CN100429628C

CN100429628C - Method for rebuilding directory structure and recovering data in NTFS volume

Info

Publication number: CN100429628C
Application number: CNB2006101222480A
Authority: CN
Inventors: 涂彦晖
Original assignee: Zhuhai Kingsoft Software Co Ltd
Current assignee: Beijing Kingsoft Internet Security Software Co Ltd
Priority date: 2006-09-19
Filing date: 2006-09-19
Publication date: 2008-10-29
Anticipated expiration: 2026-09-19
Also published as: CN1959649A

Abstract

A method for rebuilding up catalogue and for restoring data in NTFS volume includes file scanning course as positioning SMFT data, making ergodic on file of MFT, obtaining father catalogue and rebuilding path of said file, transferring to B or F and entering file restoration course as selecting out a table item by making ergodic on file information table, setting up file on path assigned by user, writing in file data on newly set up file according to file size and file position, judging whether file table is the last table item or not and ending process if it is or otherwise returning back to selecting step.

Description

The method of rebuilding directory structure and restore data in the NTFS volume

Technical field

The present invention relates to computer application field, relate in particular to a kind of method of recovering data in the disk.

Background technology

When a NTFS subregion is caused file to lose by reasons such as virus, hacker's destruction, mistake format manipulation, software improper uses, during the subregion inaccessible, can the recovery file data be not enough often, also must be able to reappear the bibliographic structure of these files, and recover the filename of these files before losing, such as in the software a lot of data files being arranged, they have the fixed schedule structure, if these TOC levels and filename are destroyed, even recovered the file in all these software catalogs, this software still can not normally move.

Summary of the invention

The present invention has overcome shortcoming of the prior art, and a kind of method that file data and document directory structure are together recovered is provided.

In order to solve the problems of the technologies described above, be achieved through the following technical solutions:

The method of rebuilding directory structure and restore data is characterized in that in the NTFS volume, and it comprises that file scan and file recover two processes, and the file scan process comprises the steps:

A, $MFT data field, location, and parameter x=1 is set;

B, from the $MFT file, take out the MFT of x file;

C, from the MFT of x file, obtain the parent directory information of x file, and upwards visit the MFT of x all catalogues of file upper strata, rebulid the path of x file simultaneously according to the directory name of x all catalogues of file upper strata;

D, in the file information table that comprises include file data attribute that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of x file described in the step b;

E, to judge whether to arrive $MFT last, if not, then parameter x is added 1 and turn to step b, if then turn to step f;

F, ends file scanning process enter file rejuvenation; File recovers module and comprises the steps:

I. traversal is taken out a list item from the file information table that above-mentioned file scan process is set up;

II. set up file according to the file type information in the list item of I step taking-up in the specified path of user;

III. document size information in the list item that takes out according to I step and the memory location of file in disk write file data to the file of firm foundation;

IV. judge that whether the list item that takes out according to I step is the last list item in the above-mentioned file information table, if enter step V, otherwise returns step I;

V. finish.

The inventive method does not rely on original file system, directly the sector of disk is scanned, in conjunction with the special sign that some particular file types had, judge the particular location of this document in disk, type information according to this positional information and file rebulids file again, and this method can be used as other effectively replenishing according to the file system recovery data method.

Description of drawings

Fig. 1 is a file scanning process process flow diagram in the inventive method;

Fig. 2 is a file rejuvenation process flow diagram in the inventive method.

Embodiment

Introduce the process and the principle of work of the inventive method below with reference to Fig. 1 and Fig. 2.

The method of rebuilding directory structure and restore data mainly comprises two processes, file scan process and file rejuvenation in a kind of NTFS volume.The file scan process mainly is traversal disk De $MFT (MFT file), by the various attribute informations among the scanning MFT, obtain the information such as data attribute, file path, file size, various times of file of all files, and these information are recorded in the newly-built file information table; File rejuvenation mainly is to utilize above-mentioned file information table, rebulids file, recovery file.

The file scan process is as shown in Figure 1:

A. Ding Wei $MFT data field; The NTFS volume is different with the FAT volume, in NTFS volume, a Ge $MFT file is arranged, deposited in this document the MFT of All Files (file) in the volume (Master File Table, MFT), and corresponding one by one, promptly each file (file) all has the MFT reference number of self.Multiple attribute information is arranged in the attribute list of MFT, as, 10$STANDARD_INFORMATION (standard information); 20$ATTRIBUTE_LIST (attribute list); 30$FILE_NAME (filename); 40$VOLUME_VERSION (volume version); 50$SECURITY Descriptor (security descriptor); 60$VOLUME_NAME (file label); 70$VOLUME_INFORMATION (volume information); 80$DATA (data); 90$INDEX_ROOT (index root) etc.

B. travel through file MFT; Guarantee the file full recovery in the disk.

C. from this document MFT, obtain parent directory information, and upwards visit all catalogues on it, rebulid the path of this document simultaneously according to the directory name of all catalogues on it; It in this method the MFT reference number that can obtain this document parent directory by 30 attributes among the visit MFT; Can obtain the absolute path of each file (file) by this step, so that guarantee in the follow-up restore data process that the bibliographic structure of file is constant.

D. in the file information table that comprises include file data attribute that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of this document; Above-mentioned various information also is to obtain by each the corresponding attribute among the visit MFT.

E. it is last to judge whether to have arrived $MFT, and not being changes b, is to change f;

F. the ends file scanning process enters file rejuvenation;

File rejuvenation is as shown in Figure 2:

1. traversal is taken out a list item in the file information table that above-mentioned file scan process is set up; The corresponding file (file) of each list item wherein contains the fileinfo of the file data attribute, file path, file size, the various temporal informations of file etc. of this document (file).

2. set up file according to file type information in the table in the specified path of user;

3. according to document size information and the memory location of file in disk in the table file of firm foundation is write file data;

4. judge that whether the file table is the last list item in the above-mentioned file information table, if enter step 5, otherwise returns step 1;

5. finish.

Above step is the unrestricted technical scheme of the present invention in order to explanation only.Any modification or partial replacement that does not break away from spirit and scope of the invention all should be encompassed in the middle of the claim scope of the present invention.

Claims

1, the method for rebuilding directory structure and restore data in the NTFS volume is characterized in that, it comprises that file scan and file recover two processes, and the file scan process comprises the steps:

A. Ding Wei $MFT data field, and parameter x=1 is set;

B. from the $MFT file, take out the MFT of x file;

C. from the MFT of x file, obtain the parent directory information of x file, and upwards visit the MFT of x all catalogues of file upper strata, rebulid the path of x file simultaneously according to the directory name of x all catalogues of file upper strata;

D. in the file information table that comprises include file data attribute that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of x file described in the step b;

E. it is last to judge whether to have arrived $MFT, if not, then parameter x is added 1 and turn to step b, if then turn to step f;

F. the ends file scanning process enters file rejuvenation;

File recovers module and comprises the steps:

V. finish.

2, the method for rebuilding directory structure and restore data in the NTFS volume according to claim 1 is characterized in that the file data attribute information in the described steps d obtains by the 80H attribute of the institute of MFT described in traversal step b respective file.