CN104699794A - Method for completely removing deleted jpg format in FAT 32 document system - Google Patents
Method for completely removing deleted jpg format in FAT 32 document system Download PDFInfo
- Publication number
- CN104699794A CN104699794A CN201510116689.9A CN201510116689A CN104699794A CN 104699794 A CN104699794 A CN 104699794A CN 201510116689 A CN201510116689 A CN 201510116689A CN 104699794 A CN104699794 A CN 104699794A
- Authority
- CN
- China
- Prior art keywords
- file
- jpg
- directory entry
- deleted
- perform
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 17
- 239000012634 fragment Substances 0.000 claims abstract description 11
- 238000012986 modification Methods 0.000 claims description 10
- 230000004048 modification Effects 0.000 claims description 10
- 238000013467 fragmentation Methods 0.000 claims description 4
- 238000006062 fragmentation reaction Methods 0.000 claims description 4
- 230000002123 temporal effect Effects 0.000 claims description 4
- 241001269238 Data Species 0.000 claims description 3
- 230000008878 coupling Effects 0.000 claims description 3
- 238000010168 coupling process Methods 0.000 claims description 3
- 238000005859 coupling reaction Methods 0.000 claims description 3
- 239000000203 mixture Substances 0.000 claims description 3
- 238000005516 engineering process Methods 0.000 description 3
- 230000007547 defect Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 238000011081 inoculation Methods 0.000 description 1
- 230000003449 preventive effect Effects 0.000 description 1
- 230000003716 rejuvenation Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/1724—Details of de-fragmentation performed by the file system
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a method for completely removing a deleted jpg format in a FAT 32 document system. The method comprises the following steps: S1: Searching all directory entries of the deleted jpg format document; S2: analyzing the directory entries and obtaining a distribution area of the jpg document; S3: writing in and filling empty value in the distribution zone; S4: obtaining a clear area position; S5: scanning and matching the clear area, and finding out fragment data; S6: writing in empty value and filling. Through a bottom layer, the method can analyze the deleted jpg document in the FAT 32 document system by, and find out the fragment data position of the deleted jpg document. The method ensures the safety of the normal jpg document while completely removes the jpg formatted document. Through the jpg document, the jpg document fragments in the clear area are removed for the second time, and thereby all fragment data are removed at the maximum degree, the public privacy is guaranteed, and malicious stealing behavior specific to private data is prevented.
Description
Technical field
The present invention relates to field of information security technology, particularly in a kind of thorough removing FAT32 file system, delete the method for jpg formatted file.
Background technology
In FAT32 system, the jpg file data deleted by user operation is not real being eliminated from storage medium, but the space storing jpg file is marked as idle condition, if this area stores alternative document time do not cover the fragment file that bulk portion can form jpg completely.Not affecting its part show this singularity because jpg formatted file data division damages, making deleted jpg formatted file data when not being completely covered easily by some current date restoring software rejuvenations out.The significant data information be not eliminated may be had, such as application information, geographical location information, photograph taking temporal information, photograph taking facility information etc. in jpg formatted file.These information can reveal the confidential data of user, and particularly country, army, economy, the administration of justice and enterprises and institutions' private data are revealed, and relate to individual privacy information and reveal.
The main flow file system of SD card is FAT32 on the market at present, and existing technology thoroughly can't be eliminated clearly in FAT32 and delete jpg formatted file data.Therefore, the method for having deleted jpg formatted file data in a kind of thorough elimination FAT32 of exploitation is badly in need of.
Summary of the invention
The present invention is directed to the defect of prior art, propose a kind of method removing normal file afterbody crumb data, effectively can solve above-mentioned prior art Problems existing.
To achieve these goals, the technical solution used in the present invention is:
Delete a method for jpg formatted file in thorough removing FAT32 file system, comprised the following steps:
S1: obtain target file system, obtain the directory entry of every layer of catalogue from root directory by layer, analytical bibliography item finds all directory entries having deleted jpg formatted file;
S2: the jpg file directory item obtained according to S1, resolves each directory entry and obtains the range of distribution of jpg file;
S3: the write range of distribution of each jpg formatted file that S2 obtains being carried out to null value is filled;
S4: the position, clear area being obtained target file system by the FAT table of FAT32 file system;
S5: carry out scan matching to each free cluster by the key mark of jpg file, finds jpg file fragmentation Data Position;
S6: write null value fills the free cluster of all storage jpg file datas in clear area.
As preferably, the detailed step of described S1 is as follows:
S101: all directory entry contents under a catalogue are read buffer zone;
S102: extract a directory entry in order;
S103: resolve directory entry, obtain directory entry attribute;
S104: the directory entry determining whether jpg formatted file, if then perform S105, otherwise performs S106;
S105: the directory entry recording this jpg formatted file;
S106: determine that all directory entries are parsed, if complete, terminate, if do not complete, performs S102.
As preferably, the detailed step of described S104 is as follows:
S1041: the directory entry delete property obtained according to S103, judges whether this directory entry is deleted status; If then perform S1042, then perform S106 if not;
S1042: the directory entry directory attribute obtained according to S103, judges whether this directory entry is file directory item; If then perform S1043, then perform S106 if not;
S1043: expand name information according to the directory entry that S103 obtains, judge whether this directory entry is jpg formatted file directory entry; If then perform S105, then perform S106 if not.
As preferably, the detailed step of described S2 is as follows:
S201: transfer the creation-time of all normal files of whole catalogue of S1 record and last modification time;
S202: the directory entry transferring one of them jpg formatted file of S1 record, obtains the creation-time of this file and last modification time;
S203: the temporal information of the jpg document time information of S202 and the normal file of S201 is contrasted one by one, filters out normal file immediate with jpg document time;
S204: obtain first bunch that the low level bunch number of this normal file and high-order bunch number obtain file, and obtain the range of distribution of file according to file size;
S205: check whether available free region, the front and back of this normal file by FAT table, if having, the jpg fragment file that expressed possibility performs S206, if do not have, then represents and does not have jpg fragment file to perform S208;
S206: by low level bunch number first bunch of the composition jpg file of the high position of normal file bunch number and jpg file, by the signature identification of first bunch of coupling jpg formatted file;
S207: record from first bunch of jpg file, until be recorded to jpg file size afterbody;
S208: judge whether to some extent deleted jpg file directory item has extracted; If then terminate, then perform S202 if not.
As preferably, the contrast in described S203 is that first documents creation-time is immediate, if not, contrasts last modification time immediate.
As preferably, the detailed step of described S5 is as follows:
S501: extract a free cluster in clear area in order;
S502: scan the jpg file characteristic mark whether single free cluster contains, if there is mark, perform S503, if not, perform S504;
S503: record this free cluster;
S504: judge whether clear area has been scanned; If then terminate, then perform S501 if not.
Compared with prior art the invention has the advantages that: by bottom, the jpg of the deletion file in FAT32 file system is resolved, find out the crumb data position of deleting jpg file.While the safety guaranteeing normal jpg file, the file deleting jpg form is thoroughly removed.Carry out secondary removing by the jpg file fragmentation of jpg representation of file to clear area, remove all crumb data to greatest extent.Ensured the data-privacy of the public, the malice of preventive inoculation to private data steals behavior.
Accompanying drawing explanation
Fig. 1 is the main flow chart of the embodiment of the present invention;
Fig. 2 is the detail flowchart of step S1 of the present invention;
Fig. 3 is the detail flowchart of step S2 of the present invention;
Fig. 4 is the detail flowchart of step S5 of the present invention.
Embodiment
In order to describe the specific embodiment of the present invention in detail, illustrate below in conjunction with accompanying drawing:
As shown in Figure 1, deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system, comprised the following steps:
S1: obtain target file system, obtain the directory entry of every layer of catalogue from root directory by layer, analytical bibliography item finds all directory entries having deleted jpg formatted file;
S2: the jpg file directory item obtained according to S1, resolves each directory entry and obtains the range of distribution of jpg file;
S3: carry out null value " 0x00 " write to the range of distribution of each jpg formatted file that S2 obtains and fill, reaches thoroughly to cover and removes this range of distribution;
S4: the position, clear area being obtained target file system by the FAT table of FAT32 file system;
S5: carry out scan matching to each free cluster by the key mark of jpg file, finds jpg file fragmentation Data Position;
S6: the free cluster of all storage jpg file datas in clear area is filled in write null value " 0x00 ".
As shown in Figure 2, the detailed step of described S1 is as follows:
S101: all directory entry contents under a catalogue are read buffer zone;
S102: extract a directory entry in order;
S103: resolve directory entry, obtains the delete property of directory entry, directory attribute, filename, expansion name, low level bunch number, high-order bunch number, creation-time, modification time;
S104: the directory entry determining whether jpg formatted file, if then perform S105, otherwise performs S106;
The detailed step of described S104 is as follows:
S1041: the delete property obtained according to S103, judges whether this directory entry is deleted status; If directory entry beginning is designated " E5 ", represents it is that deleted file performs S1042, then perform S106 if not;
S1042: the directory attribute obtained according to S103, judges whether this directory entry is file directory item; If then perform S1043, then perform S106 if not;
S1043: the expansion name obtained according to S103, judges that whether this directory entry is the expansion name of jpg formatted file; If then perform S105, then perform S106 if not.
S105: the directory entry recording this jpg formatted file;
S106: determine that all directory entries are parsed, if complete, terminate, if do not complete, performs S102.
As shown in Figure 3, the detailed step of S2 is as follows:
S201: transfer the creation-time of all normal files of whole catalogue of S1 record and last modification time;
S202: the directory entry transferring one of them jpg formatted file of S1 record, obtains the creation-time of this file and last modification time;
S203: the temporal information of the jpg document time information of S202 and the normal file of S201 is contrasted one by one, filters out normal file immediate with jpg document time; Here need first documents creation-time immediate, if not, contrast last modification time immediate.
S204: obtain first bunch that the low level bunch number of this normal file and high-order bunch number obtain file, and obtain the range of distribution of file according to file size;
S205: check whether available free region, the front and back of this normal file range of distribution by FAT table, if having, the jpg fragment file that expressed possibility performs S206, if do not have, then represents and does not have jpg fragment file to perform S208;
S206: by low level bunch number first bunch of the composition jpg file of the high position of normal file bunch number and jpg file, by the signature identification " 0xFFD8 " of first bunch of coupling jpg formatted file head;
S207: record from first bunch of jpg file, until be recorded to jpg file size afterbody; Size herein refers to all pieces that can hold and delete jpg file, and such as block size is 4096 bytes, and having deleted jpg file size is 40965 bytes, so just needs 11 blocks could hold this and has deleted jpg file;
S208: judge whether to some extent deleted jpg file directory item has extracted; If then terminate, then perform S202 if not.
As shown in Figure 4, the detailed step of described S5 is as follows:
S501: extract a free cluster in clear area in order;
S502: scan jpg file characteristic mark " 0xFFD8 ", " 0xFFD9 " that whether single free cluster contain, " JFIF ", " 0xFFE0 ", " 0xFFDA ", " 0xFFDB ", if there is one of them to identify, perform S503, if not, perform S504;
S503: record this free cluster;
S504: judge whether clear area has been scanned; If then terminate, then perform S501 if not.
Claims (6)
1. thoroughly remove a method of having deleted jpg formatted file in FAT32 file system, it is characterized in that comprising the following steps:
S1: obtain target file system, obtain the directory entry of every layer of catalogue from root directory by layer, analytical bibliography item finds all directory entries having deleted jpg formatted file;
S2: the jpg file directory item obtained according to S1, resolves each directory entry and obtains the range of distribution of jpg file;
S3: the write range of distribution of each jpg formatted file that S2 obtains being carried out to null value is filled;
S4: the position, clear area being obtained target file system by the FAT table of FAT32 file system;
S5: carry out scan matching to each free cluster by the key mark of jpg file, finds jpg file fragmentation Data Position;
S6: write null value fills the free cluster of all storage jpg file datas in clear area.
2. deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system according to claim 1, it is characterized in that the detailed step of described S1 is as follows:
S101: all directory entry contents under a catalogue are read buffer zone;
S102: extract a directory entry in order;
S103: resolve directory entry, obtain directory entry attribute;
S104: the directory entry determining whether jpg formatted file, if then perform S105, otherwise performs S106;
S105: the directory entry recording this jpg formatted file;
S106: determine that all directory entries are parsed, if complete, terminate, if do not complete, performs S102.
3. deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system according to claim 2, it is characterized in that the detailed step of described S104 is as follows:
S1041: the directory entry delete property obtained according to S103, judges whether this directory entry is deleted status; If then perform S1042, then perform S106 if not;
S1042: the directory entry directory attribute obtained according to S103, judges whether this directory entry is file directory item; If then perform S1043, then perform S106 if not;
S1043: expand name information according to the directory entry that S103 obtains, judge whether this directory entry is jpg formatted file directory entry; If then perform S105, then perform S106 if not.
4. deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system according to claim 1, it is characterized in that the detailed step of described S2 is as follows:
S201: transfer the creation-time of all normal files of whole catalogue of S1 record and last modification time;
S202: the directory entry transferring one of them jpg formatted file of S1 record, obtains the creation-time of this file and last modification time;
S203: the temporal information of the jpg document time information of S202 and the normal file of S201 is contrasted one by one, filters out normal file immediate with jpg document time;
S204: obtain first bunch that the low level bunch number of this normal file and high-order bunch number obtain file, and obtain the range of distribution of file according to file size;
S205: check whether available free region, the front and back of this normal file by FAT table, if having, the jpg fragment file that expressed possibility performs S206, if do not have, then represents and does not have jpg fragment file to perform S208;
S206: by low level bunch number first bunch of the composition jpg file of the high position of normal file bunch number and jpg file, by the signature identification of first bunch of coupling jpg formatted file;
S207: record from first bunch of jpg file, until be recorded to jpg file size afterbody;
S208: judge whether to some extent deleted jpg file directory item has extracted; If then terminate, then perform S202 if not.
5. deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system according to claim 1, it is characterized in that: the contrast in described S203 is that first documents creation-time is immediate, if not, contrasts last modification time immediate.
6. deleted the method for jpg formatted file in a kind of thorough removing FAT32 file system according to claim 1, it is characterized in that the detailed step of described S5 is as follows:
S501: extract a free cluster in clear area in order;
S502: scan the jpg file characteristic mark whether single free cluster contains, if there is mark, perform S503, if not, perform S504;
S503: record this free cluster;
S504: judge whether clear area has been scanned; If then terminate, then perform S501 if not.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510116689.9A CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510116689.9A CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104699794A true CN104699794A (en) | 2015-06-10 |
| CN104699794B CN104699794B (en) | 2018-11-13 |
Family
ID=53346914
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510116689.9A Active CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104699794B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104991940A (en) * | 2015-07-07 | 2015-10-21 | 广东欧珀移动通信有限公司 | Method and apparatus for filtering files in file system of terminal |
| CN107704595A (en) * | 2017-10-13 | 2018-02-16 | 苏州亿科赛卓电子科技有限公司 | A kind of method and device of quickly deleting file |
| CN107943804A (en) * | 2016-10-12 | 2018-04-20 | 中标软件有限公司 | The system and method for data is periodically deleted on mobile terminal |
| CN108170372A (en) * | 2017-12-08 | 2018-06-15 | 厦门集微科技有限公司 | data processing method and device based on cloud hard disk |
| CN109522756A (en) * | 2018-09-27 | 2019-03-26 | 中国科学院信息工程研究所 | A kind of data method for deleting and device |
| CN111382126A (en) * | 2018-12-28 | 2020-07-07 | 卡巴斯基实验室股份制公司 | System and method for deleting files and hindering file recovery |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1928869A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for deleting files in FAT roll |
| CN1928868A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for completely crashing file data in FAT roll |
| CN104504117A (en) * | 2014-12-31 | 2015-04-08 | 四川秘无痕信息安全技术有限责任公司 | Method for clearing tail fragment data of normal file |
-
2015
- 2015-03-18 CN CN201510116689.9A patent/CN104699794B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1928869A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for deleting files in FAT roll |
| CN1928868A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for completely crashing file data in FAT roll |
| CN104504117A (en) * | 2014-12-31 | 2015-04-08 | 四川秘无痕信息安全技术有限责任公司 | Method for clearing tail fragment data of normal file |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104991940A (en) * | 2015-07-07 | 2015-10-21 | 广东欧珀移动通信有限公司 | Method and apparatus for filtering files in file system of terminal |
| CN107943804A (en) * | 2016-10-12 | 2018-04-20 | 中标软件有限公司 | The system and method for data is periodically deleted on mobile terminal |
| CN107704595A (en) * | 2017-10-13 | 2018-02-16 | 苏州亿科赛卓电子科技有限公司 | A kind of method and device of quickly deleting file |
| CN108170372A (en) * | 2017-12-08 | 2018-06-15 | 厦门集微科技有限公司 | data processing method and device based on cloud hard disk |
| CN109522756A (en) * | 2018-09-27 | 2019-03-26 | 中国科学院信息工程研究所 | A kind of data method for deleting and device |
| CN111382126A (en) * | 2018-12-28 | 2020-07-07 | 卡巴斯基实验室股份制公司 | System and method for deleting files and hindering file recovery |
| CN111382126B (en) * | 2018-12-28 | 2023-08-15 | 卡巴斯基实验室股份制公司 | System and method for deleting file and preventing file recovery |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104699794B (en) | 2018-11-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104699794A (en) | Method for completely removing deleted jpg format in FAT 32 document system | |
| KR101456757B1 (en) | Method and Apparatus for recovering deleted data for SQLite database | |
| CN102629247B (en) | Method, device and system for data processing | |
| JP5316711B2 (en) | File storage device, file storage method and program | |
| CN102567427B (en) | Method and device for processing object data | |
| US9087207B2 (en) | Obtaining complete forensic images of electronic storage media | |
| CN107153794A (en) | File encrypting method and device, file decryption method and apparatus | |
| CN104462433B (en) | A kind of method of recovery FAT32 partition datas | |
| US11042507B2 (en) | System and method of deletion of files and counteracting their restoration | |
| TW201325179A (en) | Method and system for proving a digital file | |
| US20130013570A1 (en) | File storage apparatus, data storing method, and data storing program | |
| CN111125034A (en) | Aggregation object data processing method, system and related equipment | |
| Sitompul et al. | File reconstruction in digital forensic | |
| Şentürk et al. | Image and file system support framework for a digital mobile forensics software | |
| CN116069729B (en) | Intelligent document packaging method, system and medium | |
| Sanap et al. | Comparative study and simulation of digital forensic tools | |
| WO2020238376A1 (en) | Processing method for file data and solid-state drive | |
| US9098730B2 (en) | System and method for preserving electronically stored information | |
| CN103905694A (en) | Key frame processing method and system | |
| Haggerty et al. | Forsigs: Forensic signature analysis of the hard drive for multimedia file fingerprints | |
| Ogazi-Onyemaechi et al. | Performance of android forensics data recovery tools | |
| Sengupta et al. | A platform independent and forensically sound method to extract WhatsApp data from mobile phones | |
| Barton et al. | Forensic analysis of the recovery of Wickr’s ephemeral data on Android platforms | |
| EP3674876B1 (en) | System and method of deletion of files and counteracting their restoration | |
| KR101539617B1 (en) | File wiping method according to file type structure in mobile system, and apparatus thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Huang Xu Inventor after: Yang Xianmin Inventor before: Huang Xu |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address | ||
| CP03 | Change of name, title or address |
Address after: 641000 South side of Songshan South Road, Zhongqu District, Neijiang City, Sichuan Province Patentee after: Sichuan Miwu Traceless Science and Technology Co.,Ltd. Country or region after: China Address before: No. 183 Songshan Road, Neijiang, Sichuan, Sichuan Patentee before: SICHUAN MWH INFORMATION SECURITY TECHNOLOGY CO.,LTD. Country or region before: China |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20240529 Address after: 641100 No.1 Hanyu Avenue, Shizhong District, Neijiang City, Sichuan Province Patentee after: XLY SALVATIONDATA TECHNOLOGY Inc. Country or region after: China Address before: 641000 Songshan South Road 253, Neijiang City, Sichuan Province Patentee before: Sichuan Miwu Traceless Science and Technology Co.,Ltd. Country or region before: China |