CN112380174A - XFS file system analysis method containing deleted files, terminal equipment and storage medium - Google Patents
XFS file system analysis method containing deleted files, terminal equipment and storage medium Download PDFInfo
- Publication number
- CN112380174A CN112380174A CN202011387192.8A CN202011387192A CN112380174A CN 112380174 A CN112380174 A CN 112380174A CN 202011387192 A CN202011387192 A CN 202011387192A CN 112380174 A CN112380174 A CN 112380174A
- Authority
- CN
- China
- Prior art keywords
- file
- file system
- block
- deleted
- xfs
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
- G06F16/162—Delete operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/18—File system types
- G06F16/1805—Append-only file systems, e.g. using logs or journals to store data
- G06F16/1815—Journaling file systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Human Computer Interaction (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention relates to an XFS file system analysis method containing deleted files, a terminal device and a storage medium, wherein the method comprises the following steps: analyzing the file system according to the organization structure of the XFS file system, neglecting the distributed INDODE number in the analyzing process, directly combining the block head identification with the structure matching rule and the verification algorithm recorded by the INDODE group pointer, and carrying out key structure identification on the metadata area of the file system to obtain all metadata information, thereby realizing the analysis of normal and deleted files. The method provides a solution for the quick analysis of the normal and deleted files of the XFS file system, provides effective technical support for the quick and deep analysis of electronic data evidence taking, and has great significance.
Description
Technical Field
The invention relates to the field of file analysis, in particular to an XFS file system analysis method containing deleted files, a terminal device and a storage medium.
Background
XFS is a high-performance journaling file system, which was formally migrated to Linux kernel in 2000 with excellent large file handling capability. The XFS file system has strong flexibility and robustness, has strong guarantee on the safety of data, and is widely used on the Linux system at present, wherein the XFS is used as the default file system after the CENTOS series is 7.0. In the electronic data forensics process (especially server forensics), an XFS file system is frequently touched, and the forensics tool directly influences the forensics effect according to the analysis depth of the XFS file system.
The XFS file system stores file meta-information in the form of INODE node groups, and the INODE node groups are organized in the form of trees, with pointers to the INODE node groups stored in leaf nodes of the trees. When a file is deleted, the node organization structure of the B + tree is adjusted, namely the INDODE node information for storing the deleted file loses the pointer direction, so that the deleted file information cannot be normally indexed, and only a normal file can be analyzed by a traditional analysis means, and the deleted file cannot be recovered. The current recovery tool in the market can only perform normal file analysis or perform deleted file recovery in a full disk fragment scanning mode, but the full disk fragment scanning mode is low in efficiency and the recovered files cannot guarantee a complete directory structure.
Disclosure of Invention
In order to solve the above problems, the present invention provides an XFS file system parsing method, a terminal device and a storage medium containing a deleted file.
The specific scheme is as follows:
an XFS file system analysis method containing deleted files comprises the following steps:
s1: analyzing the super block in the XFS file system to obtain a block size BLOCKSIZE, a sector size SECTORSIZE, an INDODE node size INODESIZE and a total block number TOTALBLOCKUMBER contained in the file system;
s2: setting the current offset CURRENTSECTOR to be 2, and setting the used block number USEDBLOCKNUMBER to be 0;
s3: judging whether the used block number USEDBLOCKUMBER is more than or equal to the total block number TOTALBLOCKUMBER contained in the file system, if so, ending; otherwise, reading a block from the CURRENTSECTOR sector, and analyzing according to the AG block head structure to obtain a block identifier AGMAGIC, a block number AGBLOCKUM, an allocated INDODE number AGUSEDINODENUMBER and a B + Tree root node position AGTREREROOT;
s4: if the block identifier AGMAGIC is not "XAGI" or the block number AGBLOCKUM is equal to 0, ending; otherwise, reading the B + Tree root node information according to the B + Tree root node position AGTREREROOT and analyzing the whole Tree according to the Tree structure;
s5: let us blocknumber be AGBLOCKNUM + useblocknumber,
CURRENTSECTOR ═ CURRENTSECTOR + (AGBLOCKNUM ═ blockksize/sectoresize), return to S3.
Further, the parsing process of the leaf node when the whole tree is parsed in step S4 includes the following steps:
s401: analyzing the leaf node to obtain a block identifier LNMAGIC and an INDODE group number LNINODECHUNKNUMBER of the leaf node;
s402: judging whether the block identifier LNMAGIC of the leaf node is equal to 'IABT', if so, setting the current INDODE group pointer position CURRENDEDECHUNK to 56, and entering S403; otherwise, go to S5;
s403: judging whether the current index group pointer position currentindedchunk is larger than or equal to the block size, if so, entering S5; otherwise, the current index group pointer position currentindedaterecord is regarded as the index group pointer record, and the initial index number STARTINODE, the idle index number FREEINODENUMBER and the index idle bitmap freeinodenblanket are obtained by analysis, and the step S404 is entered;
s404: judging whether the current index group pointer record is legal or not, if so, acquiring the index group according to the initial index number STARTINODE, and analyzing the indexes in the index group one by one to acquire file and folder information; otherwise, go to S406;
s405: after judging whether the analyzed file or folder is a normal file or a deleted file, marking the file or folder to be normal or deleted;
s406: let currentindodechunk be currentindodechunk +16, return to S403.
Further, the method for determining whether the index group pointer record in step S404 is legal includes: when the NODE set pointer record satisfies (FREEEINODENUMBER > >8) equal to 64 and (FREEEINODENUMBER &0x000000FF) equal to the number of 1's in the 64-bit binary in FREEEINODE ITMAP, the INDODE set pointer record is legal; otherwise, it is illegal, wherein, FREEINODENUMBER represents the number of idle INODEs recorded by the INODE group pointer, and freeinodetmap represents the INODE idle bitmap recorded by the INODE group pointer.
Further, the method for judging whether the analyzed file or folder is a normal file or a deleted file is as follows: judging whether AGUSEDINODENUMBER is equal to 0 or (CURRENDIDECHUNK-56)/16 is greater than LNINDECECHUNKNUMBER, and if yes, judging that the file is deleted; otherwise, the file is determined to be a normal file, wherein the AGUSEDINODENUMBER indicates the number of allocated INODEs of the AG to which the file belongs, and the CURRENDINODECHUNK indicates the position of an INODE node group pointer pointing to the INODE node group at the corresponding leaf node.
An XFS file system parsing terminal device with a deleted file includes a processor, a memory, and a computer program stored in the memory and executable on the processor, where the processor implements the steps of the method described above in the embodiments of the present invention when executing the computer program.
A computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, carries out the steps of the method as described above for an embodiment of the invention.
By adopting the technical scheme, the pointer information (including deletion) of all the INDODE node groups is searched by combining a structure matching and checking algorithm on the basis of the analysis of the conventional XFS file system, all the INDODE information is obtained on the basis of the pointer information of the INDODE node groups, and the normal and deleted files are further obtained through analysis. The method provides a solution for the normal and quick analysis of the deleted files of the XFS file system, provides effective technical support for the quick and deep analysis of electronic data evidence taking, and has great significance.
Drawings
Fig. 1 is a diagram illustrating a structure of an XFS file system according to an embodiment of the present invention.
FIG. 2 is a structural diagram of AG components in the first embodiment of the present invention.
Fig. 3 is a structural diagram of a B + Tree leaf node according to a first embodiment of the present invention.
Fig. 4 is a diagram illustrating a structure of pointer records of a NODE group according to an embodiment of the present invention.
Fig. 5 is a flowchart illustrating a first embodiment of the present invention.
Fig. 6 is a diagram illustrating an analysis effect of the mainstream tool according to the first embodiment of the invention.
Fig. 7 is a diagram illustrating an analysis effect of the method according to the embodiment of the present invention.
Detailed Description
To further illustrate the various embodiments, the invention provides the accompanying drawings. The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments. Those skilled in the art will appreciate still other possible embodiments and advantages of the present invention with reference to these figures.
The invention will now be further described with reference to the accompanying drawings and detailed description.
The first embodiment is as follows:
the XFS file system consists of superblocks and individual AGs (allocation groups), as shown in fig. 1. Each AG is composed of a series of blocks, which are the smallest allocation unit of the XFS file system. The super block includes information such as block size, INODE node size, sector size, and number of blocks totalblockumber included in the file system. Each AG initially contains the number of blocks within the AG, the number of INODE nodes assigned, the B + Tree root node location, and the B + Tree hierarchy, etc., as shown in fig. 2.
The B + Tree root node that manages the INDEE node group is located by a "B + Tree root node location" in the AG header, where leaf nodes in the B + Tree store pointers to the INDEE node group. The leaf node (occupying one block) is composed of a block header and an index group pointer record, wherein the block header stores information such as a block identifier, a leaf node layer level number, left node information, right node information, and the index group pointer record number. Each INDODE group pointer record contains the start INDODE number (4 bytes), the number of idle INDODEs (4 bytes), and the INDODE idle bitmap (8 bytes) for the group, as shown in FIG. 3.
Based on the above structure, this embodiment provides an XFS file system parsing method including a deleted file, and the parsing principle is as follows: when a file in the XFS file system is deleted, the number of allocated INODEs in the AG is reduced, and the corresponding number of INODEs groups in the B + Tree leaf node is correspondingly adjusted, so that the deleted file cannot be analyzed by a normal analysis method. In this embodiment, by matching the head identifiers of various metadata blocks in the XFS file system and combining the structure (as shown in fig. 4) matching rule and verification algorithm of the index group pointer record, an XFS file system parsing method that does not depend on the number of assigned indexes and the number of index groups is implemented, and normal and deleted files can be parsed at the same time.
Based on the above analysis principle, as shown in fig. 5, the method of this embodiment specifically includes the following steps:
s1: analyzing the super block in the XFS file system to obtain a block size BLOCKSIZE, a sector size SECTORSIZE, an INDODE node size INODESIZE and a total block number TOTALBLOCKUMBER contained in the file system;
s2: setting the current offset (unit sector) CURRENTSECTOR to 2, and setting the used block number usedblocknuber to 0;
s3: judging whether the used block number USEDBLOCKUMBER is more than or equal to the total block number TOTALBLOCKUMBER contained in the file system, if so, ending; otherwise, reading a block from the CURRENTSECTOR sector, and analyzing according to the AG block head structure to obtain a block identifier AGMAGIC, a block number AGBLOCKUM, an allocated INDODE number AGUSEDINODENUMBER and a B + Tree root node position AGTREREROOT;
s4: if the block identifier AGMAGIC is not "XAGI" or the block number AGBLOCKUM is equal to 0, ending; otherwise, reading the B + Tree root node information according to the B + Tree root node position AGTREREROOT and analyzing the whole Tree according to the Tree structure;
s5: let us blocknumber be AGBLOCKNUM + useblocknumber,
CURRENTSECTOR ═ CURRENTSECTOR + (AGBLOCKNUM ═ blockksize/sectoresize), return to S3.
The leaf node parsing process in the step S4 includes the following steps:
s401: analyzing the leaf node to obtain a block identifier LNMAGIC and an INDODE group number LNINODECHUNKNUMBER of the leaf node;
s402: judging whether the block identifier LNMAGIC of the leaf node is equal to 'IABT', if so, setting the current INODE group pointer position CURRENTINODECHUNK (relative to the starting position of the leaf node) to 56, and entering S403; otherwise, go to S5;
s403: judging whether the current index group pointer position currentindedchunk is larger than or equal to the block size, if so, entering S5; otherwise, the current index group pointer position currentindedaterecord is regarded as the index group pointer record, and the start index number start (4 bytes, the information points to the start position of the index group), the idle index number freepointer (4 bytes) and the index idle bitmap freepointer map (8 bytes) are parsed and obtained, and the process proceeds to S404;
s404: judging whether the current index group pointer record is legal or not, if so, acquiring an index group (containing 64 index nodes) according to the initial index number STARTINODE, and analyzing the index groups one by one to acquire file and folder information; otherwise, go to S406;
s405: after judging whether the analyzed file or folder is a normal file or a deleted file, marking the file or folder to be normal or deleted;
s406: let currentindodechunk be currentindodechunk +16, return to S403.
The method for judging whether the index group pointer record in the embodiment is legal or not is as follows: when the NODE set pointer record satisfies (FREEEINODENUMBER > >8) equal to 64 and (FREEEINODENUMBER &0x000000FF) equal to the number of 1's in the 64-bit binary in FREEEINODE ITMAP, the INDODE set pointer record is legal; otherwise, it is illegal, wherein, FREEINODENUMBER represents the number of idle INODEs recorded by the INODE group pointer, and freeinodetmap represents the INODE idle bitmap recorded by the INODE group pointer.
The method for judging whether the analyzed file or folder is a normal file or a deleted file comprises the following steps: judging whether AGUSEDINODENUMBER is equal to 0 or (CURRENDIDECHUNK-56)/16 is greater than LNINDECECHUNKNUMBER, and if yes, judging that the file is deleted; otherwise, the file is determined to be a normal file, wherein the AGUSEDINODENUMBER indicates the number of allocated INODEs of the AG to which the file belongs, and the CURRENDINODECHUNK indicates the position of an INODE node group pointer pointing to the INODE node group at the corresponding leaf node.
To verify the correctness of the method of this example, the following experiment was performed. The experimental process is as follows:
1. newly building a partition with an XFS format, and copying a plurality of files/folders into the partition;
2. the "multi-threaded" folder under the "Data 1" folder was deleted and parsed using the mainstream tools on the market that support the XFS file system and the methods herein, the comparison results are shown in fig. 6 and 7.
As can be seen from the comparison between fig. 6 and fig. 7, the deleted folder and the information of the deleted file under the folder are analyzed by using the method of this embodiment, whereas the deleted file cannot be analyzed by using the conventional file system analysis technique in the tool of fig. 7, so that only the normal file information can be analyzed.
In the first embodiment of the invention, on the basis of conventional analysis of an XFS file system, the pointer information (including deletion) of all INDEE node groups is searched by combining a structure matching and checking algorithm, all the INDEE information is obtained based on the pointer information of the INDEE node groups, and normal and deleted files are further obtained by analysis. The method provides a solution for the quick analysis of the normal and deleted files of the XFS file system, provides effective technical support for the quick and deep analysis of electronic data evidence taking, and has great significance.
Example two:
the invention also provides an XFS file system analysis terminal device containing a deleted file, which comprises a memory, a processor and a computer program which is stored in the memory and can run on the processor, wherein the steps in the above method embodiment of the first embodiment of the invention are realized when the processor executes the computer program.
Further, as an executable scheme, the XFS file system analysis terminal device containing the deleted file may be a desktop computer, a notebook, a palm computer, a cloud server, or other computing devices. The XFS file system parsing terminal device with deleted files may include, but is not limited to, a processor, a memory. It is understood by those skilled in the art that the above-mentioned structure of the XFS file system parsing terminal device with deleted files is only an example of the XFS file system parsing terminal device with deleted files, and is not limited to the XFS file system parsing terminal device with deleted files, and may include more or less components than the above-mentioned structure, or combine some components, or different components, for example, the XFS file system parsing terminal device with deleted files may further include an input/output device, a network access device, a bus, etc., which is not limited by the embodiments of the present invention.
Further, as an executable solution, the Processor may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, a discrete hardware component, and the like. The general processor can be a microprocessor or the processor can be any conventional processor, etc., the processor is the control center of the XFS file system analysis terminal equipment containing the deleted files, and various interfaces and lines are utilized to connect all parts of the whole XFS file system analysis terminal equipment containing the deleted files.
The memory can be used for storing the computer program and/or the module, and the processor realizes various functions of the XFS file system analysis terminal equipment containing the deleted files by operating or executing the computer program and/or the module stored in the memory and calling the data stored in the memory. The memory can mainly comprise a program storage area and a data storage area, wherein the program storage area can store an operating system and an application program required by at least one function; the storage data area may store data created according to the use of the mobile phone, and the like. In addition, the memory may include high speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), at least one magnetic disk storage device, a Flash memory device, or other volatile solid state storage device.
The invention also provides a computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, carries out the steps of the above-mentioned method of an embodiment of the invention.
The integrated module/unit of the XFS file system parsing terminal device with deleted files may be stored in a computer-readable storage medium if it is implemented in the form of a software function unit and sold or used as an independent product. Based on such understanding, all or part of the flow of the method according to the embodiments of the present invention may also be implemented by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method embodiments may be implemented. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), software distribution medium, and the like.
While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (6)
1. An XFS file system analysis method containing deleted files is characterized by comprising the following steps:
s1: analyzing the super block in the XFS file system to obtain a block size BLOCKSIZE, a sector size SECTORSIZE, an INDODE node size INODESIZE and a total block number TOTALBLOCKUMBER contained in the file system;
s2: setting the current offset CURRENTSECTOR to be 2, and setting the used block number USEDBLOCKNUMBER to be 0;
s3: judging whether the used block number USEDBLOCKUMBER is more than or equal to the total block number TOTALBLOCKUMBER contained in the file system, if so, ending; otherwise, reading a block from the CURRENTSECTOR sector, and analyzing according to the AG block head structure to obtain a block identifier AGMAGIC, a block number AGBLOCKUM, an allocated INDODE number AGUSEDINODENUMBER and a B + Tree root node position AGTREREROOT;
s4: if the block identifier AGMAGIC is not "XAGI" or the block number AGBLOCKUM is equal to 0, ending; otherwise, reading the B + Tree root node information according to the B + Tree root node position AGTREREROOT and analyzing the whole Tree according to the Tree structure;
s5: let us blocknumber be AGBLOCKNUM + useblocknumber,
CURRENTSECTOR ═ CURRENTSECTOR + (AGBLOCKNUM ═ blockksize/sectoresize), return to S3.
2. The method for parsing XFS file system including deleted files according to claim 1, characterized in that: the leaf node parsing process in the step S4 includes the following steps:
s401: analyzing the leaf node to obtain a block identifier LNMAGIC and an INDODE group number LNINODECHUNKNUMBER of the leaf node;
s402: judging whether the block identifier LNMAGIC of the leaf node is equal to 'IABT', if so, setting the current INDODE group pointer position CURRENDEDECHUNK to 56, and entering S403; otherwise, go to S5;
s403: judging whether the current index group pointer position currentindedchunk is larger than or equal to the block size, if so, entering S5; otherwise, the current index group pointer position currentindedaterecord is regarded as the index group pointer record, and the initial index number STARTINODE, the idle index number FREEINODENUMBER and the index idle bitmap freeinodenblanket are obtained by analysis, and the step S404 is entered;
s404: judging whether the current index group pointer record is legal or not, if so, acquiring the index group according to the initial index number STARTINODE, and analyzing the indexes in the index group one by one to acquire file and folder information; otherwise, go to S406;
s405: after judging whether the analyzed file or folder is a normal file or a deleted file, marking the file or folder to be normal or deleted;
s406: let currentindodechunk be currentindodechunk +16, return to S403.
3. The method for parsing XFS file system including deleted files according to claim 2, characterized in that: in step S404, the method for determining whether the index group pointer record is legal is: when the NODE set pointer record satisfies (FREEEINODENUMBER > >8) equal to 64 and (FREEEINODENUMBER &0x000000FF) equal to the number of 1's in the 64-bit binary in FREEEINODE ITMAP, the INDODE set pointer record is legal; otherwise, it is illegal, wherein, FREEINODENUMBER represents the number of idle INODEs recorded by the INODE group pointer, and freeinodetmap represents the INODE idle bitmap recorded by the INODE group pointer.
4. The method for parsing XFS file system including deleted files according to claim 2, characterized in that: the method for judging whether the analyzed file or folder is a normal file or a deleted file comprises the following steps: judging whether AGUSEDINODENUMBER is equal to 0 or (CURRENDIDECHUNK-56)/16 is greater than LNINDECECHUNKNUMBER, and if yes, judging that the file is deleted; otherwise, the file is determined to be a normal file, wherein the AGUSEDINODENUMBER indicates the number of allocated INODEs of the AG to which the file belongs, and the CURRENDINODECHUNK indicates the position of an INODE node group pointer pointing to the INODE node group at the corresponding leaf node.
5. An XFS file system parsing terminal device containing a deleted file is characterized in that: comprising a processor, a memory and a computer program stored in the memory and running on the processor, the processor implementing the steps of the method according to any of claims 1 to 4 when executing the computer program.
6. A computer-readable storage medium storing a computer program, characterized in that: the computer program when executed by a processor implementing the steps of the method as claimed in any one of claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011387192.8A CN112380174B (en) | 2020-12-01 | 2020-12-01 | XFS file system analysis method containing deleted files, terminal device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011387192.8A CN112380174B (en) | 2020-12-01 | 2020-12-01 | XFS file system analysis method containing deleted files, terminal device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112380174A true CN112380174A (en) | 2021-02-19 |
| CN112380174B CN112380174B (en) | 2022-07-15 |
Family
ID=74589622
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011387192.8A Active CN112380174B (en) | 2020-12-01 | 2020-12-01 | XFS file system analysis method containing deleted files, terminal device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112380174B (en) |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104199888A (en) * | 2014-08-25 | 2014-12-10 | 厦门市美亚柏科信息股份有限公司 | Data recovery method and device for resilient file system |
| CN106021031A (en) * | 2016-05-30 | 2016-10-12 | 厦门市美亚柏科信息股份有限公司 | Deleted data restoration method and device of BTRFS file system |
| CN106155845A (en) * | 2016-08-02 | 2016-11-23 | 四川效率源信息安全技术股份有限公司 | A kind of restructuring restoration methods based on XFS file system data |
| CN110569147A (en) * | 2019-09-05 | 2019-12-13 | 厦门市美亚柏科信息股份有限公司 | Deleted file recovery method based on index, terminal device and storage medium |
| CN110659162A (en) * | 2019-09-27 | 2020-01-07 | 厦门市美亚柏科信息股份有限公司 | Data recovery method, device and system of TPSFS file system and storage medium |
| CN111400101A (en) * | 2020-03-18 | 2020-07-10 | 北京北亚宸星科技有限公司 | Data recovery method and system for deleting JFS2 file system data |
| US20200293499A1 (en) * | 2019-03-15 | 2020-09-17 | Fungible, Inc. | Providing scalable and concurrent file systems |
-
2020
- 2020-12-01 CN CN202011387192.8A patent/CN112380174B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104199888A (en) * | 2014-08-25 | 2014-12-10 | 厦门市美亚柏科信息股份有限公司 | Data recovery method and device for resilient file system |
| CN106021031A (en) * | 2016-05-30 | 2016-10-12 | 厦门市美亚柏科信息股份有限公司 | Deleted data restoration method and device of BTRFS file system |
| CN106155845A (en) * | 2016-08-02 | 2016-11-23 | 四川效率源信息安全技术股份有限公司 | A kind of restructuring restoration methods based on XFS file system data |
| US20200293499A1 (en) * | 2019-03-15 | 2020-09-17 | Fungible, Inc. | Providing scalable and concurrent file systems |
| CN110569147A (en) * | 2019-09-05 | 2019-12-13 | 厦门市美亚柏科信息股份有限公司 | Deleted file recovery method based on index, terminal device and storage medium |
| CN110659162A (en) * | 2019-09-27 | 2020-01-07 | 厦门市美亚柏科信息股份有限公司 | Data recovery method, device and system of TPSFS file system and storage medium |
| CN111400101A (en) * | 2020-03-18 | 2020-07-10 | 北京北亚宸星科技有限公司 | Data recovery method and system for deleting JFS2 file system data |
Non-Patent Citations (1)
| Title |
|---|
| 蓝朝祥等: "XFS文件系统的删除文件的恢复技术研究", 《计算机科学》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112380174B (en) | 2022-07-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106682186B (en) | File access control list management method and related device and system | |
| CN110569147B (en) | Deleted file recovery method based on index, terminal device and storage medium | |
| CN109710455B (en) | Deleted file recovery method and system based on FAT32 file system | |
| WO2020211236A1 (en) | Read-write conflict resolution method and apparatus employing b+ tree and storage medium | |
| US20080282355A1 (en) | Document container data structure and methods thereof | |
| CN109241003B (en) | File management method and device | |
| CN109976669B (en) | Edge storage method, device and storage medium | |
| WO2021129151A1 (en) | File backup method and apparatus, and terminal device | |
| US20140244582A1 (en) | Apparatus and Methods for Selective Location and Duplication of Relevant Data | |
| EP3788505B1 (en) | Storing data items and identifying stored data items | |
| CN111209257B (en) | File system fragmentation method and device | |
| CN115878027A (en) | Storage object processing method and device, terminal and storage medium | |
| CN115114232A (en) | Method, device and medium for enumerating historical version objects | |
| CN112379835B (en) | OOB area data extraction method, terminal device and storage medium | |
| CN112306957A (en) | Method and device for acquiring index node number, computing equipment and storage medium | |
| CN111176901B (en) | HDFS deleted file recovery method, terminal device and storage medium | |
| CN112965939A (en) | File merging method, device and equipment | |
| CN111309677A (en) | File management method and device of distributed file system | |
| CN112380174B (en) | XFS file system analysis method containing deleted files, terminal device and storage medium | |
| CN111045994A (en) | KV database-based file classification retrieval method and system | |
| CN113806803B (en) | Data storage method, system, terminal equipment and storage medium | |
| CN107748705B (en) | Method for recovering system EVT log fragments, terminal equipment and storage medium | |
| CN111444194B (en) | Method, device and equipment for clearing indexes in block chain type account book | |
| CN114416655A (en) | Hive file processing method and device, computer equipment and storage medium | |
| CN106991021B (en) | Method and system for constructing new data file from existing data file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |