CN115878571A - Method and system for acquiring and recovering file information on disk - Google Patents
Method and system for acquiring and recovering file information on disk Download PDFInfo
- Publication number
- CN115878571A CN115878571A CN202211418262.0A CN202211418262A CN115878571A CN 115878571 A CN115878571 A CN 115878571A CN 202211418262 A CN202211418262 A CN 202211418262A CN 115878571 A CN115878571 A CN 115878571A
- Authority
- CN
- China
- Prior art keywords
- file
- information
- deleted
- record
- list
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a method and a system for acquiring and recovering file information on a disk, wherein the method comprises the following steps: acquiring an information list I and a deletion record list; if the initial cluster number of the deleted file in the file system of the target disk is complete, finding out an item recorded with the same initial cluster number, and endowing file information to corresponding file naked data; otherwise, forming an information list II; comparing the information list II with the deleted record list, if the data type suffixes are consistent and the initial cluster numbers of the files are also consistent, preferentially matching, and giving the file information in the deleted file record item to corresponding file naked data; otherwise, finding out the same file initial cluster number item, and endowing the file information to the corresponding file naked data. The method analyzes and records the related data structure information of the current sector, adds the related data structure information into the information list, and compares the bare data with the file information obtained by the file system analysis, thereby completing the original file information of the bare data recorded in the bare data queue.
Description
Technical Field
The invention belongs to the technical field of disk recovery, and particularly relates to a method and a system for acquiring and recovering file information on a disk.
Background
When the disk data needs to be restored to analyze the disk data, only the naked data (pure file data content) of the file is obtained, and complete information such as the file name, the file creation time, the file modification time, the file size and the like of the file is not obtained. The user cannot correctly find the specific lost file, so that the disk recovery effect is greatly reduced.
Disclosure of Invention
In view of this, the present invention provides a method and a system for obtaining and recovering file information on a disk, which match bare data with file information when recovering user data to obtain a complete recovery file.
In order to solve the above technical problems, the technical solution of the present invention is to adopt a method for obtaining and recovering file information on a disk, comprising:
performing data scanning on a target disk sector by sector, acquiring data structure information of each sector, forming an information record item, storing the information record item in an information list I, recording a deleted file in the sector, forming a deleted file record item, and storing the deleted file record item in a deleted record list; the elements of the information recording item comprise a sector number of a current sector, a starting cluster number, whether identifiable type data exists, an identified data type suffix and whether continuous effective characters exist; the elements of the deleted record item comprise a file starting cluster number and file basic information;
if the initial cluster number of the deleted file in the file system of the target disk is complete, comparing the deleted record list with the information list I one by one, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file naked data; if the high order of the initial cluster number of the deleted file in the file system of the target disk is lost, erasing the high order of the initial cluster number recorded by all information recording items in the information list to form an information list II;
comparing the information list II with the deleted record list item by item, if the identified data type suffix recorded in the information record item is consistent with the file suffix recorded in a deleted file record item and the initial cluster number is also consistent, preferentially matching, and endowing the file information in the deleted file record item with corresponding file naked data;
and comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out deleted file record items and information record items recorded with the same file starting cluster number, and endowing the file information of the deleted file record items with corresponding file naked data.
As an improvement, the method for acquiring the information list I and the deleted record list comprises the following steps:
judging whether the current sector contains one of file data of identifiable file types, continuous visible characters or complete words and deleted file records; if the file data contains file data with identifiable file types, or continuous visible characters or complete words, creating an information record item and adding the information record item to an information list I; if the deleted file record is included, a deleted file record item is created and added to the deleted record list.
As a further improvement, before determining whether the current sector contains file data of a recognizable file type, consecutive visible characters, or complete words, determining whether the current sector is cluster-aligned:
if not, judging whether the current sector data has a deleted file record, if so, creating a deleted file record item to be added into a deleted record list and scanning the next sector;
if the current sector is aligned with the invisible character, judging whether the first N bytes of the current sector are all invisible characters, and if so, scanning the next sector.
As another further improvement, before judging whether the current sector contains file data of an identifiable file type, constructing a Bitmap based on a real file of a file system and a folder record, judging whether all the first N bytes of the current sector are 0, and if so, scanning the next sector;
if not, whether the current sector is occupied by the real file or the file folder is continuously judged, and if the current sector is occupied, the next sector is scanned.
As an improvement, the method for erasing the high order bits of the start cluster number of all information record items recorded in the information list comprises:
starting cluster number and 2 for recording information recording item 16 And performing a modulus operation.
The invention also provides a system for acquiring and recovering file information on a disk, which comprises:
a list-obtaining module for obtaining a list of the users,
the system is used for scanning data of a target disk sector by sector, acquiring data structure information of each sector, forming an information record item and storing the information record item in an information list I, and recording a deleted file in the sector to form a deleted file record item and storing the deleted file record item in a deleted record list;
the information recording device is used for erasing the high order of the initial cluster numbers recorded by all the information recording items in the information list to form an information list II;
a comparison and judgment module for comparing the received signals,
the file deleting system is used for comparing the deleted record list with the information list I one by one, if the initial cluster number of a deleted file in the file system of the target disk is complete, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file naked data;
the file type suffix matching module is used for comparing the information list II with the deleted record list item one by one, preferentially matching the identified data type suffix recorded in the information record item with the file suffix recorded in a deleted file record item if the identified data type suffix is consistent with the file suffix recorded in the deleted file record item and the initial cluster number is also consistent, and endowing the file information in the deleted file record item with corresponding file naked data;
and the file management module is used for comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out the deleted file record items and the information record items which are recorded with the same file start cluster numbers, and endowing the file information of the deleted file record items with corresponding file bare data.
As an improvement, the list acquisition module comprises:
the recognizable file type judging module is used for judging whether the current sector contains file data of a recognizable file type, and if so, an information recording item is created and added into the information list I;
the continuous visible data judgment module is used for judging whether the first N bytes of the current sector contain continuous visible characters or complete words or not, and if so, creating an information recording item and adding the information recording item into the information list I;
and the deleted file record judging module is used for judging whether the deleted file record exists in the current sector data or not, and if so, creating a deleted file record item and adding the deleted file record item into the deleted record list.
As an improvement, the list acquisition module further comprises:
the cluster alignment judging module is used for judging whether the current sector is cluster aligned or not; if not, judging whether the current sector data has a deleted file record, and if so, creating a deleted file record item and adding the deleted file record item into a deleted record list; if the characters are aligned, whether all the first N bytes of the current sector are invisible characters is judged.
As an improvement, the list acquisition module further comprises:
the occupation judgment module is used for constructing a Bitmap based on the real file and the folder record of the file system and judging whether all the first N bytes of the current sector are 0; if not, whether the current sector is occupied by the real file or the file folder is continuously judged.
The invention also provides a computer device, comprising a processor and a memory, and being characterized in that: the memory stores a computer program, and the processor can realize the method for acquiring and recovering the file information on the disk when executing the computer program.
The invention has the advantages that:
according to the method, the user disk data are scanned sector by sector, the related data structure information of the current sector is analyzed and recorded, the related data structure information is added into an information list, and the bare data and the file information obtained by file system analysis are compared, so that the original file information of the bare data recorded in the bare data queue is completed, and the correct lost file of the user is found.
Meanwhile, the invention can solve the problems that after the EXT4 file system deletes the file, the size of the deleted file is zero and the cluster chain of the file data is lost; the problem that the high order of the deleted file is lost after the FAT32 file system is deleted can also be solved.
Drawings
FIG. 1 is a flow chart of the present invention.
FIG. 2 is a flow chart of step 1.
Fig. 3 is a schematic diagram of the structure of the present invention.
