Embodiment
In order to make the object of the invention, technical scheme and advantage clearer,, the present invention is further elaborated below in conjunction with accompanying drawing and embodiment.Should be appreciated that specific embodiment described herein only in order to explanation the present invention, and be not used in qualification the present invention.
In embodiments of the present invention, elder generation is the type of data recovered as required, scans the database file under the corresponding preset restoration path, and the deletion record that perhaps finds according to detected delete flag again recovers the data of deleting in the data library file.
Embodiment one
Fig. 1 shows the realization flow of the method for the restore data that the embodiment of the invention one provides, and present embodiment is applicable to the situation that the Mac mobile device has been escaped from prison, and at this moment, the device of restore data is installed on the Mac mobile device.Need to prove that escaping from prison is meant some leak that utilizes the iOS system, obtain the root authority of iOS through instruction, change some programs then and make that the function of Mac mobile device is strengthened, break through the closed environment of Mac mobile device, details are as follows:
In step S101, based on the ios plateform system, the type of data recovered scans the database file under the corresponding preset restoration path as required, and wherein, data of different types is preset with different restoration paths.
In the present embodiment; At first in the type of Mac mobile device according to want data recovered; Preset different restoration paths, and the device of restore data directly is installed on the Mac mobile device with the form of APP, again the Mac mobile device is connected with Apple Computers Mac end or general-purpose computer PC end.
When the needs restore data; The device that is installed in the restore data on the Mac mobile device can be according to type of data; Select corresponding preset restoration path; Scan the database file under this restoration path, recover, then the database file that scans is copied to Apple Computers Mac end or general-purpose computer PC end if carry out data in computer end.
Concrete; The Mac mobile device is the preset different restoration path of data of different types; Said restoration path is the memory location of data of different types in Mac mobile device disk; This memory location is preserved the database file of the type data down, and database file is the SQLite database format.Such as, the restoration path of the data of short message type is var/mobile/library/SMS, the data of short message type are kept under this restoration path with the form of sms.db database file; The restoration path of the data of address list type is var/mobile/library/AddressBook; The data of address list type are kept under this restoration path with the form of AddressBook.sqlitedb database file database file; Wherein, the suffix of the database file of accord with SQL ite database format can be that db also can be sqlitedb.
Particularly,,, scan the sms.db database file, and copy this database file to Mac end or PC end according to preset var/mobile/library/SMS restoration path when when recovering the data of short message type; When recovering the data of address list, according to preset var/mobile/library/AddressBook restoration path, scan A ddressBook.sqlitedb database file, and copy this database file to Mac end or PC end.In the present embodiment, though only introduced the data of short message type and address list type, this embodiment is equally applicable to the data of the literal types such as literal of message registration type, p.m.entry type or network browsing.
In step S102, detect the data that delete flag is arranged in the said database file or search the deletion record in the said database file.
The user is after carrying out deleted data on the Mac mobile device; The data of deletion still are kept in the original database; Behind the deleted data, the flag field of the data of this deletion in tables of data can be labeled as delete, carries out when synchronous at the Mac mobile device simultaneously; Will be eliminated by the index data of deleted data, but the data content zone also remains unchanged.
Concrete, can detect the data that delete flag is arranged in the said database file through the SQLite database, perhaps search the deletion record in the said database file through the SQLite database format.
In the present embodiment; Data structure according to the SQLite database format detects the data that delete flag is arranged in the said database file or uses the SQLite database format to analyze the hexadecimal data of said database file; Find the deletion record in the said database file, and the data of deleting in the said database file are recovered according to said delete flag or according to said deletion record.
Need to prove; The data structure of use SQLite database format detects when delete flag comes restore data can only use the SQLite database software; This database software is mounted in Mac or PC end; According to the hexadecimal data of SQLite database format analytical database file, search not rely on when deletion record comes restore data whether the SQLite database software is installed.In the embodiment of the invention; Detecting has the data of delete flag or searches deletion record according to the hexadecimal data of SQLite database format analytical database file in the SQLite database file; The data that all are based on the Mac mobile device are recovered, and the data of promptly being carried out based on the ios plateform system are recovered.
In step S103, perhaps the data of deleting in the said database file are recovered according to said deletion record according to said delete flag.
The method of the bright for instance below data of using delete flag once and undeleting according to the deletion record in the SQLite database format analytical database file:
Example 1, use delete flag recover
Suppose that the sms.db list structure is Rowid, address, name, flag;
The flag value can become 129 behind the deleted data;
In the Mac mobile device, carry out sqlite3-header sms.db " select Rowid, address, name from sms.db where flag=129 ", can recover the data of deleting.
Example 2, the data that undelete according to the deletion record in the SQLite database format analytical database file.
Read the hexadecimal data of sms.db; Page structure according to SQLite comes out the normal data area mark; Again according to tables of data gauge outfit key words such as " Rowid "; Do not have the remaining data district of mark to search coupling in a last step, and looked for and the successful address of Rowid coupling, recover the data in the page or leaf of match address place out.
In the present embodiment; Using the SQLite database to detect has the data of delete flag or uses the SQLite database format to search the deletion record in the said database file in the database file, and perhaps according to said deletion record the data of deleting in the said database file is recovered according to said delete flag.
Concrete, can said data be returned to Mac end or PC end, follow-uply can send the Mac mobile device to through iTunes; Also can data directly be returned to the Mac mobile device that is being connected with Mac end or PC end, but this process need uses associated drives or the assembly of iTunes.
Embodiment two
Fig. 2 shows the realization flow of the method for the restore data that the embodiment of the invention two provides, and present embodiment is applicable to the device that restore data is installed at Mac end or PC end, and the data in the Mac mobile device that is connecting are recovered, and details are as follows:
In step S201, search the Mac mobile device that is connected with Mac end or PC end.
In the present embodiment, Mac end or PC end are at first searched connected Mac mobile device.
In step S202, based on the ios plateform system, the type of data recovered scans the database file under the corresponding preset restoration path in the said Mac mobile device as required, and wherein, data of different types is preset with different restoration paths.
In the present embodiment, at first the Mac mobile device is according to the type of want data recovered, and preset different restoration path is connected the Mac mobile device again with Apple Computers Mac end or general-purpose computer PC end.
When the needs restore data; The device that is installed in the restore data of Mac end or PC end can be according to the type of Mac mobile device needs data recovered; Select corresponding preset restoration path; Scan the database file under this restoration path, recover, then the database file that scans is copied to Apple Computers Mac end or general-purpose computer PC end if carry out data in computer end.
In step S203, detect the data that delete flag is arranged in the said database file or search the deletion record in the said database file.
In step S204, perhaps the data of deleting in the said database file are recovered according to said deletion record according to said delete flag.
Wherein, can data be returned to Apple Computers Mac end or general-purpose computer PC end, send data recovered to the Mac mobile device, also can drive or/and assembly directly returns to the Mac mobile device with data through iTunes through iTunes.
In the present embodiment; Use SQLite database detects in the database file that is copied to Apple Computers Mac end or general-purpose computer PC end to be had the data of delete flag or uses the SQLite database format to search the deletion record in the said database file, and perhaps according to said deletion record the data of deleting in the said database file is recovered according to said delete flag.Concrete, can said data be returned to Mac end or PC end, follow-uply can send the Mac mobile device to through iTunes; Also can data directly be returned to the Mac mobile device that is being connected with Mac end or PC end, but this process need uses the associated drives of iTunes or/and assembly.
Concrete steps 202 see the description among the embodiment one for details to step 204, repeat no more at this.
Embodiment three
Fig. 3 shows the structured flowchart of the Mac mobile device that the embodiment of the invention three provides, and for the ease of explanation, only shows the part relevant with the embodiment of the invention.Said Mac mobile device comprises: document copying unit 31, file detecting unit 32 and data recovery unit 33.
Wherein, document copying unit 31 is used for the plateform system based on ios, and the type of data recovered scans the database file under the corresponding preset restoration path as required, and wherein, data of different types is preset with different restoration paths; File detecting unit 32, being used for detecting said database file has the data of delete flag or searches the deletion record in the said database file;
Data recovery unit 33 is used for recovering according to said delete flag or according to the data that said deletion record is deleted said database file.
Concrete, said file detecting unit 32 comprises: the first detection module and/or second detection module.
Wherein, first detection module is used for detecting the data that said database file has delete flag through the SQLite database;
Second detection module is used for searching through the SQLite database format deletion record of said database file.
Concrete, data recovery unit 33 comprises: first recovers module and/or second recovers module.
Wherein, first recovers module, is used for data are returned to Apple Computers Mac end or general-purpose computer PC end, sends data recovered to the Mac mobile device through iTunes;
Second recovers module, is used for driving or/and assembly directly returns to the Mac mobile device with data through iTunes.
Concrete, preset restoration path is provided with by the Mac mobile device in advance, and therefore, in the present embodiment, the Mac mobile device comprises that also restoration path preset unit 34, and this unit is used to data of different types and presets different restoration paths.
Wherein,, see also the description among the embodiment one, repeat no more at this about the specific descriptions of each unit.
Embodiment four
Fig. 4 shows the structured flowchart of the computer that the embodiment of the invention four provides, and for the ease of explanation, only shows the part relevant with the embodiment of the invention.Said computer can be Apple Computers Mac, also can be or general-purpose computer PC, and said computer comprises: equipment is searched unit 44, document copying unit 41, file detecting unit 42 and data recovery unit 43.
Wherein, document copying unit 41 is used for the type of data recovered as required, scans the database file under the corresponding preset restoration path, and wherein, data of different types is preset with different restoration paths; File detecting unit 42, being used for detecting said database file has the data of delete flag or searches the deletion record in the said database file;
Data recovery unit 43 is used for recovering according to said delete flag or according to the data that said deletion record is deleted said database file.
Concrete, preset restoration path is provided with by the Mac mobile device in advance, and therefore, in the present embodiment, preset restoration path is the store path of database file in the Mac mobile device.
In addition, in the present embodiment, need Mac or PC and corresponding M ac mobile device to communicate, therefore, Mac end or PC end comprise that equipment searches unit 44, and this unit is used to search the Mac mobile device that is connected with said Apple Computers Mac end.
In addition, the document copying unit 41 in the present embodiment also is used for the said database file that scans is copied to Apple Computers Mac end or general-purpose computer PC end.
Wherein,, see also the description among embodiment two and the embodiment three, repeat no more at this about the specific descriptions of each unit.
In embodiments of the present invention; Elder generation is the type of data recovered as required; Scan the database file under the corresponding preset restoration path; The deletion record that perhaps finds according to detected delete flag again recovers the data of deleting in the said database file, does not need iTunes that Apple Computers Mac end or general-purpose computer PC end are carried out can recovering the data of deleting at the Mac mobile device synchronously with the Mac mobile device; In addition, the device of this restore data can be built in Apple Computers Mac end or general-purpose computer PC end, also can be built in the Mac mobile device, makes things convenient for user's restore data.
The above is merely preferred embodiment of the present invention, not in order to restriction the present invention, all any modifications of within spirit of the present invention and principle, being done, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.