CN102622302B - Recognition method for fragment data type - Google Patents
Recognition method for fragment data type Download PDFInfo
- Publication number
- CN102622302B CN102622302B CN201110031123.8A CN201110031123A CN102622302B CN 102622302 B CN102622302 B CN 102622302B CN 201110031123 A CN201110031123 A CN 201110031123A CN 102622302 B CN102622302 B CN 102622302B
- Authority
- CN
- China
- Prior art keywords
- data
- crumb data
- crumb
- type
- similarity
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 239000012634 fragment Substances 0.000 title abstract description 23
- 239000000284 extract Substances 0.000 claims description 10
- 230000008569 process Effects 0.000 description 11
- 238000010586 diagram Methods 0.000 description 6
- 238000004458 analytical method Methods 0.000 description 4
- 238000005215 recombination Methods 0.000 description 4
- 230000006798 recombination Effects 0.000 description 4
- 230000019771 cognition Effects 0.000 description 3
- 238000006062 fragmentation reaction Methods 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000000605 extraction Methods 0.000 description 2
- 238000013467 fragmentation Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000013139 quantization Methods 0.000 description 2
- 230000009467 reduction Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013499 data model Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 239000003550 marker Substances 0.000 description 1
Landscapes
- Complex Calculations (AREA)
Abstract
The invention provides a recognition method for a fragment data type, which comprises the following steps: first extracting byte frequency distribution F(x) of fragment data x to be tested; then calculating similarity Tx of byte frequency distribution between the fragment data x to be tested and some sample S, judging whether the similarity Tx of the byte frequency distribution between the fragment data x to be tested and some sample S falls into a range of similarity of a fragment data type Ti in known data types T, and if the similarity Tx of the byte frequency distribution between the fragment data x to be tested and some sample S falls into the range of similarity of the fragment data type Ti in the known data types T, judging that the tested fragment data x belong to the type represented by the known fragment data type Ti; and if the similarity Tx of the byte frequency distribution between the fragment data x to be tested and some sample S does not fall into the range of any known data type T, judging that the type of the fragment data x to be tested cannot be recognized. The method can recognize the type of the fragment data, provides basis for follow-up fragment data reconstruction work, and accordingly files with certain content can be restored according to the fragment data so as to provide technical support for judicial evidence obtaining.
Description
Technical field
The present invention relates to the recognition methods of crumb data type in the type of disk fragments data of a kind of hard disc of computer or other movable storage mediums or memory mirror, particularly relate to the recognition methods of the crumb data type based on byte frequency distribution.
Background technology
Disk bunch or piece formed by one or more sectors, sector is the physical memory cell of disk minimum, and bunch be the minimum unit that operating system is distributed, disk bunch be generally multiple sectors, for example have multiple sectors such as 2,4,8,16,32,64, each bunch can only be taken by a file, even if only have several bytes in this file, also never allow one bunch of plural file sharing, otherwise can cause the confusion of data.Wherein, sector is physics, and bunch is logic, bunch can be changed by operating system, forms and bunch is convenient to system management.
File system is with Cu Huokuaiwei unit in the time that storage data arrive disk, and distributed and saved, to the difference place of whole disk, in the prior art, is called file fragmentation by these distributed and saved to the different piece of the local file of difference of disk.These file fragmentations can cause system performance to reduce, travelling speed is declined, thereby, process fragment by traditional Disk Defragmenter, Disk Defragmenter can be analyzed the disk fragments in hard disk, and mobile and merged file fragment, makes each file can take storage area independent and continuous on hard disk, thereby improve the utilization rate of disk usage space, improve the speed of disk file reading.
In disk except existing above-mentioned traditional file fragmentation, also exist another kind of data, be present in the data in unallocated bunch or piece, the generation of these data normally, owing to using after a period of time at disk, copies repeatedly, generation and deleted file cause.For example, after file is deleted, but the part actual content of this file is still stored in this space.That these class data have is imperfect, easy capped feature.With the example that is operating as of deleted file, after file is deleted, the space of originally storing this file is identified as " unallocated space ", and the disk file system in disk, reclaiming in use unallocated space process, can write fresh content this part region.But in fact, this unallocated space also has the partial content of original deleted file, in the time that fresh content is write to this space, former already present data message is covered by new data message.
Although these class data are normally incomplete, easily capped, these class data extract and reconstruct after can obtain comparatively complete content, thereby use as electronic evidence.
For the present invention is clearly described, in the present invention, be crumb data by this data definition being kept in disk in unallocated bunch or piece.In addition, there is the file of what type, just there is the crumb data of corresponding types, the type identification of crumb data is a basis of file restructuring or file reduction, therefore, the present invention is based on sector 512B is unit, and definition crumb data type refers to the type of the data of the crumb data representative taking 512B as unit.
Visible by above-mentioned analysis, described crumb data is playing an important role aspect formation electronic evidence, and can improve the discrimination of follow-up file recombination to the identification of crumb data type, and reduces corresponding calculated amount.But not having at present any prior art can analyze and utilize described crumb data, and crumb data type is identified.
Summary of the invention
The present invention provides a kind of recognition methods of crumb data type in order to address the above problem, in order to identify the type of crumb data, for follow-up crumb data recombination provides basis.
In order to solve the problems of the technologies described above, the invention provides following technical scheme:
A recognition methods for crumb data type, comprises the following steps:
Step 1, extracts the byte frequency distribution F (x) of crumb data x to be tested; Wherein, F (x)={ f
0, f
1f
if
255, f
ifor the number of times of byte value i appearance in the crumb data taking sector as unit;
Step 2, calculates the similarity T of byte frequency distribution between crumb data x to be tested and a certain sample S by formula (1)
x,
Wherein, A=F (x), is the byte frequency distribution of sector, described test crumb data x place, and S is the frequency distribution of sample data byte;
n=256;
Step 3, judges the similarity T of byte frequency distribution between described crumb data x to be tested and a certain sample S
xwhether fall into a kind of crumb data type T of known types T
ithe scope of similarity in, if fallen into, judge that described test crumb data x belongs to known types T
ithe type of representative; If do not fallen in the scope of any one known types T, judge the type None-identified of described crumb data x to be tested; ;
Wherein, T={T
1, T
2... T
it
mrepresent that T has m kind crumb data type, T
irepresent i kind crumb data type, i=1 ... m.
Further, the recognition methods of described crumb data type also comprises step 4,
Step 4, the similarity T of byte frequency distribution between described crumb data x to be tested and a certain sample S
xfall into a known types T
ithe scope of similarity in time, further judge in crumb data x, whether there is δ
xif, exist, determine whether to meet δ
x∈ T
jif, meet, and, if i=j judges that described test crumb data x belongs to known types T
ithe type of representative;
Wherein, δ
xfor the architectural feature of described a certain file type, Tj is the set of the architectural feature of UNKNOWN TYPE data.
Further, the recognition methods of described crumb data type also comprises step 5,
Step 5, the similarity T of byte frequency distribution between the crumb data x described to be tested in step 3 and a certain sample S
xfall into a known types T
ithe scope of similarity in similarity while being less than preset range, or when i ≠ j in step 4, judge that the similarity of other crumb data in the data block at described crumb data to be measured place falls into described known types T
iscope in quantity whether reach predetermined quantity, if reached, judge that described crumb data x belongs to data type T
ithe type of representative, otherwise judge described crumb data x None-identified.
In addition, before the step 1 of the recognition methods of aforesaid crumb data type, comprise the steps:
Steps A: extract sample pattern S, determine the similarity between crumb data and the described sample pattern S of various file types;
Step B: extract the architectural feature δ of various file types, wherein, δ={ δ
1, δ
2δ
iδ
m, represent that δ has the architectural feature of m kind file type.
Crumb data of the present invention comprises the crumb data in crumb data and the internal memory in disk.
Method provided by the invention can be identified the type of crumb data, for follow-up crumb data recombination provides basis, thereby can make it possible to recover the file with certain content according to crumb data, for judicial evidence collection provides technical support.
Below in conjunction with the drawings and specific embodiments, technical scheme of the present invention is described in detail.
brief description of the drawings
Fig. 1 is the process flow diagram of crumb data kind identification method of the present invention;
Fig. 2 is the process flow diagram of a specific embodiment of crumb data kind identification method of the present invention;
Fig. 3 is the detail flowchart of step S15 in Fig. 2;
Fig. 4 is the detail flowchart of step S16 in Fig. 2;
Fig. 5 is the process flow diagram of crumb data evidence obtaining work.
Embodiment
As shown in Figure 1, be the process flow diagram of crumb data kind identification method of the present invention.
Step S1, before starting to carry out crumb data type identification, first will carry out preliminary work, should obtain byte frequency distribution sample and its distinctive architectural feature in various file type data region.If byte frequency distribution sample and its distinctive architectural feature in existing various file type data region, can skip this step and directly start to carry out identification work from step 2, if do not had, need to extract by a large amount of work in this step, as collection, contrast, analysis, summary etc., obtain byte frequency distribution sample and its distinctive architectural feature in various file type data region, for the type identification of lower step provides basis.
Step S2, for the crumb data to be tested that will identify, extracts the byte frequency distribution of crumb data to be tested.
Step S3, utilizes Tanimoto coefficient to set up corresponding model of cognition, calculates the similarity of the byte frequency distribution of crumb data to be tested and a certain sample.
Step S4, the similarity of the byte frequency distribution of the crumb data of the similarity calculating and a known type and same sample is compared, the scope of a similarity after whether the similarity that judgement calculates falls into, if fallen into, in step S4, the crumb data of determining crumb data to be tested and this known type belongs to same type, if not in the scope of a rear similarity, confirms this crumb data None-identified to be tested.
Wherein, judgement according to obtaining in advance, the similarity that is the byte frequency distribution of the crumb data of known certain type and a certain sample should be a known range, so just, can judge whether the similarity of calculating falls into this scope, if fallen into, illustrate that crumb data to be tested belongs to the type.
In addition, the present invention proposes the identification of the auxiliary crumb data type of two class Optimal Parameters, the one, search the specific structural features that whether contains related data type in crumb data, the 2nd, consider the relevance of crumb data, be between crumb data to be tested and adjacent crumb data type, have certain associated, can strengthen the accuracy of crumb data identification by these two kinds of methods, and guarantee in identifying, not change raw data, thereby guarantee authenticity and the reliability of counting.
Fig. 2 is the process flow diagram of a specific embodiment of crumb data kind identification method of the present invention, specifically comprises following step: 1) pre-service; 2) set up model of cognition; 3) type under the tested crumb data of preliminary judgement; 4) dependency structure of introducing tested crumb data is characterized as Optimal Parameters 1; 5) between introducing crumb data, the relevance of distance is Optimal Parameters 2.Utilize Optimal Parameters can improve the accuracy of crumb data type identification.Below illustrate above steps:
Step S11, pre-service.At pretreatment stage, comprise the byte frequency distribution sample that extracts various file type data region, set up sample pattern S, wherein, S={S
1, S
2... S
is
m, the set of S representative sample model, s
ibe one of them daughter element, this is that method with mathematics is out abstract sample pattern, represents with S;
Also comprise the distinctive architectural feature δ of extraction document type, wherein, δ={ δ
1, δ
2δ
iδ
m, the set of δ representation file architectural feature.
Byte frequency distribution refers to the operating system aspect of leaving, by the frequency distribution of byte statistics raw data.In function F (x), f
irepresent the number of times that in the crumb data taking sector as unit, byte value i (being the corresponding decimal system numerical value of each byte (byte) in computing machine) occurs.By this function F (x), can extract according to the difference of different types of data self property the feature of byte frequency distribution, the advantage of this feature is: can abandon the surface that file type, file extension, file special identifier etc. are given by operating system, be based on the content of crumb data self, can truly reflect the characteristic of crumb data.
The distinctive architectural feature δ of file type, refers to its distinctive continuous binary data mark of various file types, and these architectural features are not only distributed in the reference position of file, and are likely distributed in the central or ending of file.Need to obtain by mass data analysis, can automatically be obtained by some algorithm by machine, also can manual analysis obtain.
About the distinctive architectural feature δ of file type, different file types, its architectural feature difference, taking jpeg file type as example, the file of jpeg file type mainly comprises binary data mark as shown in table 1 below.
Table 1
| Code | Implication |
| FFD8 | SOI SOI (Start of Image) |
| FFE0 | APP0 mark (Marker) |
| FFDB | Quantization table DQT (difine quantization table) |
| FFC4 | Huffman table DHT (Difine Huffman Table) |
| FFC0 | Two field picture starts SOF0 (Start of Frame) |
| FFDA | Scanning starts SOS (Start of Scan) |
| FFD9 | Image finishes EOI (End ofImage) |
The byte frequency distribution F (x) of step S12, extraction test crumb data x (x represents the code name of tested crumb data), wherein, F (x)={ f
0, f
1f
if
255.
Step S13, by Tanimoto coefficient, formula (1) calculates the similarity T of byte frequency distribution between sample S and test data F (x)
x.
Tanimoto coefficient can be measured the similarity of document data, and reduction is Jaccard coefficient in double attributes situation.The present invention proposes a kind of crumb data model of cognition based on byte frequency distribution, this model is taking the crumb data of 512B as minimum test cell, add up the byte frequency distribution F (x) in each test 512B, can draw the similarity T of byte frequency distribution between sample S and test crumb data F (x) by Tanimoto coefficient
x.
Wherein A=F (X), for the byte frequency distribution of test sector, crumb data x place, is 1 dimensional vector with 256 elements; S is the byte frequency distribution of sample data;
Visible, the span of T is [0,1], and in the time of T=0, A and S similarity are minimum; In the time that T trends towards equaling 1, A and S similarity are the highest.The value of T from 0 to 1 o'clock, A and S similarity were from low to high.
In the time calculating similarity, can calculate by means of means such as computing machines, for example, in computing machine, write calculation procedure, input S and A by inputting interface, can automatically calculate the similarity T of byte frequency distribution between sample S and test data F (x)
x.
Step S14, calculates the similarity T of byte frequency distribution between sample S and test data F (x)
xafter, the similarity T of the tested crumb data x of preliminary judgement
xwhether fall within the scope of the similarity of the crumb data of a known type and the byte frequency distribution of same sample.
In the present invention, the similarity between pre-stored with good grounds various types of crumb data and sample and the data type T that draws, i.e. T={T
1, T
2... T
it
m, represent total m kind crumb data type.Wherein, Ti representative be i kind data type, it represents with two parameter Ti1, Ti2, wherein, Ti1 represents similarity, the similarity of i kind data type represents with Ti1, and it is the scope of from 0 to 1, and the similarity of each data type has an effective range, taking jpeg file type as example, utilizing the effective range of the similarity that Tanimoto coefficient calculations goes out is [0.55,1], between 0.55 to 1; The set of Ti2 representative data architectural feature, the data structure characteristic set of i kind data type represents with Ti2, for example, the data structure characteristic set of jpeg file type can be the content of aforementioned table 1.
The data type T drawing based on the above-mentioned pre-stored similarity according between various types of crumb data and sample, the similarity T of the tested crumb data x of preliminary judgement
xwhether fall within the scope of Ti1, if similarity T
xfall within the scope of Ti1, can think that crumb data x belongs to i class crumb data; If similarity T
xdo not fall within the scope of Ti1, can think that crumb data x does not belong to i class crumb data, need to continue to judge similarity T
xwhether fall into T
i+1scope, within the scope of the similarity of another known type, if similarity T
xall do not fall within the scope of the similarity of all known types, this tested crumb data None-identified of thinking prestoring by m kind goes out type.
Step S15, introduce the dependency structure feature δ of tested crumb data
xfor Optimal Parameters 1, as shown in Figure 3.Be the similarity T of byte frequency distribution between crumb data x and a certain sample S
xfall into a known similar degree T
iscope in time, further judge in crumb data x, whether there is δ
xif, exist, continue to judge whether to meet δ
x∈ T
j, wherein, Tj represents the data structure characteristic set of another kind of UNKNOWN TYPE, if meet δ
x∈ T
j, continue to judge whether i equates with j, if i=j illustrates that the data structure characteristic set of Tj representative is identical with Ti2, can judge that described test crumb data x belongs to data type T
ithe type of representative.If i and j are unequal, continue step S 16, if do not meet δ
x∈ T
j, or the not no δ that exists in crumb data x
x, this situation is not analyzed, with the judged result of step S14 as overall result.
In step S15, the similarity T of byte frequency distribution between described crumb data x to be tested and a certain sample S
xfall into a known types T
isimilarity within the scope of time, further confirm the architectural feature δ of described crumb data x to be tested
xwhether also belong to this known types T
iarchitectural feature set, thereby determine more exactly the type of judgement test crumb data x.
Between step S16, introducing crumb data, the relevance of distance is Optimal Parameters 2.Be 80% because fragment in identical file is distributed in 32 possibilities within data block, therefore crumb data in disk and Non-random distribution, is to have certain relevance between fragment, and a certain section of continuous crumb data belongs to same file.
In step S15, in the time of i ≠ j, or in step S14, although the similarity T of tested crumb data x
xfall within the scope of Ti1, but similarity is lower, for example, taking jpeg file type as example, the effective range of similarity is [0.55,1], and the similarity T of tested crumb data x
xbe 0.56, the similarity degree of obvious tested crumb data x and jpeg file type is very low.In above-mentioned two situations, all can adopt the measure of step S16.As shown in Figure 4, whether the sequence number that judges current tested crumb data x is last of place data block, if not, sequence number adds 1, then judge that the similarity of crumb data of this sequence number is whether within the scope of Ti, loop comparison, until other data of tested crumb data x place data block are all compared, then add up the number of the crumb data of similarity within the scope of Ti, if similarity is greater than 80% in the ratio of the quantity of Ti scope internal fragment data, judge that described crumb data x belongs to data type T
ithe type of representative, otherwise judge described crumb data x None-identified.
In step S16, judgement falls into T
iscope in the crumb data ratio that accounts for this data block have muchly, for example, if be greater than 80%, can think very definitely that described crumb data x belongs to data type T
ithe type of representative.
Can effectively evaluate the type of crumb data by above-described embodiment.In addition, when Memory Allocation, distributing by page (4K), is the integral multiple of 512B, and therefore, the crumb data described in the present invention also can refer to it is the data in internal memory.
Crumb data kind identification method of the present invention can provide certain electronic evidence information for judicial evidence collection, guarantee to identify on the one hand the type of crumb data, further, improve the discrimination of type, on the other hand, ensured the reliability of the data in crumb data type identification process, with the consistance of raw data, for certain place mat work is done in follow-up crumb data recombination.
Fig. 5 is the collect evidence process flow diagram of whole work of crumb data.Wherein preparatory stage and crumb data are extracted the stage as a series of preliminary work of the present invention, are not described in detail at this, can adopt existing universal method.When having extracted after crumb data, carry out the analysis of crumb data, comprising rejecting contiguous file data block, carrying out the identification of crumb data type of the present invention, then carry out the restructuring of crumb data, then show fragment evidence, and be submitted to court, reach a conclusion according to the crumb data obtaining.
By the identification of crumb data type of the present invention, for the restructuring of next step crumb data in electronic evidence-collecting provides the foundation, and, because the crumb data in electronic evidence-collecting process of the present invention has ensured obtaining, in identification, regrouping process and the consistance of raw data, therefore reliability and the authenticity of the electronic evidence obtaining, have fundamentally been guaranteed.
Claims (8)
1. a recognition methods for crumb data type, is characterized in that: comprise the following steps:
Step 1, extracts the byte frequency distribution F (x) of crumb data x to be tested; Wherein, F (x)={ f
0, f
1f
if
255, f
ifor the number of times of byte value i appearance in the crumb data taking sector as unit;
Step 2, calculates the similarity T of byte frequency distribution between crumb data x to be tested and a certain sample S by formula (1)
x,
Wherein, A=F (x), is the byte frequency distribution of sector, described test crumb data x place, and S is the frequency distribution of sample data byte;
n=256;
Step 3, judges the similarity T of byte frequency distribution between described crumb data x to be tested and a certain sample S
xwhether fall into a kind of crumb data type T of known types T
ithe scope of similarity in, if fallen into, judge that described test crumb data x belongs to known types T
ithe type of representative; If do not fallen in the scope of any one known types T, judge the type None-identified of described crumb data x to be tested;
Wherein, T={T
1, T
2... T
it
mrepresent that T has m kind crumb data type, T
irepresent i kind crumb data type, i=1 ... m.
2. the recognition methods of crumb data type according to claim 1, is characterized in that: also comprise step 4,
Step 4, the similarity T of byte frequency distribution between described crumb data x to be tested and a certain sample S
xfall into a known types T
ithe scope of similarity in time, further judge in crumb data x, whether there is δ
xif, exist, determine whether to meet δ
x∈ T
jif, meet, and, if i=j judges that described test crumb data x belongs to known types T
ithe type of representative;
Wherein, δ
xfor the architectural feature of a certain file type, T
jfor the set of the architectural feature of UNKNOWN TYPE data.
3. the recognition methods of crumb data type according to claim 1 and 2, is characterized in that: also comprise step 5,
Step 5, the similarity T of byte frequency distribution between the crumb data x described to be tested in step 3 and a certain sample S
xfall into a known types T
ithe scope of similarity in similarity while being less than preset range, or when i ≠ j in step 4, judge that the similarity of other crumb data in the data block at described crumb data to be measured place falls into described known types T
iscope in quantity whether reach predetermined quantity, if reached, judge that described crumb data x belongs to data type T
ithe type of representative, otherwise judge described crumb data x None-identified.
4. the recognition methods of crumb data type according to claim 1, is characterized in that: before step 1, comprise the steps:
Steps A: extract sample pattern S, determine the similarity between crumb data and the described sample pattern S of various file types.
5. the recognition methods of crumb data type according to claim 1, is characterized in that: before step 1, comprise the steps:
Step B: extract the architectural feature δ of various file types, wherein, δ={ δ
1, δ
2δ
iδ
m, represent that δ has the architectural feature of m kind file type.
6. the recognition methods of crumb data type according to claim 1, is characterized in that: described crumb data comprises the crumb data in crumb data and the internal memory in disk.
7. the recognition methods of crumb data type according to claim 3, is characterized in that: the quantity of described crumb data to be measured place data block is 2
5-2
8piece.
8. the recognition methods of crumb data type according to claim 3, is characterized in that: described predetermined quantity is more than 80% quantity that accounts for described crumb data to be measured place data block quantity.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110031123.8A CN102622302B (en) | 2011-01-26 | 2011-01-26 | Recognition method for fragment data type |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110031123.8A CN102622302B (en) | 2011-01-26 | 2011-01-26 | Recognition method for fragment data type |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102622302A CN102622302A (en) | 2012-08-01 |
| CN102622302B true CN102622302B (en) | 2014-10-29 |
Family
ID=46562229
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110031123.8A Expired - Fee Related CN102622302B (en) | 2011-01-26 | 2011-01-26 | Recognition method for fragment data type |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102622302B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105718335B (en) * | 2016-01-27 | 2019-02-22 | 四川驭奔科技有限公司 | Single file extracting method based on feature |
| CN107729558B (en) * | 2017-11-08 | 2021-06-29 | 郑州云海信息技术有限公司 | Method, system and device for defragmenting file system and computer storage medium |
| CN108319518B (en) * | 2017-12-08 | 2023-04-07 | 中国电子科技集团公司电子科学研究院 | File fragment classification method and device based on recurrent neural network |
| CN109828866B (en) * | 2019-01-26 | 2023-04-14 | 郑州汉江电子技术有限公司 | XFS file fragment recovery method and device |
| CN111309267B (en) * | 2020-02-26 | 2023-10-03 | Oppo广东移动通信有限公司 | Storage space allocation method and device, storage equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090299999A1 (en) * | 2009-03-20 | 2009-12-03 | Loui Alexander C | Semantic event detection using cross-domain knowledge |
| CN101604364A (en) * | 2009-07-10 | 2009-12-16 | 珠海金山软件股份有限公司 | Computer rogue program categorizing system and sorting technique based on file instruction sequence |
| CN101923618A (en) * | 2010-08-19 | 2010-12-22 | 中国航天科技集团公司第七一○研究所 | Hidden Markov model based method for detecting assembler instruction level vulnerability |
-
2011
- 2011-01-26 CN CN201110031123.8A patent/CN102622302B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090299999A1 (en) * | 2009-03-20 | 2009-12-03 | Loui Alexander C | Semantic event detection using cross-domain knowledge |
| CN101604364A (en) * | 2009-07-10 | 2009-12-16 | 珠海金山软件股份有限公司 | Computer rogue program categorizing system and sorting technique based on file instruction sequence |
| CN101923618A (en) * | 2010-08-19 | 2010-12-22 | 中国航天科技集团公司第七一○研究所 | Hidden Markov model based method for detecting assembler instruction level vulnerability |
Non-Patent Citations (4)
| Title |
|---|
| 《File Fragment Classification——The Case for Specialized Approaches》;Vassil Roussev,et al;《2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering》;20091231;全文 * |
| 《基于递归与多线程的丢失文件查找设计》;钟秀玉 等;《计算机技术与发展》;20100930;第20卷(第9期);全文 * |
| Vassil Roussev,et al.《File Fragment Classification——The Case for Specialized Approaches》.《2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering》.2009,全文. |
| 钟秀玉 等.《基于递归与多线程的丢失文件查找设计》.《计算机技术与发展》.2010,第20卷(第9期),全文. |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102622302A (en) | 2012-08-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102622302B (en) | Recognition method for fragment data type | |
| CN102682024B (en) | Method for recombining incomplete JPEG file fragmentation | |
| CN111125089A (en) | Time sequence data storage method, device, server and storage medium | |
| CN101706825B (en) | Replicated data deleting method based on file content types | |
| CN104142984B (en) | It is a kind of to be based on thick fine-grained video fingerprint retrieval method | |
| CN109117440B (en) | Metadata information acquisition method, system and computer readable storage medium | |
| CN104021132A (en) | Method and system for verification of consistency of backup data of host database and backup database | |
| CN103812877B (en) | Data compression method based on Bigtable distributed memory system | |
| JP6065844B2 (en) | Index scanning device and index scanning method | |
| CN105893585B (en) | A kind of bigraph (bipartite graph) model academic paper recommended method of combination tag data | |
| CN106201774B (en) | NAND FLASH storage chip data storage structure analysis method | |
| CN104156562A (en) | Failure predication system and failure predication method for background operation and maintenance system of bank | |
| CN103984758A (en) | Remote sensing image time sequence clustering method for conducting separated treatment according to cloud pixel number | |
| CN104361109A (en) | Method and device for determining picture screening result | |
| CN114049788B (en) | Parking blind spot identification method and device, electronic device and computer program product | |
| CN103945238A (en) | Community detection method based on user behaviors | |
| CN106383897B (en) | Database volume computational methods and device | |
| CN114153898A (en) | Method, device and application for combing relationships among database tables | |
| KR20140000369A (en) | Forensic analysis method and system for document files | |
| CN107590233B (en) | File management method and device | |
| Billard et al. | Making sense of unstructured flash-memory dumps | |
| CN116319815B (en) | Cloud data placement policy management system introducing SaaS features | |
| EP3451611B1 (en) | Method and apparatus for setting mobile device identifier | |
| CN109886318B (en) | Information processing method and device and computer readable storage medium | |
| CN115640597B (en) | Audit data validity verification method for block chain low storage overhead |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20141029 |