Detailed Description
In order that those skilled in the art will better understand the technical solutions of the present invention, the present invention will be further described in detail with reference to the following embodiments.
The term is defined as:
real files, real folders: undeleted files, folders that exist in the file system.
Bare data: the file contents of the file information are lacking.
NTFS (New Technology File System) File System: the system is a disk format which is supported by a serial operating system of a Windows NT kernel and is particularly designed for management security characteristics such as network and disk quotas, file encryption and the like, provides long filenames, data protection and recovery, can realize security through directory and file permission, and supports spanning partitions.
FAT (File Allocation Table) 32 File System: the file allocation table is a disk file management method adopting 32-bit binary number record management.
EXT4 file system: the journal file system under the Fourth generation Extended file system (abbreviated EXT 4) Linux system is a successor version of the EXT3 file system.
In the file system, after a user deletes a file, the file system does not erase the real data of the user file, but only deletes a file record recording the file and removes and records some related information of the file record. For example, the EXT4 file system may empty cluster chain information of a file, the FAT32 file system may empty a FAT table and empty high-order information of a starting cluster of the file record, the NTFS file system may modify a file record as a deletion flag, remove the record from a B + tree of the NTFS file system, and update deletion information of the record in a $ logfile and a $ usnjnl file, and the like.
Therefore, in order to restore the file completely, file information needs to be found and associated with the naked data via the file information.
In order to solve this problem, the present invention provides a method for acquiring and recovering file information on a disk as shown in fig. 1, comprising the following steps:
s1, scanning data of a target disk sector by sector, acquiring data structure information of each sector, forming an information record item, storing the information record item in an information list I, recording a deleted file in the sector, forming a deleted file record item, and storing the deleted file record item in a deleted record list; the elements of the information recording item comprise a sector number of a current sector, a starting cluster number, whether identifiable type data exists, an identified data type suffix and whether continuous effective characters exist; the elements of the deleted entry include a file start cluster number and file basic information. The specific steps shown in fig. 3 are as follows:
s11, constructing a Bitmap based on the real file and the folder record of the file system; the sectors occupied by the real files and the folders are marked in the bitmap, and the purpose is to facilitate the later judgment of whether the sectors are occupied by the real files and the folders.
S12, judging whether all the first N bytes of the current sector are 0, and scanning the next sector if the first N bytes of the current sector are 0; in this step, N may be set as a threshold according to actual conditions. In the present invention, the threshold N may also occur in the remaining steps, and N in all the steps may be the same or different, and is not limited. The purpose of this step is to determine whether the sector is empty, and if the sector is empty, the data scanning is not performed, thereby saving the system overhead.
S13, if not, continuously judging whether the current sector is occupied by the real file or the file folder, and if so, scanning the next sector. Judging through the Bitmap established in the previous step, if the sector is marked as occupied by a real file or a folder, scanning is not performed, and the same is to save the system overhead. The reason is that the sector occupied by the real file or folder stores the data of the real file or folder, and the data needing to be restored does not exist.
The order of steps S12 and S13 may be reversed.
S14, judging whether the current sector is aligned, if not, judging whether the current sector data has deleted file records, and if so, creating a deleted file record item to be added into a deleted record list and scanning the next sector.
The term "cluster alignment" refers to that if each cluster includes 8 sectors, only the sectors with sector numbers being multiples of 8 are analyzed and determined subsequently, and the sectors with non-cluster-aligned are analyzed and determined for deleting file records. Because the data is stored in the disk by taking the cluster as a unit, each cluster can only store the data belonging to the same file. E.g., sectors 0-31, where 0-7 are one cluster, 8-15 one cluster, 16-23 one cluster, 24-31 one cluster. If the sector numbers are 0, 8, 16 and 24, the process is called cluster alignment, and at this time, the subsequent analysis work is required to jump to step S15, and if the sector numbers are other sector numbers, the sector numbers are considered to have been analyzed, and only the analysis judgment of deleting the file record needs to be performed. The method aims to reduce the system overhead and improve the scanning efficiency.
Analysis of deleted file records for non-cluster aligned sectors is performed because corrupted data, such as typical data corrupted by a virus, is also recovered in addition to the deleted data. The data corruption caused by the virus is also the most probable cluster-aligned writing of some data to overwrite the file data on the disk or the recorded data of the folder. After the virus clears 0 the cluster-aligned sectors or writes garbage data, the normal file system cannot find the files. But the cluster has the possibility of file recording information in addition to the damaged data of the cluster-aligned sectors. Although these file record information are "free", they are still useful, and therefore, it is necessary to analyze it to determine whether there is a file record to be deleted.
S15, if the characters are aligned, whether all the first N bytes of the current sector are invisible characters is judged, and if yes, the next sector is scanned. The invisible character cannot be processed and therefore a jump to the next sector is required. N as a threshold value can be set according to actual conditions.
S16, judging whether the current sector contains file data with identifiable file types, if so, creating an information recording item, adding the information recording item into the information list I, and scanning the next sector.
For example, when the current sector is analyzed to have a recognizable file type such as a picture, an information record item is created to record the current sector number, the start cluster number, and the suffix of the file type jpg is added to the information list, and then the next sector is scanned.
S17 if not, judging whether the first N bytes of the current sector contain continuous visible characters or complete words, if so, creating an information recording item, adding the information recording item into the information list I, and scanning the next sector.
The purpose of this step is to analyze and determine whether useful data exists in the current sector, where N is a threshold that can be set according to actual situations. By continuously visible characters is meant 2 or more than 2 continuously visible characters. And the words in the sector are separated by 0x20 or 0x00 and thus can be recognized by 0x20 or 0x 00. Similarly, when the analysis determines that the current sector contains consecutive visible characters or complete words, an information entry is also created and added to the information list I and the next sector is scanned.
S18, if the previous N bytes of the current sector do not contain continuous visible characters or complete words, judging whether deleted file records exist in the data of the current sector, if so, creating a deleted file record item to be added into a deleted record list and scanning the next sector, and if not, directly scanning the next sector.
S16-S18 are used for judging whether the current sector contains one of file data, continuous visible characters or complete words and deleted file records with identifiable file types; since the data in the sector may only be one of the three or none, the order of S16-S18 may be reversed.
And repeating the steps S12 to S18 until all the sectors are scanned.
S2, if the initial cluster number of the deleted file in the file system of the target disk is complete, comparing the deleted record list with the information list I one by one, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file bare data; if the high order of the initial cluster number of the deleted file in the file system of the target disk is lost, the high order of the initial cluster number recorded by all the information recording items in the information list is erased to form an information list II.
This step performs a distinction process for different file systems.
If the initial cluster number of the deleted file in the file system of the target disk is complete as the NTFS file system, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file naked data; for example, the file start cluster number recorded in a certain deleted file entry is 619982, and a certain file entry contains the naked data with the same start cluster number, that is, the file information contained in the deleted file entry is given to the naked data to form complete file data.
If the high order of the initial cluster number of the deleted file in the file system of the target disk is lost like the FAT32 file system, the high order of the initial cluster number recorded by all the information recording items in the information list is erased to form an information list II. The method for erasing the high order of the initial cluster number specifically comprises the following steps:
starting cluster number and 2 for recording information recording item 16 And performing a modulus operation. For example, if the start cluster number recorded in an information recording item is 619982, the start cluster number after erasing the high bits is 619982% 16 =30158. The start cluster number is represented by four bytes, one byte 8 bits, the upper bits of which are 2 bytes for 16 bits, and thus 2 bytes 16 And performing a modulus operation. The information list II is a new list formed by erasing the high order bits of the start cluster number recorded in each information recording item.
S3, the information list II is compared with the deleted record list item by item, if the identified data type suffixes recorded in the information record items are consistent with the file suffixes recorded in a certain deleted file record item and the initial cluster numbers are also consistent, the data type suffixes are preferably matched, and the file information in the deleted file record item is endowed with corresponding file naked data. And preferentially matching the records recorded with the same data type and the same initial cluster number, and endowing the file information with corresponding file naked data so as to obtain complete file data.
S4, comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out deleted file record items and information record items which are recorded with the same file start cluster number, and endowing the file information of the deleted file record items with corresponding file bare data. And if all the information record items in the information list II are compared, the whole process is ended.
As shown in fig. 3, the present invention further provides a system for acquiring and recovering file information on a disk, including:
a list-obtaining module for obtaining a list of the users,
the system comprises a data acquisition unit, a data storage unit and a data processing unit, wherein the data acquisition unit is used for acquiring data structure information of each sector, forming an information recording item and storing the information recording item in an information list I, and recording deleted files in the sectors into deleted file recording items and storing the deleted file recording items in a deleted recording list;
and erasing the high order bits of the initial cluster numbers recorded by all the information recording items in the information list to form an information list II.
A comparison and judgment module for comparing the received signals,
the information management system is used for comparing the deleted record list with the information list I one by one, if the initial cluster number of a deleted file in the file system of the target disk is complete, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file naked data;
the file type suffix matching module is used for comparing the information list II with the deleted record list item by item, if the identified data type suffix recorded in the information record item is consistent with the file suffix recorded in a deleted file record item and the initial cluster number is also consistent, the data type suffix is preferably matched, and the file information in the deleted file record item is endowed with corresponding file naked data;
and the file management module is used for comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out the deleted file record items and the information record items which are recorded with the same file starting cluster numbers, and endowing the file information of the deleted file record items with corresponding file naked data.
The list acquisition module specifically comprises:
the occupation judgment module is used for constructing a Bitmap based on the real file of the file system and the folder record and judging whether all the first N bytes of the current sector are 0; if not, whether the current sector is occupied by the real file or the folder is continuously judged.
The cluster alignment judging module is used for judging whether the current sector is cluster aligned or not; if not, judging whether the current sector data has a deleted file record, and if so, creating a deleted file record item and adding the deleted file record item into a deleted record list; if the characters are aligned, whether all the first N bytes of the current sector are invisible characters is judged.
The recognizable file type judging module is used for judging whether the current sector contains file data of a recognizable file type, and if so, an information recording item is created and added into the information list I;
the continuous visible data judgment module is used for judging whether the first N bytes of the current sector contain continuous visible characters or complete words or not, and if so, creating an information recording item and adding the information recording item into the information list I;
and the deleted file record judging module is used for judging whether the deleted file record exists in the current sector data or not, and if so, creating a deleted file record item and adding the deleted file record item into the deleted record list.
The present invention also provides a computer device comprising a processor and a memory, wherein: the memory stores a computer program, and the processor can realize the method for acquiring and recovering the file information on the disk when executing the computer program.
The above are only preferred embodiments of the present invention, and it should be noted that the above preferred embodiments should not be considered as limiting the present invention, and the protection scope of the present invention should be subject to the scope defined by the claims. It will be apparent to those skilled in the art that various modifications and adaptations can be made without departing from the spirit and scope of the invention, and should be considered to be within the scope of the invention.
Claims (10)
1. A method for acquiring and recovering file information on a disk is characterized by comprising the following steps:
performing data scanning on a target disk sector by sector, acquiring data structure information of each sector, forming an information record item, storing the information record item in an information list I, recording a deleted file in the sector, forming a deleted file record item, and storing the deleted file record item in a deleted record list; the elements of the information recording item comprise a sector number of a current sector, a starting cluster number, whether identifiable type data exists, an identified data type suffix and whether continuous effective characters exist; the elements of the deleted record item comprise a file start cluster number and file basic information;
if the initial cluster number of the deleted file in the file system of the target disk is complete, comparing the deleted record list with the information list I one by one, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number, and endowing the file information of the deleted file record item with corresponding file naked data; if the high order of the initial cluster number of the deleted file in the file system of the target disk is lost, the high order of the initial cluster number recorded by all the information recording items in the information list is erased to form an information list II;
comparing the information list II with the deleted record list item by item, if the identified data type suffix recorded in the information record item is consistent with the file suffix recorded in a deleted file record item and the initial cluster number is also consistent, preferentially matching, and endowing the file information in the deleted file record item with corresponding file naked data;
and comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out deleted file record items and information record items recorded with the same file starting cluster number, and endowing the file information of the deleted file record items with corresponding file naked data.
2. The method for acquiring and recovering file information on a disk according to claim 1, wherein the method for acquiring the information list I and the deleted record list is as follows:
judging whether the current sector contains one of file data of identifiable file types, continuous visible characters or complete words and deleted file records; if the file data contains file data with identifiable file types, or continuous visible characters or complete words, creating an information record item and adding the information record item to an information list I; if the deleted file record is contained, creating a deleted file record item and adding the deleted file record item to a deleted record list.
3. The method of claim 2, wherein before determining whether the current sector contains file data of recognizable file types, consecutive visible characters, or complete words, determining whether the current sector is cluster-aligned:
if not, judging whether the current sector data has a deleted file record, if so, creating a deleted file record item to be added into a deleted record list and scanning the next sector;
if the characters are aligned, judging whether all the first N bytes of the current sector are invisible characters, and if so, scanning the next sector.
4. The method for acquiring and recovering file information on a disk as claimed in claim 2, wherein: before judging whether the current sector contains file data with an identifiable file type, constructing a Bitmap based on a real file of a file system and a folder record, judging whether all the first N bytes of the current sector are 0, and scanning the next sector if all the first N bytes of the current sector are 0;
if not, whether the current sector is occupied by the real file or the file folder is continuously judged, and if the current sector is occupied, the next sector is scanned.
5. The method of claim 1, wherein erasing the high order bits of the start cluster number of all information entry records in the information list comprises:
starting cluster number and 2 for recording information recording item 16 And performing a modulus operation.
6. A system for retrieving and restoring file information on a disk, comprising:
a list-obtaining module for obtaining a list of the users,
the system is used for scanning data of a target disk sector by sector, acquiring data structure information of each sector, forming an information record item and storing the information record item in an information list I, and recording a deleted file in the sector to form a deleted file record item and storing the deleted file record item in a deleted record list;
the information recording device is used for erasing the high order of the initial cluster numbers recorded by all the information recording items in the information list to form an information list II;
a comparison and judgment module for comparing the received signals,
the file deleting system is used for comparing the deleted record list with the information list I one by one, if the initial cluster number of a deleted file in a file system of a target disk is complete, finding out a deleted file record item and an information record item which are recorded with the same initial cluster number of the file, and endowing file information of the deleted file record item with corresponding file naked data;
the file type suffix matching module is used for comparing the information list II with the deleted record list item one by one, preferentially matching the identified data type suffix recorded in the information record item with the file suffix recorded in a deleted file record item if the identified data type suffix is consistent with the file suffix recorded in the deleted file record item and the initial cluster number is also consistent, and endowing the file information in the deleted file record item with corresponding file naked data;
and the file management module is used for comparing the deleted record list with the information record items which are not preferentially matched in the information list II one by one, finding out the deleted file record items and the information record items which are recorded with the same file start cluster numbers, and endowing the file information of the deleted file record items with corresponding file bare data.
7. The system for retrieving and restoring file information from a disk as claimed in claim 6, wherein the list retrieving module comprises:
the recognizable file type judging module is used for judging whether the current sector contains file data of a recognizable file type or not, and if so, creating an information recording item and adding the information recording item into the information list I;
the continuous visible data judgment module is used for judging whether the first N bytes of the current sector contain continuous visible characters or complete words or not, and if so, creating an information recording item and adding the information recording item into the information list I;
and the deleted file record judging module is used for judging whether the deleted file record exists in the current sector data or not, and if so, creating a deleted file record item and adding the deleted file record item into the deleted record list.
8. The system for retrieving and recovering file information from a disk as claimed in claim 7, wherein said list retrieving module further comprises:
the cluster alignment judging module is used for judging whether the current sector is cluster aligned or not; if not, judging whether the current sector data has a deleted file record, and if so, creating a deleted file record item and adding the deleted file record item into a deleted record list; if the characters are aligned, whether all the first N bytes of the current sector are invisible characters is judged.
9. The system for retrieving and restoring file information from a disk as claimed in claim 7, wherein said list retrieving module further comprises:
the occupation judgment module is used for constructing a Bitmap based on the real file of the file system and the folder record and judging whether all the first N bytes of the current sector are 0; if not, whether the current sector is occupied by the real file or the folder is continuously judged.
10. A computer device comprising a processor and a memory, characterized in that: the memory stores a computer program, and the processor can implement the method for acquiring and recovering file information on a disk according to any one of claims 1 to 5 when executing the computer program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211418262.0A CN115878571A (en) | 2022-11-14 | 2022-11-14 | Method and system for acquiring and recovering file information on disk |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211418262.0A CN115878571A (en) | 2022-11-14 | 2022-11-14 | Method and system for acquiring and recovering file information on disk |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115878571A true CN115878571A (en) | 2023-03-31 |
Family
ID=85759820
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211418262.0A Pending CN115878571A (en) | 2022-11-14 | 2022-11-14 | Method and system for acquiring and recovering file information on disk |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115878571A (en) |
-
2022
- 2022-11-14 CN CN202211418262.0A patent/CN115878571A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6378054B1 (en) | Data backup device and method for use with a computer, and computer-readable recording medium having data backup program recorded thereon | |
| JP3178475B2 (en) | Data processing device | |
| EP2363815B1 (en) | System for permanent file deletion | |
| US20050144501A1 (en) | Method for recovering data in EXT2 file system, and computer-readable storage medium recorded with data-recovery program | |
| US7577808B1 (en) | Efficient backup data retrieval | |
| CN109710455B (en) | Deleted file recovery method and system based on FAT32 file system | |
| US11544150B2 (en) | Method of detecting source change for file level incremental backup | |
| CN109496292A (en) | A kind of disk management method, disk management device and electronic equipment | |
| CN112115002B (en) | Method and device for recovering file from damaged or untrusted mechanical hard disk | |
| CN110297781B (en) | Method for recovering deleted data in APFS (advanced File System) based on copy-on-write | |
| CN111382126B (en) | System and method for deleting file and preventing file recovery | |
| Bahjat et al. | Deleted file fragment dating by analysis of allocated neighbors | |
| CN106874399B (en) | Networking backup system and backup method | |
| EP1103894A2 (en) | Fragmented data recovery method | |
| CN115878571A (en) | Method and system for acquiring and recovering file information on disk | |
| KR101539617B1 (en) | File wiping method according to file type structure in mobile system, and apparatus thereof | |
| JP2925042B2 (en) | Information link generation method | |
| Lee et al. | Block based smart carving system for forgery analysis and fragmented file identification | |
| EP3674876B1 (en) | System and method of deletion of files and counteracting their restoration | |
| KR20110023580A (en) | The method and system for recovering data | |
| Azeem | The Data Carving-The Art of Retrieving Deleted Data as Evidence | |
| CN112380174B (en) | XFS file system analysis method containing deleted files, terminal device and storage medium | |
| CN112732726B (en) | Data processing method and device, processor and computer storage medium | |
| US20230409608A1 (en) | Management device, database system, management method, and computer program product | |
| Alhussein et al. | Forensics filesystem with cluster-level identifiers for efficient data recovery |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |