is not, skip to S328;
    S328. the content of end mark is assigned to current cluster number, continues to read the content of the directory entry, skip to S321;
    S329. verify and update the status information for recording the cluster in fat tables;
    S3210. the position of next free cluster is read;
    S3211. the content of next free cluster is read, skips to S323;
    S3212. the directory entry information of file or folder is built, and is write;
    S3213. the cluster state that this document or file use in fat tables is updated;
    S3214. by file content write corresponding in cluster number;
    S3215. judge whether file writes, if so, then skipping to S3219;If it is not, then skip to S3216;
    S3216. current cluster number is obtained, by the lower cluster positional information of current cluster, preparation continues to write to data;
    S3217. the positional information of next free cluster in fat tables is read;
    S3218. the content information of free cluster in fat tables is read, and judges whether its preceding 4byte is all 0x00, if skipping to S3213, otherwise skip to S3217;
    S3219. after completing write-in, fat tables and its backup information are updated;
    S3220. it is successfully written file or folder.
CN201510204245.0A 2015-04-27 2015-04-27 The method of rapid verification storage device Active CN104794025B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510204245.0A CN104794025B (en) 2015-04-27 2015-04-27 The method of rapid verification storage device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201510204245.0A CN104794025B (en) 2015-04-27 2015-04-27 The method of rapid verification storage device

Publications (2)

Publication Number Publication Date
CN104794025A CN104794025A (en) 2015-07-22
CN104794025B true CN104794025B (en) 2017-11-10

Family

ID=53558835

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201510204245.0A Active CN104794025B (en) 2015-04-27 2015-04-27 The method of rapid verification storage device

Country Status (1)

Country Link
CN (1) CN104794025B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105956172B (en) * 2016-05-23 2019-08-13 深圳市硅格半导体有限公司 The storage method and device of log information
CN106095619A (en) * 2016-06-08 2016-11-09 杭州华三通信技术有限公司 A kind of virtual machine backup method and device
CN107797881A (en) * 2017-12-06 2018-03-13 郑州云海信息技术有限公司 A kind of data coherence tester method, apparatus, equipment and storage medium
CN108763371B (en) * 2018-05-17 2021-06-18 上海威固信息技术股份有限公司 Exfat file system power-off protection and file detection recovery method

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5696897A (en) * 1994-01-31 1997-12-09 Sun Microsystems, Inc. Method and apparatus for a multi-layer system quiescent suspend and resume operation
CN1979436A (en) * 2005-12-02 2007-06-13 联想(北京)有限公司 Data back-up system and method and system load-bearing apparatus
CN103138871A (en) * 2011-11-23 2013-06-05 毕书清 Server data processing system and method of application program of mobile communication system

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6779082B2 (en) * 2001-02-05 2004-08-17 Ulysses Esd, Inc. Network-based disk redundancy storage system and method
KR101994811B1 (en) * 2012-03-04 2019-07-01 삼성전자주식회사 Electronic apparatus, method for restore of mbr and computer-readable recording medium

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5696897A (en) * 1994-01-31 1997-12-09 Sun Microsystems, Inc. Method and apparatus for a multi-layer system quiescent suspend and resume operation
CN1979436A (en) * 2005-12-02 2007-06-13 联想(北京)有限公司 Data back-up system and method and system load-bearing apparatus
CN103138871A (en) * 2011-11-23 2013-06-05 毕书清 Server data processing system and method of application program of mobile communication system

Also Published As

Publication number Publication date
CN104794025A (en) 2015-07-22

Similar Documents

Publication Publication Date Title
CN101464900B (en) Light file hiding method in NTFS file system
KR101506578B1 (en) File system configuration method and apparatus for data security, method and apparatus for accessing data security area formed by the same, and data storage device thereby
CN104794025B (en) The method of rapid verification storage device
US8606751B1 (en) System and method for backup by inode number
WO2020000725A1 (en) Electronic apparatus, data migration method, and storage medium
US11249665B2 (en) Object synthesis
WO2020103493A1 (en) Method and system for recovering deleted file based on fat32 file system
US11347717B2 (en) Generalized verification scheme for safe metadata modification
US20220129501A1 (en) Method and system for performing a storage tier operation on video data using a data processing unit
CN108062262A (en) Operating system backup-and-restore method and its system based on storage sector data
CN104699794B (en) A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system
CN112800007B (en) Directory entry expansion method and system suitable for FAT32 file system
CN104199909B (en) Recover the method for NTFS superencipherment files in VMware scenes
CN104462148B (en) A kind of data storage and management method and device
CN106254806B (en) A kind of Video data guard method and device
US20120089849A1 (en) Cookie management system and method
CN107256368A (en) File integrality measure in virtual machine based on copy-on-write characteristic
CN112416657A (en) System cloning method
CN106126555A (en) A kind of file management method and file system
KR101265691B1 (en) Method for managing and restoring identifier of storage device and apparatus thereof
CN105786590B (en) The management method and system of logical volume in virtual environment
Ma et al. Recovery of evidence and the judicial identification of electronic data based on ExFAT
Alhussein et al. Forensics filesystem with cluster-level identifiers for efficient data recovery
CN106528332A (en) Recovery method for deleted data in registry
Alhussein et al. Multi-version data recovery for cluster identifier forensics filesystem with identifier integrity

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
EXSB Decision made by sipo to initiate substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information
CB02 Change of applicant information

Address after: 641000 Sichuan province Neijiang City Songshan Road No. 183

Applicant after: SICHUAN XLY INFORMATION SAFETY TECHNOLOGY CO., LTD.

Address before: 641000 Sichuan province Neijiang City Songshan Road No. 183

Applicant before: Sichuan SalvationData Information Safety Technology Co., Ltd.

CB03 Change of inventor or designer information
CB03 Change of inventor or designer information

Inventor after: Liang Xiaoning

Inventor after: Xu Chaoming

Inventor after: Zhu Xinghai

Inventor before: Liang Xiaoning

GR01 Patent grant
GR01 Patent grant