CN100407159C - Method for recovering files deleted from FAT32 document system - Google Patents
Method for recovering files deleted from FAT32 document system Download PDFInfo
- Publication number
- CN100407159C CN100407159C CN2006100368771A CN200610036877A CN100407159C CN 100407159 C CN100407159 C CN 100407159C CN 2006100368771 A CN2006100368771 A CN 2006100368771A CN 200610036877 A CN200610036877 A CN 200610036877A CN 100407159 C CN100407159 C CN 100407159C
- Authority
- CN
- China
- Prior art keywords
- file
- deleted
- document
- cluster
- directory entry
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention relates to a method to restore the deleted file in hard disk. It includes the following steps: a. orienting deleted files catalog needed restore; b. judging whether undeleted file or folder existing of the same grade next to the file, if existing, coming into step c, else coming into step e; c. searching a catalog of undeleted file or folder; d. using the high 16bits of the starting locating cluster in catalog of undeleted file or folder as the high 16bit of the cluster of deleted file that needs to restore; f. creating file information of the high and low 16bits of cluster after filled that includes starting cluster, file size, file creating time, etc; restoring the deleted file to another location in hard disc. The invention could rapidly determine the staring cluster 16bits information of the deleted file and determine the starting cluster information of the deleted file and restore the file eventually.
Description
Technical field
The present invention relates to computer realm, particularly a kind of method of recovering deleted document in the disk.
Background technology
FAT32 directory entry structure as shown in Figure 1.Windows is when carrying out file operation, according to this structural orientation file data.During the file of a FAT32 Logical Disk of deletion, at first the first byte with filename is labeled as deleted marker, then high 16 of file data starting cluster is revised as 0, carries out the processing that the space discharges at last in the Windows system.The structure of the directory entry in the FAT32 subregion behind the file delete as shown in Figure 2.When file is deleted in the FAT32 subregion, high 16 bit data of describing its starting cluster are by clear 0, though low 16 that describe its data starting cluster is correct, the data structure in the remaining directory entry of most applications after according to file delete can not correctly find the position of file data.Can only correctly navigate to high 16 of file data starting cluster according to this remnants directory entry was exactly 0 situation originally, can learn by following calculating, this situation may be: 1, bunch size of FAT32 Logical Disk is 32K, and the deleted file data are positioned within the 2G of Logical Disk; 2, bunch size of FAT32 Logical Disk is 16K, and the deleted file data are positioned within the 1G of Logical Disk.
When 1, bunch size of FAT32 Logical Disk is 32K:
Size=0xFFFF bunch of representing of the multipotency of 32 bunches reference position * 32K/ bunch=2097120K
When 2, bunch size of FAT32 Logical Disk is 16K:
Size=0xFFFF bunch of representing of the multipotency of 16 bunches reference position * 16K/ bunch=1048560K
Certainly, by that analogy, bunch size of FAT32 Logical Disk is 64K, and the problems referred to above or the like are also arranged when the deleted file data are positioned at outside the 4G of Logical Disk.Decide during bunch size format subregion, bunch size is big more, the space of waste is also big more, but file access speed can be fast, Windows file system general acquiescence when format FAT32 subregion is selected 16K size or 32K size, and with the situation of 16K size (generally determining according to total size of subregion) in the majority, so the file in the FAT32 Logical Disk is deleted, if its data are positioned at the 2G (situation 1) of subregion or 1G (situation 2) when above, the recovery of file becomes a difficult problem.Application number is 200510100303.1, the Chinese patent application that name is called " method of recovering FAT32 subregion deleted document " has proposed a solution, the rely prerequisite implemented of this scheme is understood the file type sign of deleted document, these signs refer generally to several characters that file starts most, file header such as files such as executable file EXE, the DLL of windows, VXD is character string " MZ ", and the file header of the pdf document of Adobe company is a character string " %PDF " etc.But it is unknown that the file type sign of this deleted document under a few cases is also arranged, and said method just can't be realized recovery purposes like this.By top analysis as can be seen, the main cause that said " difficult problem " exists is that high 16 of starting cluster of deleted document no longer are zero, can't determine, just can carry out file and has recovered if can determine high 16 of deleted document starting cluster.
Summary of the invention
The present invention has overcome shortcoming of the prior art, provides a kind of and does not rely on the particular file types sign and recover the method for the deleted document in the assigned catalogue.
In order to solve the problems of the technologies described above, be achieved through the following technical solutions:
Recover the method for deleted document in the FAT32 file system, it is characterized in that it comprises following process:
A, location need to recover the directory entry of deleted document;
B, judge whether the not deleted file or the file of the peer adjacent,, do not enter process e if enter process c with this document;
C, upwards or search for a not directory entry of deleted file or file downwards;
D, with this not in the directory entry of deleted file or file indication reference position bunch high 16 be used as needs recover deleted document bunch high 16, go to process f;
E, with indication reference position in the directory entry of the parent directory of this deleted document (being file '. ' by name) bunch high 16 be used as needs recovery deleted document bunch high 16;
F, set up fileinfo, comprise starting cluster, file size, various times of file etc. according to 16 of the height of filling later bunch;
G, recover deleted document a certain position to the disk.
The inventive method can be determined high 16 information of starting cluster of this deleted document fast by the directory entry information of the adjacent file of inquiry deleted document, thereby determines the starting cluster information of this deleted document, finally recovers this document.
Description of drawings
Fig. 1 is a FAT32 directory entry structural drawing;
Fig. 2 is the FAT32 directory entry structural drawing behind the deleted file;
Fig. 3 is the process flow diagram of the inventive method.
Embodiment
The application principle of flow process and this method of the inventive method is described with reference to the accompanying drawings.
Referring to Fig. 1 and Fig. 2, be respectively before the file delete and the directory entry structural drawing after the deletion, relatively two width of cloth figure are not difficult to find to mainly contain the change of two places behind the file delete, first byte of first filename is flagged as " deleting ", it two is that high 16 of file data starting cluster are modified to 0, file data starting cluster information is the most worthy information of locating file Data Position in disk, as long as energy recovery file data starting cluster information, but the just position of locating file data in disk, also just deleted document can have been recovered, so a main task of the inventive method is exactly file starting cluster high of determining in this deleted document directory entry 16; The inventive method determines that high 16 principle of the file starting cluster in this deleted document directory entry is such: generally speaking, two files (or file) that creation-time is close can be dispensed in the close or continuous disk space, in addition, also there is a strong possibility the adjacent document creation time in the identical file folder as a rule is continuous or creates simultaneously with its parent directory.In sum, high 16 identical probabilities of file starting cluster are bigger in the directory entry of adjacent file in identical file folder or file and its parent directory, method of the present invention is determined the high 16 of deleted document according to this principle, though in some cases (, parent directory big as adjacent document creation time phase difference in the same file differs greatly with this deleted file creation-time or the file or folder adjacent with this deleted file takes up room bigger etc.) located high 16 may not be accurate, this method still can have good use value.
The process flow diagram of the inventive method as shown in Figure 3, its course of work is as follows:
A. the location needs to recover the directory entry of deleted document;
B. judge whether the not deleted file or the file of the peer adjacent,, do not enter process e if enter process c with this document;
C. upwards or search for a not directory entry of deleted file or file downwards;
D. with this not in the directory entry of deleted file or file indication reference position bunch high 16 be used as needs recover deleted document bunch high 16, go to process f;
E. with indication reference position in the directory entry of the parent directory of this deleted document (being file '. ' by name) bunch high 16 be used as needs recovery deleted document bunch high 16;
F. set up fileinfo according to 16 of the height of filling later bunch, comprise starting cluster, file size, various times of file etc.;
G. recover deleted document a certain position to the disk.
If detect this deleted document among the process b peer not deleted file or file are arranged all up and down, then only upwards search or only search for a not directory entry of deleted file or file downwards among the process c.
Above step is the unrestricted technical scheme of the present invention in order to explanation only.Any modification or partial replacement that does not break away from spirit and scope of the invention all should be encompassed in the middle of the claim scope of the present invention.
Claims (2)
1. recover the method for deleted document in the FAT32 file system, it is characterized in that it comprises following process:
A. the location needs to recover the directory entry of deleted document;
B. judge whether the not deleted file or the file of the peer adjacent,, do not enter process e if enter process c with this document;
C. upwards or search for a not directory entry of deleted file or file downwards;
D. with this not in the directory entry of deleted file or file indication reference position bunch high 16 be used as needs recover deleted document bunch high 16, go to process f;
E. with indication reference position in the directory entry of the parent directory of this deleted document bunch high 16 be used as needs recover deleted document bunch high 16;
F. set up fileinfo according to 16 of the height of filling later bunch, comprise starting cluster, file size, various times of file;
G. recover deleted document a certain position to the disk.
2. the method for deleted document in the recovery FAT32 file system according to claim 1, it is characterized in that, if detect this deleted document among the process b peer not deleted file or file are arranged all up and down, then only upwards search or only search for a not directory entry of deleted file or file downwards among the process c.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2006100368771A CN100407159C (en) | 2006-08-01 | 2006-08-01 | Method for recovering files deleted from FAT32 document system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2006100368771A CN100407159C (en) | 2006-08-01 | 2006-08-01 | Method for recovering files deleted from FAT32 document system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1904845A CN1904845A (en) | 2007-01-31 |
| CN100407159C true CN100407159C (en) | 2008-07-30 |
Family
ID=37674115
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2006100368771A Active CN100407159C (en) | 2006-08-01 | 2006-08-01 | Method for recovering files deleted from FAT32 document system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100407159C (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109614370A (en) * | 2018-11-28 | 2019-04-12 | 万兴科技股份有限公司 | Disk file scan method, device, computer equipment and storage medium |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101937377B (en) * | 2009-06-29 | 2014-10-22 | 百度在线网络技术（北京）有限公司 | Data recovery method and device |
| CN102360318B (en) * | 2011-09-27 | 2013-07-31 | 深圳万兴信息科技股份有限公司 | Recovery method and device of deleted files in FAT (File Allocation Table) file system |
| CN103164501A (en) * | 2012-07-04 | 2013-06-19 | 北京安天电子设备有限公司 | Method and system of rapid file erasure of anti-recovery software |
| CN103092726B (en) * | 2013-01-16 | 2015-06-17 | 厦门市美亚柏科信息股份有限公司 | Recovery method and recovery device of registry deleted data |
| CN104331348A (en) * | 2014-11-27 | 2015-02-04 | 四川效率源信息安全技术有限责任公司 | Method for recovering file by reducing initial cluster number of FAT32 directory entry |
| CN108021472B (en) * | 2017-11-28 | 2021-02-02 | 厦门市美亚柏科信息股份有限公司 | Format recovery method of ReFS file system and storage medium |
| CN112905546A (en) * | 2021-03-15 | 2021-06-04 | 深圳软牛科技有限公司 | Deleted file recovery method, device, equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1359071A (en) * | 2001-11-29 | 2002-07-17 | 上海格尔软件股份有限公司 | Method for completely deleting files on hard disk |
| US6560615B1 (en) * | 1999-12-17 | 2003-05-06 | Novell, Inc. | Method and apparatus for implementing a highly efficient, robust modified files list (MFL) for a storage system volume |
| CN1773462A (en) * | 2005-10-17 | 2006-05-17 | 珠海金山软件股份有限公司 | Method for recovering deleted file of FAT32 partition |
-
2006
- 2006-08-01 CN CN2006100368771A patent/CN100407159C/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6560615B1 (en) * | 1999-12-17 | 2003-05-06 | Novell, Inc. | Method and apparatus for implementing a highly efficient, robust modified files list (MFL) for a storage system volume |
| CN1359071A (en) * | 2001-11-29 | 2002-07-17 | 上海格尔软件股份有限公司 | Method for completely deleting files on hard disk |
| CN1773462A (en) * | 2005-10-17 | 2006-05-17 | 珠海金山软件股份有限公司 | Method for recovering deleted file of FAT32 partition |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109614370A (en) * | 2018-11-28 | 2019-04-12 | 万兴科技股份有限公司 | Disk file scan method, device, computer equipment and storage medium |
| CN109614370B (en) * | 2018-11-28 | 2021-11-09 | 万兴科技股份有限公司 | Disk file scanning method and device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1904845A (en) | 2007-01-31 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100407159C (en) | Method for recovering files deleted from FAT32 document system | |
| CN100353329C (en) | Method for recovering deleted file of FAT32 partition | |
| CN101937377B (en) | Data recovery method and device | |
| CN100446000C (en) | Method for re-setting up catalogue structure and restoring data in FAI volume | |
| CN100429628C (en) | Method for rebuilding directory structure and recovering data in NTFS volume | |
| KR20070003578A (en) | File system having deferred verification of data integrity | |
| CN103617097B (en) | File access pattern method and device | |
| CN1655146A (en) | Method and apparatus for file system snapshot persistence | |
| CN101667118A (en) | Method and device for multi-language version development and replacement | |
| US8996542B2 (en) | Navigation of hierarchical data sets | |
| CN103473277A (en) | Snapshot method and device for file systems | |
| CN110659254B (en) | Deleted file recovery method, device, equipment and readable storage medium | |
| KR20070003576A (en) | Optimized startup verification of file system integrity | |
| US10496612B2 (en) | Method for reliable and efficient filesystem metadata conversion | |
| CN107291858A (en) | Data indexing method based on character string suffix | |
| CN105989013A (en) | Method and device for removing character watermarks | |
| US9524354B2 (en) | Device, method, and program for processing data with tree structure | |
| US6446085B1 (en) | Method and apparatus for processing recursive hard links in a data processing system | |
| CN102609531A (en) | Method for pegging files according to keywords | |
| EP1103894A2 (en) | Fragmented data recovery method | |
| CN102073682B (en) | Code mode-based document data recovering system and quick recovering method thereof | |
| US20130091110A1 (en) | Recovery of Inconsistent Data in Databases | |
| CN104391945A (en) | Method and device for processing database file data index | |
| CN102346559A (en) | Method and device for deleting lexical items in input method as well as character input tool | |
| CN104699688A (en) | File searching method and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C56 | Change in the name or address of the patentee | ||
| CP01 | Change in the name or title of a patent holder |
Address after: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee after: Zhuhai Kingsoft Software Co.,Ltd. Address before: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee before: Zhuhai Kingsoft Software Co.,Ltd. |
|
| ASS | Succession or assignment of patent right |
Owner name: KINGSOFT CORPORATION LIMITED Free format text: FORMER OWNER: ZHUHAI KINGSOFT SOFTWARE CO., LTD. Effective date: 20140901 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 519015 ZHUHAI, GUANGDONG PROVINCE TO: 100085 HAIDIAN, BEIJING |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20140901 Address after: Kingsoft No. 33 building, 100085 Beijing city Haidian District Xiaoying Road Patentee after: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. Address before: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee before: Zhuhai Kingsoft Software Co.,Ltd. |
|
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20070131 Assignee: Zhuhai Kingsoft Software Co.,Ltd. Assignor: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. Contract record no.: 2014990000778 Denomination of invention: Method for recovering files deleted from FAT32 document system Granted publication date: 20080730 License type: Common License Record date: 20140926 |
|
| LICC | Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model |