CN114063927B - Evidence obtaining method and system for electronic data - Google Patents
Evidence obtaining method and system for electronic data Download PDFInfo
- Publication number
- CN114063927B CN114063927B CN202111396793.XA CN202111396793A CN114063927B CN 114063927 B CN114063927 B CN 114063927B CN 202111396793 A CN202111396793 A CN 202111396793A CN 114063927 B CN114063927 B CN 114063927B
- Authority
- CN
- China
- Prior art keywords
- channel
- channels
- information
- evidence obtaining
- host
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 22
- 238000006243 chemical reaction Methods 0.000 claims abstract description 23
- 238000013500 data storage Methods 0.000 claims abstract description 12
- 238000005192 partition Methods 0.000 claims description 2
- 101100284507 Schizosaccharomyces pombe (strain 972 / ATCC 24843) hdd1 gene Proteins 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
- G06F3/0601—Interfaces specially adapted for storage systems
- G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
- G06F3/062—Securing storage systems
- G06F3/0623—Securing storage systems in relation to content
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/42—User authentication using separate channels for security data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
- G06F3/0601—Interfaces specially adapted for storage systems
- G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
- G06F3/0638—Organizing or formatting or addressing of data
- G06F3/0643—Management of files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
- G06F3/0601—Interfaces specially adapted for storage systems
- G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
- G06F3/0671—In-line storage system
- G06F3/0673—Single storage device
- G06F3/0674—Disk device
- G06F3/0676—Magnetic disk device
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Human Computer Interaction (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The method comprises the steps of connecting a plurality of channels of evidence obtaining equipment with a host one by one, obtaining interface mark information corresponding to conversion modules of the channels, and writing the interface mark information into the corresponding interface conversion modules; connecting any channel in the channels with a host again, initializing history setting information of the current channel, writing interface mark information into a guide sector of a magnetic disk of the current channel, and setting the current channel as a main channel; copying the evidence obtaining application to a disk space of a main channel, connecting a plurality of channels with a host, and opening the evidence obtaining application after the host recognizes the channels; the evidence obtaining application divides the data of the host into a plurality of image files, and simultaneously saves the plurality of image files in a plurality of channels. The invention is portable and convenient, can be used for a specific department to effectively solve the problems of small data storage space and low speed of the evidence obtaining equipment when the specific department performs data acquisition on the target computer.
Description
Technical Field
The invention relates to the technical field of electronic data evidence obtaining, in particular to an evidence obtaining method and system for electronic data.
Background
With the rapid development of internet technology and computer technology, crimes related to the computer field are expanding, so that technical applications in the aspect of electronic data evidence collection are also updated continuously, such as portable electronic data evidence collection equipment, laboratory special fixed evidence collection equipment and the like.
In the field of electronic data evidence obtaining, hard disk data obtaining is an important means in field investigation, but along with the increase of the hard disk capacity and storage data of an evidence obtaining object host, the evidence obtaining time is long, the required storage space is large, so that very high requirements are put forward on evidence obtaining equipment, the portable evidence obtaining equipment is small in size, the capacity of the portable evidence obtaining equipment with the storage space is not large, the evidence obtaining speed is relatively not fast, and therefore, how to efficiently improve the evidence obtaining speed and meet the large capacity becomes a necessity to consider.
Disclosure of Invention
In order to solve the technical problems of long evidence obtaining time and large required storage space in the prior art, the invention provides an evidence obtaining method and system for electronic data, and aims to solve the technical problems.
According to one aspect of the present invention, there is provided a forensic method for electronic data, the method comprising:
s1: connecting a plurality of channels of the evidence obtaining equipment with a host one by one, acquiring interface mark information corresponding to the conversion modules of the channels, and writing the interface mark information into the corresponding interface conversion modules;
s2: connecting any channel in the channels with a host again, initializing history setting information of the current channel, writing interface mark information into a guide sector of a magnetic disk of the current channel, and setting the current channel as a main channel;
s3: copying the evidence obtaining application to a disk space of a main channel, connecting a plurality of channels with a host, and opening the evidence obtaining application after the host recognizes the channels; and
s4: the evidence obtaining application divides the data of the host into a plurality of image files, and simultaneously saves the plurality of image files in a plurality of channels.
In some specific embodiments, step S2 further includes initializing history setting information for channels other than the master channel, writing interface flag information into a boot sector of a disk of the corresponding channel, and setting the channel as a slave channel.
In some specific embodiments, the evidence obtaining application operates to read the information of the disk drive through the system api function, after judging the master-slave channel, respectively read the information of the preset disk guide sector, and in response to the information being matched with the preset information, take the storage space of the master-slave channel as the evidence obtaining data storage space.
In some specific embodiments, the disk drive information includes the number of drives, drive string information, and drive type.
In some specific embodiments, step S4 specifically includes the forensics application taking the disk data of the host to be forensic as an entire image, dividing the entire image into a plurality of small image files, and storing a first image from the main channel, and simultaneously storing a second image sequentially from the channel. The total storage space for evidence collection is the sum of the storage space of the main channel 1 and the storage space of the channel 2, so that the storage space for evidence collection is enlarged
In some specific embodiments, the evidence application automatically selects an idle channel to continue storing the new split image file according to the completion order of the image files of each channel. By means of the arrangement, the overall evidence obtaining speed can be improved at maximum efficiency.
According to a second aspect of the present invention, there is provided a forensic system for electronic data, the system comprising:
the interface mark information acquisition and input unit is configured to connect a plurality of channels of the evidence obtaining equipment with the host one by one, acquire interface mark information corresponding to the conversion modules of the channels, and write the interface mark information into the corresponding interface conversion modules;
a channel initializing unit configured to connect any one of the plurality of channels with the host again, initialize history setting information of a current channel, write interface flag information into a boot sector of a disk of the current channel, and set the current channel as a main channel;
a preparation unit: the method comprises the steps of configuring a disk space for copying a evidence obtaining application to a main channel, connecting a plurality of channels with a host, and opening and running the evidence obtaining application after the host recognizes the channels;
evidence obtaining unit: the method comprises the steps of configuring a evidence obtaining application to divide data of a host into a plurality of image files, and simultaneously storing the plurality of image files in a plurality of channels.
In some specific embodiments, the channel initializing unit further includes initializing history setting information for channels other than the master channel, writing interface flag information to a boot sector of a disk of the corresponding channel, and setting as the slave channel.
In some specific embodiments, the evidence obtaining application operates to read the information of the disk drive through the system api function, after judging the master-slave channel, respectively read the information of the preset disk guide sector, and in response to the information being matched with the preset information, take the storage space of the master-slave channel as the evidence obtaining data storage space, wherein the disk drive information comprises the number of drives, the character string information of the drives and the type of the drives.
In some specific embodiments, the forensic application uses the disk data of the host being forensic as an entire image, divides the entire image into a plurality of small image files, and stores a first image from the main channel while sequentially storing a second image from the channel. At this time, the total storage space for evidence collection is the sum of the storage space of the main channel 1 and the storage space of the channel 2, so that the storage space for evidence collection is enlarged.
In some specific embodiments, the evidence application automatically selects an idle channel to continue storing the new split image file according to the completion order of the image files of each channel. By means of the arrangement, the overall evidence obtaining speed can be improved at maximum efficiency.
The invention provides a evidence obtaining method and a system for electronic data, which can automatically expand the storage space of a main channel and a slave channel into a total storage space for storing evidence obtaining data when a computer is subjected to data evidence obtaining, and the total speed is the sum of the evidence obtaining speeds of the two channels. In the process of evidence collection, evidence collection software can finish the sequence according to the image files of each channel, and the evidence collection software automatically selects an idle channel to continuously store a new divided image file.
Drawings
The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and together with the description serve to explain the principles of the invention. Many of the intended advantages of other embodiments and embodiments will be readily appreciated as they become better understood by reference to the following detailed description. Other features, objects and advantages of the present application will become more apparent upon reading of the detailed description of non-limiting embodiments, made with reference to the following drawings, in which:
FIG. 1 is a flow chart of a method for forensic evidence of electronic data according to one embodiment of the present application;
FIG. 2 is a frame diagram of a forensic system for electronic data according to one embodiment of the present application;
fig. 3 is a frame structure diagram of a portable evidence obtaining device according to an embodiment of the present application.
Detailed Description
The present application is described in further detail below with reference to the drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention. It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings.
It should be noted that, in the case of no conflict, the embodiments and features in the embodiments may be combined with each other. The present application will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.
Fig. 1 shows a flowchart of a method for forensic evidence of electronic data according to an embodiment of the present application. As shown in fig. 1, the method includes:
s101: and connecting a plurality of channels of the evidence obtaining equipment with the host one by one, acquiring interface mark information corresponding to the conversion modules of the channels, and writing the interface mark information into the corresponding interface conversion modules.
In a specific embodiment, in combination with the dual-channel evidence obtaining device as shown in fig. 3, after the external interface of the channel 310 is connected to the PC host 330, after the external interface is connected, interface flag information corresponding to the conversion module of the channel 310 is displayed on the disk drive of the PC host 330, which is also called as a device interface description. This interface flag information is written into the interface conversion module beforehand by the configuration tool of the CPU controller module 312 in the evidence obtaining apparatus: the specified channel interface flag information is written in the configuration file, and then the conversion module channel interface flag of the channel 310 is set to HDD1 through the configuration tool of the CPU controller of the converter module 314, respectively, and the conversion module channel interface flag of the channel 320 is set to HDD2 in the same manner. When the portable device is connected to the PC host 330 after the setting is completed (at this time, both the channel 310 and the channel 320 are connected to the PC host 330), the corresponding interface descriptions are displayed on the disk drive of the PC host as HDD1 and HDD2, respectively.
S102: and connecting any channel in the channels with the host again, initializing the history setting information of the current channel, writing the interface mark information into the guide sector of the magnetic disk of the current channel, and setting the current channel as a main channel.
In a specific embodiment, after interface flag information of two channels is set, one of the channels is accessed to the PC host 330 again, a device initialization software tool stored in the PC host 330 is opened, and the channel of the corresponding disk is determined according to the accessed hardware interface description, if the interface description is HDD1, the history setting information of the channel is firstly cleared through the initialization tool, then the interface flag information HDD1 is written into the guide sector of the disk of the channel, and the disk identifier of the disk is set as the main channel; then another channel is accessed, and in the same step, the interface description information HDD2 of the other channel is written into the boot sector of the disk, and the disk drive of this channel is set as the slave channel.
S103: copying the evidence obtaining application to a disk space of a main channel, connecting a plurality of channels with a host, and opening the evidence obtaining application after the host recognizes the channels.
In a specific embodiment, both channels of the portable evidence obtaining device are connected to the target PC host 330, data evidence obtaining is performed on the target PC host 330, after the target PC host 330 recognizes the two channels of the portable evidence obtaining device, a evidence obtaining software system stored in the main channel 310 is opened, a evidence obtaining task management function is opened, the information of the evidence obtaining disk and the information of the disk of the portable device are recognized respectively, when the evidence obtaining software is operated, the evidence obtaining software reads the information of the disk drive through the api function of the operating system, the information includes the number of drives, the character string information of the drives, the type of the drives and the like, and is used for judging which disk drive interface descriptions are HDD1 and HDD2, after the channel information is recognized, the information preset in a disk guide sector is read respectively, if the read corresponding information also accords with the preset information, the evidence obtaining software automatically uses the storage spaces of the main channel 310 and the channel 320 of the portable device as evidence obtaining data storage spaces, namely the evidence obtaining system software can read the information of the disk drive, and judges that 1 is the evidence obtaining software system and the HDD data storage space according to the flag, and the HDD1 is the HDD storage space which is expandable data storage space.
S104: the evidence obtaining application divides the data of the host into a plurality of image files, and simultaneously saves the plurality of image files in a plurality of channels.
In a specific embodiment, during the forensics task, the forensics software uses the whole disk data of the PC host 330 to be forensics or a certain disk partition data as an image, and the forensics software divides the whole image into a plurality of small image files, and stores the first image from the main channel 310 and stores the second image from the channel 320, so that during the forensics process, the total storage space is the sum of the storage space of the main channel 310 and the storage space of the channel 320. In the process of evidence collection, evidence collection software can finish the sequence according to the image files of each channel, and the evidence collection software automatically selects an idle channel to continuously store a new divided image file, and because the reading speeds of the two channel disks are different, the completion time of each image is different. Thus, the overall forensic rate is increased by the maximum efficiency, so that the overall forensic rate is the sum of the forensic rate of the main channel 310 and the forensic rate of the channel 320.
Although the above embodiment only shows the technical solution of performing evidence obtaining by using two channels, it should be appreciated that a multi-channel evidence obtaining manner greater than two channels may be adopted, and the technical effects of the present invention may be obtained as well.
With continued reference to fig. 2, fig. 2 shows a frame diagram of a forensic system for electronic data according to embodiments of the present invention. The system specifically comprises an interface mark information acquisition and input unit 201, a channel initialization unit 202, a preparation unit 203 and a evidence obtaining unit 204, wherein the interface mark information acquisition and input unit 201 is configured to connect a plurality of channels of evidence obtaining equipment with a host one by one, acquire interface mark information corresponding to conversion modules of the channels, and write the interface mark information into the corresponding interface conversion modules; the channel initializing unit 202 is configured to connect any channel of the plurality of channels with the host again, initialize history setting information of the current channel, write interface flag information into a boot sector of a disk of the current channel, and set the current channel as a main channel; the preparation unit 203 is configured to copy the forensic application to the disk space of the main channel, connect the multiple channels with the host, and open the running forensic application after the host recognizes the multiple channels; the forensic unit 204 is configured to divide the data of the host into a plurality of image files by the forensic application while saving the plurality of image files in a plurality of channels.
Fig. 3 shows a frame structure diagram of a portable evidence obtaining device according to an embodiment of the present application, and as shown in fig. 3, the portable device is divided into a main channel 310 module and a channel 320 module, preferably, the two channels are visually distinguished by using silk screening on a device housing, and the two channels are independent modules in hardware and are not related in hardware. The main channel 310 module comprises 1 path of data storage module 313,1 electronic data evidence obtaining software system modules, 1 interface conversion module 314, CPU control module 312,1 power supply modules 311 and the like; the channel 320 module comprises 1 path of data storage module 321,1 interface conversion modules 322, CPU control module 324,1 power supply modules 323 and the like; in the present portable device, the main channel 310 is used as a main channel, which is not only a storage place of the forensic system, but also a storage space of forensic data, and the channel 320 is an expandable storage space. When the data is obtained by the computer, the method can automatically expand the storage space of the main channel 301 and the storage space of the channel 320 into a total storage space for storing the obtained evidence data, and the total speed is the sum of the obtained evidence speeds of the two channels. In each channel, the data storage module is connected with the interface conversion module, the interface conversion module is connected with the CPU control module, and the power supply module provides stable power supply for each module. When the portable device is in use, the other port (USB 3.1 port) of the interface conversion module is connected with the PC host to be forensized, wherein the main channel 310 and the channel 320 are respectively connected with the PC host to be forensized 330, and data in the storage module of the PC host to be forensized 330 is a forensic object. The device is small in size, portable and convenient, and can be used for a specific department to effectively solve the problems of small data storage space and low speed of evidence obtaining equipment when the specific department performs data acquisition on a target computer.
The foregoing description is only of the preferred embodiments of the present application and is presented as a description of the principles of the technology being utilized. It will be appreciated by persons skilled in the art that the scope of the invention referred to in this application is not limited to the specific combinations of features described above, but it is intended to cover other embodiments in which any combination of features described above or equivalents thereof is possible without departing from the spirit of the invention. Such as the above-described features and technical features having similar functions (but not limited to) disclosed in the present application are replaced with each other.
Claims (7)
1. A method for forensic use with electronic data, comprising:
s1: connecting a plurality of channels of evidence obtaining equipment with a host one by one, acquiring interface mark information corresponding to a conversion module of each channel, and writing the interface mark information into the corresponding interface conversion module;
s2: connecting any channel of the channels with the host again, initializing history setting information of a current channel, writing interface mark information into a guide sector of a magnetic disk of the current channel, setting the current channel as a main channel, initializing history setting information of other channels except the main channel, writing the interface mark information into the guide sector of the magnetic disk of a corresponding channel, and setting the interface mark information as a slave channel;
s3: copying the evidence obtaining application to a disk space of the main channel, connecting the channels with the host, and opening and running the evidence obtaining application after the host recognizes the channels; and
s4: the forensic application divides the data of the host into a plurality of image files, simultaneously saves the image files in the channels,
and the evidence obtaining application operates to read the disk driver information through a system api function, respectively reads the information of the guide sector of the preset disk after judging the master-slave channel, and takes the storage space of the master-slave channel as the evidence obtaining data storage space in response to the fact that the information of the guide sector of the read preset disk is matched with the preset information.
2. The method of claim 1, wherein the disk drive information includes a number of drives, drive string information, and a drive type.
3. The method according to claim 1, wherein step S4 specifically includes the forensic application dividing the disk data of the host being forensic as a whole image into a plurality of small image files, and storing a first image from the main channel and a second image sequentially from the sub channel.
4. A method for forensic use on electronic data according to claim 3 in which the forensic application automatically selects an idle channel to continue storing a new split image file according to the completion order of the image files of each channel.
5. A forensic system for electronic data, the system comprising:
the interface mark information acquisition and input unit is configured to connect a plurality of channels of the evidence obtaining equipment with the host one by one, acquire interface mark information corresponding to the conversion modules of the channels, and write the interface mark information into the corresponding interface conversion modules;
a channel initializing unit configured to connect any one channel of the plurality of channels with the host again, initialize history setting information of a current channel, write the interface flag information into a boot sector of a disk of the current channel, set the current channel as a master channel, initialize history setting information of other channels except the master channel, write the interface flag information into a boot sector of a disk of a corresponding channel, and set the interface flag information as a slave channel;
a preparation unit: the host computer is configured to copy the evidence obtaining application to a disk space of the main channel, connect the channels with the host computer, and open and run the evidence obtaining application after identifying the channels;
evidence obtaining unit: the method comprises the steps that the evidence obtaining application is configured to divide data of the host into a plurality of image files, and meanwhile the image files are stored in a plurality of channels;
and the evidence obtaining application operates to read the disk driver information through a system api function, respectively reads the information of the guide sector of the preset disk after judging the master-slave channel, and takes the storage space of the master-slave channel as the evidence obtaining data storage space in response to the fact that the information of the guide sector of the read preset disk is matched with the preset information.
6. The forensic system for electronic data according to claim 5 wherein the forensic application takes the disk data of the host being forensic as an entire image, partitions the entire image into small image files, saves a first image from the primary channel, and saves a second image sequentially from the secondary channel.
7. The forensic system for electronic data according to claim 6 in which the forensic application automatically selects an idle channel to continue storing new split image files based on the completion of each channel image file.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111396793.XA CN114063927B (en) | 2021-11-23 | 2021-11-23 | Evidence obtaining method and system for electronic data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111396793.XA CN114063927B (en) | 2021-11-23 | 2021-11-23 | Evidence obtaining method and system for electronic data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114063927A CN114063927A (en) | 2022-02-18 |
| CN114063927B true CN114063927B (en) | 2024-03-26 |
Family
ID=80275605
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111396793.XA Active CN114063927B (en) | 2021-11-23 | 2021-11-23 | Evidence obtaining method and system for electronic data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114063927B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2005125084A1 (en) * | 2004-06-21 | 2005-12-29 | Echoworx Corporation | Method, system and computer program for protecting user credentials against security attacks |
| CN102681790A (en) * | 2012-03-02 | 2012-09-19 | 南京拓界信息技术有限公司 | Data dump device and method and system for data dump by same |
| CN107967118A (en) * | 2016-10-19 | 2018-04-27 | 南京拓界信息技术有限公司 | A kind of method and apparatus realized hard disc data high speed dump and checked |
| CN112333015A (en) * | 2020-10-28 | 2021-02-05 | 重庆紫光华山智安科技有限公司 | Media data storage method, device, system, electronic equipment and storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140244699A1 (en) * | 2013-02-26 | 2014-08-28 | Jonathan Grier | Apparatus and Methods for Selective Location and Duplication of Relevant Data |
-
2021
- 2021-11-23 CN CN202111396793.XA patent/CN114063927B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2005125084A1 (en) * | 2004-06-21 | 2005-12-29 | Echoworx Corporation | Method, system and computer program for protecting user credentials against security attacks |
| CN102681790A (en) * | 2012-03-02 | 2012-09-19 | 南京拓界信息技术有限公司 | Data dump device and method and system for data dump by same |
| CN107967118A (en) * | 2016-10-19 | 2018-04-27 | 南京拓界信息技术有限公司 | A kind of method and apparatus realized hard disc data high speed dump and checked |
| CN112333015A (en) * | 2020-10-28 | 2021-02-05 | 重庆紫光华山智安科技有限公司 | Media data storage method, device, system, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114063927A (en) | 2022-02-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP1650665B1 (en) | File management method and information processing device | |
| CA2630282C (en) | Method and system for carrying multiple suspended runtime images | |
| KR100942894B1 (en) | Software-aided storage device emulation in a physical storage device | |
| US8074038B2 (en) | Converting luns into files or files into luns in real time | |
| CN1716204A (en) | Systems and methods for development of emulated devices in a virtual machine environment | |
| WO2016110004A1 (en) | Management method and apparatus for disk storage space, and storage device | |
| EP2122471A1 (en) | Unified support for solid state storage | |
| US20080117548A1 (en) | Storage Device And Storage System | |
| KR20110021125A (en) | Method and apparatus for recovering partition | |
| US20060164743A1 (en) | Method for copying source data from a source hard disk to multiple target hard disks | |
| US8949255B1 (en) | Methods and apparatus for capture and storage of semantic information with sub-files in a parallel computing system | |
| US20140365724A1 (en) | System and method for converting disk partition format | |
| US8131966B2 (en) | System and method for storage structure reorganization | |
| CN114063927B (en) | Evidence obtaining method and system for electronic data | |
| CN114036079A (en) | Mapping table compression method and system, memory controller, solid state disk and data reading method | |
| CN101645048B (en) | Method for realizing computer virtualized evidence obtaining | |
| TW201504937A (en) | Virtual storage devices formed by selected partitions of a physical storage device | |
| CN107544865A (en) | A kind of quick available method and apparatus of Backup Data | |
| CN101893999A (en) | System for virtually partitioning storage device into multiple devices | |
| US9354911B2 (en) | Method and system for logging into a virtual environment executing on a host | |
| US8452820B2 (en) | Logical partition configuration data file creation | |
| US20200004592A1 (en) | Hybridized storage optimization for genomic workloads | |
| CN105446601A (en) | Playlist management method and mobile terminal | |
| US20080004857A1 (en) | Restoring base configuration on software testing computer | |
| CN101493844B (en) | Method and apparatus for implementing multiple main interfaces for embedded memory |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |