CN102298546B - Method and computer for restoring deleted joint picture group (JPG) file from disk - Google Patents
Method and computer for restoring deleted joint picture group (JPG) file from disk Download PDFInfo
- Publication number
- CN102298546B CN102298546B CN 201110265294 CN201110265294A CN102298546B CN 102298546 B CN102298546 B CN 102298546B CN 201110265294 CN201110265294 CN 201110265294 CN 201110265294 A CN201110265294 A CN 201110265294A CN 102298546 B CN102298546 B CN 102298546B
- Authority
- CN
- China
- Prior art keywords
- file
- jpg
- mark
- sector
- disk
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Abstract
The invention relates to a method and a system for restoring a deleted joint picture group (JPG) file from a disk. The method comprises the following steps of: searching file header feature codes of the JPG file and a sector with the file header feature codes in the disk, and recording the excursion of the sector as an initial position; finding a sign of a JPG intermediate file compression packet in the sector, recording the position of the sign of the JPG intermediate file compression packet as a current position, and otherwise, reading a 16-bit integral number from the sign of the JPG intermediate file compression packet, and recording the value of the integral number as L; executing the operation repeatedly from the position by adding the current position and L; and determining data between the initial position and the current position as the content of the integral JPG file, and reading and storing the content of the JPG file to restore the JPG file. In the method, the deleted file is restored according to the content of the file, the content of the restored file is the same as that of a real file, the generality is high, and the JPG file can be used and checked in various file systems.
Description
Technical field
The present invention relates to field of computer technology, specifically refer to from the method and system of the deleted JPG file of disk recovery.
Background technology
Data are recovered the field, and software rejuvenation can be divided into dual mode: 1, based on the recovery of file system structure; 2, based on the recovery of file content.First kind of way is the characteristics according to file system, such as NTFS(New Technology File System, the file system of Windows NT operating environment and Windows NT advanced server network operating system environment) file system can make marks the file of deletion, but the key messages such as storage positions of files still exist.The second way is the condition code of utilizing some file known, normally the content of file several bytes of beginning to locate.The first reset mode Quality of recovery is better, and usually can obtain filename, and shortcoming is at deleted file, and uses this subregion to be not easy after a period of time to find; Rear a kind of long ago file of deletion that often can find, shortcoming is there is no filename, the probability of file corruption is also higher.
In prior art, recover JPG(Joint Photographic Experts Group, JPEG (joint photographic experts group),) mode, for example Easy Recovery(file recovers software) software, first seeking the file header sign " FF D8 FF E0 " of JPG file, until find the file header of next file or reach maximal value (2G), is a JPG file with this interval content recognition.The restoration methods shortcoming that above-mentioned prior art provides is that the file that recovers is often larger, and some picture checks that software can not show correctly that this end-of-file has the picture of a lot of junk datas.
Summary of the invention
Fundamental purpose of the present invention is to provide a kind of method and system from the deleted JPG file of disk recovery, and the file content after recovery is identical with the authentic document content size, and highly versatile.
The technical solution adopted for the present invention to solve the technical problems is:
The invention provides a kind of method from the deleted JPG file of disk recovery, it comprises:
A kind of method from the deleted JPG file of disk recovery, it comprises:
S110, seek the file header condition code of JPG file, seek in disk and have the sector of file header condition code, and the skew of recording this sector is the starting position;
S120, seek backward the mark of JPG intermediate file compressed package, find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if the mark of this intermediate file compressed package is 0xfff9, and execution in step S140; Otherwise, read 16 integers after the mark of this intermediate file compressed package, recording this round values is L;
S130, from the position of current location+L, the operation of repeated execution of steps S120;
S140, determine that the data between described starting position and current location are the content of a complete JPG file, read and preserve the content of this JPG file to recover this JPG file.
Preferably, the described sector with file header condition code of seeking in disk specifically comprises: search for " ff d8 ff e0 " " ff d8 ff e1 ", " ff d8 ff ed ", the sector of " ff d8 ff ff fe " beginning in disk.
Preferably, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers in the scope of 0xffda ~ 0xfffe).
In step S110, when the file header condition code of seeking the JPG file, when searching out the sector that starts with " ff d8 ffe0 " in disk, also comprise:
Judge that described disk is whether with the sector of " ff d8 ff e0 00 10 41 56 49 31 " beginning; When being judged as YES, continue execution in step S110; When being judged as NO, execution in step S120.
A kind of system from the deleted JPG file of disk recovery, it comprises:
Condition code is sought the unit, is used for seeking the file header condition code of JPG file, seek to have the sector of file header condition code in disk, and the skew of recording this sector is the starting position;
Mark is sought the unit, is used for seeking backward the mark of JPG intermediate file compressed package; Find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if the mark of this intermediate file compressed package is 0xfff9, and startup file recovery unit; Otherwise, read 16 integers after the mark of this intermediate file compressed package, recording this round values is L, starts the mark repetitive;
The mark repetitive is used for from the position of current location+L, and triggered mark is sought the unit and repeated the searching process;
The file recovery unit is used for determining that the data between described starting position and current location are the content of a complete JPG file, reads and preserve the content of this JPG file to recover this JPG file.
Preferably, described condition code is sought the unit, is used in the sector of disk search with " ff d8 ff e0 ", " ff d8 ffe1 ", " ff d8 ff ed " or " ff d8 ff ff fe " beginning.
Preferably, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers in the scope of 0xffda ~ 0xfffe).
Preferably, described system also comprises the condition code judging unit, be used for seeking the unit when disk searches sector with " ff d8 ff e0 " beginning when described condition code, judge the sector whether described disk starts with " ff d8 ff e0 00 1,041 56 49 31 "; When being judged as YES, triggering described condition code and seek unit execution searching process; When being judged as NO, triggering described mark and seek unit execution searching process.
Implement technical scheme of the present invention, has following beneficial effect: the file that method provided by the invention undeletes according to file content, file content after recovery is identical with the authentic document content size, and highly versatile, can use and check this JPG file in various file system.
Description of drawings
The method flow diagram that Fig. 1 provides for the embodiment of the present invention;
The structural representation of the system that Fig. 2 provides for the embodiment of the present invention;
Another structural representation of the system that Fig. 3 provides for the embodiment of the present invention.
The realization of the object of the invention, functional characteristics and advantage are described further with reference to accompanying drawing in connection with embodiment.
Embodiment
In order to make purpose of the present invention, technical scheme and advantage clearer, below in conjunction with drawings and Examples, the present invention is further elaborated.Should be appreciated that specific embodiment described herein only in order to explain the present invention, is not intended to limit the present invention.
The embodiment of the present invention provides a kind of method from the deleted JPG file of disk recovery, and as shown in Figure 1, the method comprising the steps of:
S110, seek the file header condition code of JPG file, seek in disk and have the sector of file header condition code, and the skew of recording this sector is the starting position; In concrete this step S110: search is with the sector of " ff d8 ff e0 ", " ff d8 ff e1 ", " ff d8 ff ed " or " ff d8 ff ff fe " beginning in disk.Except " ff d8 ff e000 10 41 56 49 31 ", this condition code is avi(Audio Video Interleaved, the Audio Video Interleaved form) key frame in file, rather than JPG file independently.
S120, seek backward the mark of JPG intermediate file compressed package, find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if the mark of this JPG intermediate file compressed package is 0xfff9, execution in step S140; Otherwise, read 16 integers (large end alignment) after the mark of this intermediate file compressed package, recording this round values is L; In the present embodiment, more specifically, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers (large end aligns) in the scope of 0xffda ~ 0xfffe).
S130, from the position of current location+L, the operation of repeated execution of steps S120;
The position of the current location of determining like this has a plurality of, namely repeats step S120 one time, and a new current location is just arranged again.
S140, determine that the data between described starting position and current location are the content of a complete JPG file, read and preserve the content of this JPG file to recover this JPG file.
In other embodiment, further, in above-mentioned steps S110, when the file header condition code of seeking the JPG file, when searching out the sector with " ff d8 ff e0 " beginning in disk, also comprise: judge the sector whether described disk starts with " ff d8 ff e0 00 10 41 56 49 31 "; When being judged as YES, continue execution in step S110; When being judged as NO, execution in step S120.
In the present embodiment, because it is a plurality of that the position of current location has, so the data between a plurality of described starting positions and current location are arranged, it is described JPG file that data between a described starting position and current location are wherein arranged, and can verify and determine that the data between which described starting position and current location are described JPG file according to the size of JPG file content.
The file that the method that the present embodiment provides undeletes according to the JPG file content, the JPG file content after recovery is identical with true JPG file content size, and highly versatile, can use and check this JPG file in various file system.
The present invention also provides a kind of system, is used for realizing the method that above-described embodiment provides, and as shown in Figure 2, this system comprises:
Condition code is sought unit 210, is used for seeking the file header condition code of JPG file, seek to have the sector of file header condition code in disk, and the skew of recording this sector is the starting position; More specifically, described condition code is sought the unit, is used in the sector of disk search with " ff d8 ff e0 ", " ff d8 ff e1 ", " ff d8 ff ed " or " ff d8 ff ff fe " beginning.
Mark is sought unit 220, is used for seeking backward the mark of JPG intermediate file compressed package; Find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if this mark is 0xfff9, the startup file recovery unit 240; Otherwise, read 16 integers (large end alignment) after the mark of this intermediate file compressed package, recording this round values is L; Wherein, more specifically, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers in the scope of 0xffda ~ 0xfffe)
Mark repetitive 230 is used for from the position of current location+L, starts mark and seeks unit 220;
In other embodiment, further, as shown in Figure 3, described system also comprises condition code judging unit 250, be used for seeking the unit when disk searches sector with " ff d8 ff e0 " beginning when described condition code, judge the sector whether described disk starts with " ff d8 ff e0 00 10 41 56 49 31 "; When being judged as YES, triggering described condition code and seek unit 210 execution searching processes; When being judged as NO, triggering described mark and seek unit 220 execution searching processes.
The file that the method that the present embodiment provides undeletes according to the JPG file content, the JPG file content after recovery is identical with true JPG file content size, and highly versatile, can use and check this JPG file in various file system.
The above is only preferred embodiment of the present invention, not in order to limiting the present invention, all any modifications of doing within the spirit and principles in the present invention, is equal to and replaces and improvement etc., within all should being included in protection scope of the present invention.
Claims (8)
1. the method from the deleted JPG file of disk recovery, is characterized in that, comprising:
S110, seek the file header condition code of JPG file, seek in disk and have the sector of file header condition code, and the skew of recording this sector is the starting position;
S120, seek backward the mark of JPG intermediate file compressed package, find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if the mark of this intermediate file compressed package is 0xfff9, and execution in step S140; Otherwise, read 16 integers after the mark of this intermediate file compressed package, recording this round values is L;
S130, from the position of current location+L, the operation of repeated execution of steps S120;
S140, determine that the data between described starting position and current location are the content of a complete JPG file, read and preserve the content of this JPG file to recover this JPG file.
2. method as claimed in claim 1, is characterized in that, the described sector with file header condition code of seeking in disk specifically comprises: search is with the sector of " ffd8ffe0 ", " ffd8ffe1 ", " ffd8ffed " or " ffd8fffffe " beginning in disk.
3. method as claimed in claim 1, is characterized in that, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers in the scope of 0xffda ~ 0xfffe).
4. method as claimed in claim 2, is characterized in that, in step S110, when the file header condition code of seeking the JPG file, when searching out the sector with " ffd8ffe0 " beginning in disk, also comprises:
Judge that described disk is whether with the sector of " ffd8ffe0001041564931 " beginning; When being judged as YES, continue execution in step S110; When being judged as NO, execution in step S120.
5. the system from the deleted JPG file of disk recovery, is characterized in that, comprising:
Condition code is sought the unit, is used for seeking the file header condition code of JPG file, seek to have the sector of file header condition code in disk, and the skew of recording this sector is the starting position;
Mark is sought the unit, is used for seeking backward the mark of JPG intermediate file compressed package; Find the mark of described JPG intermediate file compressed package in described sector, the position of remembering the mark of this JPG intermediate file compressed package is current location, if the mark of this intermediate file compressed package is 0xfff9, and startup file recovery unit; Otherwise, read 16 integers after the mark of this intermediate file compressed package, recording this round values is L, starts the mark repetitive;
The mark repetitive is used for from the position of current location+L, and triggered mark is sought the unit and repeated the searching process;
The file recovery unit is used for determining that the data between described starting position and current location are the content of a complete JPG file, reads and preserve the content of this JPG file to recover this JPG file.
6. system as claimed in claim 5, is characterized in that, described condition code is sought the unit, is used in the sector of disk search with " ffd8ffe0 ", " ffd8ffe1 ", " ffd8ffed " or " ffd8fffffe " beginning.
7. system as claimed in claim 5, is characterized in that, the mark of described JPG intermediate file compressed package is at (0xffc0 ~ 0xffcf) and (16 integers in the scope of 0xffda ~ 0xfffe).
8. system as claimed in claim 6, it is characterized in that, also comprise the condition code judging unit, be used for seeking the unit when disk searches sector with " ffd8ffe0 " beginning when described condition code, judge the sector whether described disk starts with " ffd8ffe0001041564931 "; When being judged as YES, triggering described condition code and seek unit execution searching process; When being judged as NO, triggering described mark and seek unit execution searching process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201110265294 CN102298546B (en) | 2011-09-07 | 2011-09-07 | Method and computer for restoring deleted joint picture group (JPG) file from disk |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201110265294 CN102298546B (en) | 2011-09-07 | 2011-09-07 | Method and computer for restoring deleted joint picture group (JPG) file from disk |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102298546A CN102298546A (en) | 2011-12-28 |
| CN102298546B true CN102298546B (en) | 2013-06-12 |
Family
ID=45358979
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 201110265294 Expired - Fee Related CN102298546B (en) | 2011-09-07 | 2011-09-07 | Method and computer for restoring deleted joint picture group (JPG) file from disk |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102298546B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103473147A (en) * | 2012-06-06 | 2013-12-25 | 网秦无限（北京）科技有限公司 | Mobile terminal data recovery method and mobile terminal data recovery system |
| CN104699688A (en) * | 2013-12-04 | 2015-06-10 | 杭州鹰湾科技有限公司 | File searching method and electronic device |
| CN105068885B (en) * | 2015-07-27 | 2018-02-27 | 四川效率源信息安全技术股份有限公司 | A kind of JPG fragments file access pattern and the method for restructuring |
| CN106407038A (en) * | 2015-07-27 | 2017-02-15 | 四川效率源信息安全技术有限责任公司 | Fragmented file data recovery method |
| CN106412200B (en) * | 2016-10-08 | 2019-12-03 | 四川秘无痕科技有限责任公司 | A method of extracting WP interconnection personal data |
| CN106453780B (en) * | 2016-10-08 | 2019-10-11 | 四川秘无痕科技有限责任公司 | A method of extracting Saipan interconnection personal data |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6519762B1 (en) * | 1998-12-15 | 2003-02-11 | Dell Usa, L.P. | Method and apparatus for restoration of a computer system hard drive |
| US6574754B1 (en) * | 2000-02-14 | 2003-06-03 | International Business Machines Corporation | Self-monitoring storage device using neural networks |
| CN1770304A (en) * | 2004-08-02 | 2006-05-10 | 日立环球储存科技荷兰有限公司 | Failure predicting method of magnetic disk device and magnetic disk device using the same |
| US7290193B2 (en) * | 2003-09-30 | 2007-10-30 | Sudhir Dattaram Kadkade | System verification using one or more automata |
-
2011
- 2011-09-07 CN CN 201110265294 patent/CN102298546B/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6519762B1 (en) * | 1998-12-15 | 2003-02-11 | Dell Usa, L.P. | Method and apparatus for restoration of a computer system hard drive |
| US6574754B1 (en) * | 2000-02-14 | 2003-06-03 | International Business Machines Corporation | Self-monitoring storage device using neural networks |
| US7290193B2 (en) * | 2003-09-30 | 2007-10-30 | Sudhir Dattaram Kadkade | System verification using one or more automata |
| CN1770304A (en) * | 2004-08-02 | 2006-05-10 | 日立环球储存科技荷兰有限公司 | Failure predicting method of magnetic disk device and magnetic disk device using the same |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102298546A (en) | 2011-12-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102298546B (en) | Method and computer for restoring deleted joint picture group (JPG) file from disk | |
| CN102937926B (en) | Method and device for recovering deleted sqlite files on mobile terminal | |
| CN102289524A (en) | Data recovery method and system | |
| US20130067237A1 (en) | Providing random access to archives with block maps | |
| CN105447168B (en) | The method of the fragment file access pattern and recombination of MP4 format | |
| EP3798842A1 (en) | Database deleted record recovery method and system | |
| CN101783955B (en) | Data recovering method when data is abnormal and equipment thereof | |
| CN112380067B (en) | Metadata-based big data backup system and method in Hadoop environment | |
| US9311189B2 (en) | Method and device for inputting data in multimedia service database on embedded device | |
| CN106407038A (en) | Fragmented file data recovery method | |
| US20230205637A1 (en) | Backup Recovery System and Method for Modern Application | |
| CN104965835A (en) | Method and apparatus for reading and writing files of a distributed file system | |
| Abdullah et al. | Carving thumbnail/s and embedded JPEG files using image pattern matching | |
| JP5032583B2 (en) | Video recording apparatus, video recording method, video recording program, and integrated circuit | |
| CN107301177B (en) | File storage method and device | |
| CN105760244B (en) | It is a kind of based on the assumption that the exFAT of verification formats restoration methods and device | |
| CN108459925B (en) | Private cloud equipment, database repairing method thereof and device with storage function | |
| WO2015055062A1 (en) | Data file writing method and system, and data file reading method and system | |
| CN113535482B (en) | Cloud backup chain data backup method and device, equipment and readable medium | |
| CN112799872B (en) | Erasure code encoding method and device based on key value pair storage system | |
| CN111698330B (en) | Data recovery method and device of storage cluster and server | |
| WO2012174942A1 (en) | Method and system for locating crash problem of mobile terminal | |
| CN113297214B (en) | Snapshot processing method, equipment and storage medium based on DAG block chain | |
| CN104200163A (en) | Virus detection method and virus detection engine | |
| CN110096387B (en) | Method and device for restoring deleted data of computer cluster based on XFS file system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| C53 | Correction of patent for invention or patent application | ||
| CB02 | Change of applicant information |
Address after: Room 9, block A901 building on the north side of a building 518000 North TCL A of Guangdong Province, Shenzhen city Nanshan District South Road West ten high new technology Applicant after: Shenzhen Wondershare Information Technology Co., Ltd. Address before: Room 9, block A901 building on the north side of a building 518000 North TCL A of Guangdong Province, Shenzhen city Nanshan District South Road West ten high new technology Applicant before: Shenzhen Wondershare Software Co., Ltd. |
|
| COR | Change of bibliographic data |
Free format text: CORRECT: APPLICANT; FROM: SHENZHEN WONDERSHARE SOFTWARE CO., LTD. TO: SHENZHEN WONDERSHARE INFORMATION TECHNOLOGY CO., LTD. |
|
| GR01 | Patent grant | ||
| C17 | Cessation of patent right | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20130612 Termination date: 20130907 |