CN104699794B - A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system - Google Patents
A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system Download PDFInfo
- Publication number
- CN104699794B CN104699794B CN201510116689.9A CN201510116689A CN104699794B CN 104699794 B CN104699794 B CN 104699794B CN 201510116689 A CN201510116689 A CN 201510116689A CN 104699794 B CN104699794 B CN 104699794B
- Authority
- CN
- China
- Prior art keywords
- jpg
- file
- files
- deleted
- directory entry
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 14
- 241001269238 Data Species 0.000 claims abstract description 6
- 238000012217 deletion Methods 0.000 claims abstract description 6
- 230000037430 deletion Effects 0.000 claims abstract description 6
- 238000006062 fragmentation reaction Methods 0.000 claims abstract description 5
- 238000012986 modification Methods 0.000 claims description 9
- 230000004048 modification Effects 0.000 claims description 9
- 239000012634 fragment Substances 0.000 claims description 7
- 230000002123 temporal effect Effects 0.000 claims description 4
- 230000003139 buffering effect Effects 0.000 claims description 3
- 239000000284 extract Substances 0.000 claims description 3
- 238000013467 fragmentation Methods 0.000 claims description 3
- 238000011081 inoculation Methods 0.000 abstract description 2
- 230000003449 preventive effect Effects 0.000 abstract description 2
- 230000000694 effects Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 230000003716 rejuvenation Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/1724—Details of de-fragmentation performed by the file system
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a kind of methods for thoroughly removing and having deleted jpg formatted files in FAT32 file system, include the following steps：S1：It searches and all has deleted jpg formatted file directory entries；S2：Parsing directory entry and the distribution region for obtaining jpg files；S3：The write-in filling of null value is carried out to distribution region；S4：Obtain clear area position；S5：Matching is scanned to clear area, finds crumb data；S6：Null value filling is written.The present invention can parse the jpg files of deletion in FAT32 file system by bottom, and the crumb data position for having deleted jpg files is found out.Ensure normal jpg files it is safe while the file for having deleted jpg formats is thoroughly removed.Secondary removing is carried out to the jpg file fragmentations of clear area by jpg representation of file, removes all crumb datas to greatest extent.The data-privacy of the public, malice stealing behavior of the preventive inoculation to private data are ensured.
Description
Technical field
The present invention relates to field of information security technology, more particularly to one kind thoroughly removes has deleted in FAT32 file system
The method of jpg formatted files.
Background technology
In FAT32 systems, the jpg file datas deleted by user's operation are not really clear from storage medium
It removes, but the space for storing jpg files is marked as idle state, if when the region stores alternative document without complete
Covering bulk portion can form the fragment file of jpg.This is shown since the damage of jpg formatted file data portions does not influence its part
One particularity so that deleted jpg formatted files data are easy in the case where not being completely covered by some current numbers
It is come out according to software rejuvenation is restored.May there are the significant data information not being eliminated, such as application program letter in jpg formatted files
Breath, geographical location information, photograph taking temporal information, photograph taking facility information etc..These information can reveal the secret of user
Data, more particularly to country, army, economy, the administration of justice and enterprises and institutions' private data leakage, are related to individual privacy information and let out
Dew.
The mainstream file system of SD card is FAT32 on the market at present, and existing technology can't be eliminated thoroughly in FAT32 clearly
Jpg formatted file data are deleted.Therefore, it is badly in need of having deleted jpg formatted file data in a kind of thorough elimination FAT32 of exploitation
Method.
Invention content
The present invention in view of the drawbacks of the prior art, proposes a kind of method for removing normal file tail portion crumb data, can have
Solution the above-mentioned problems of the prior art of effect.
To achieve the goals above, the technical solution adopted by the present invention is：
A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system, include the following steps：
S1：Target file system is obtained, obtains the directory entry of every layer of catalogue by layer since root, analytical bibliography item is looked for
To all directory entries for having deleted jpg formatted files；
S2：According to the jpg file directory items that S1 is obtained, parses each directory entry and obtain the distribution region of jpg files；
S3：The write-in filling of null value is carried out to the distribution region of the S2 each jpg formatted files obtained；
S4：The clear area position of target file system is obtained by the FAT table of FAT32 file system；
S5：Matching is scanned to each free cluster by the signature identification of jpg files, finds jpg file fragmentation data
Position；
S6：The free cluster of all storage jpg file datas in null value filling clear area is written.
Preferably, the detailed step of the S1 is as follows：
S101：All directory entry contents under one catalogue are read into buffering area；
S102：A directory entry is extracted in order；
S103：Directory entry is parsed, directory entry attribute is obtained；
S104：Otherwise the directory entry for determining whether jpg formatted files executes S106 if so then execute S105；
S105：Record the directory entry of the jpg formatted files；
S106：It determines that all directory entries are parsed, terminates if being completed, if not completing, execute S102.
Preferably, the detailed step of the S104 is as follows：
S1041：The catalogue entry deletion attribute obtained according to S103 judges whether the directory entry is deleted status；If
S1042 is then executed, if otherwise executing S106；
S1042：The directory entry directory attribute obtained according to S103 judges whether the directory entry is file directory item；If
S1043 is then executed, if otherwise executing S106；
S1043：Name information is expanded according to the directory entry that S103 is obtained, judges whether the directory entry is jpg formatted file mesh
Record item；If so then execute S105, if otherwise executing S106.
Preferably, the detailed step of the S2 is as follows：
S201：Transfer the creation time of all normal files of entire catalogue of S1 records and last modification time；
S202：The directory entry for transferring one of S1 records jpg formatted files, obtains the creation time and most of this document
Modification time afterwards；
S203：The temporal information of the jpg document times information of S202 and the normal file of S201 is compared one by one, is sieved
It selects and the immediate normal file of jpg document times；
S204：The low level cluster number and high-order cluster number for obtaining the normal file obtain the first cluster of file, and according to file size
Obtain the distribution region of file；
S205：By FAT table check before and after the normal file whether available free region, indicate may there is jpg if having
Fragment file executes S206, if not having, then it represents that executes S208 without jpg fragment files；
S206：Jpg file head clusters are formed by the high-order cluster number of normal file and the low level cluster number of jpg files, pass through head
Cluster matches the signature identification of jpg formatted files；
S207：From jpg file head cluster start recordings, until jpg file sizes tail portion is recorded；
S208：Judge all to have deleted whether jpg file directorys item extracts completion；If then terminating, if otherwise executing
S202。
Preferably, the comparison in the S203 is that first documents creation time is immediate, if being compared most without if
Modification time is immediate afterwards.
Preferably, the detailed step of the S5 is as follows：
S501：A free cluster in clear area is extracted in order；
S502：It scans whether single free cluster identifies containing jpg file characteristics, S503 is executed if having mark, if not having
Then execute S504；
S503：Record the free cluster；
S504：Judge whether clear area scans completion；If then terminating, if otherwise executing S501.
Compared with prior art the advantage of the invention is that：It can be by bottom to the deletion jpg in FAT32 file system
File is parsed, and the crumb data position for having deleted jpg files is found out.Ensure normal jpg files it is safe while
File to having deleted jpg formats thoroughly removes.The jpg file fragmentations of clear area are carried out by jpg representation of file
All crumb datas are removed in secondary removing to greatest extent.The data-privacy of the public, evil of the preventive inoculation to private data are ensured
Meaning stealing behavior.
Description of the drawings
Fig. 1 is the main flow chart of the embodiment of the present invention；
Fig. 2 is the detail flowchart of step S1 of the present invention；
Fig. 3 is the detail flowchart of step S2 of the present invention；
Fig. 4 is the detail flowchart of step S5 of the present invention.
Specific implementation mode
For the specific implementation mode that the present invention will be described in detail, illustrate below in conjunction with the accompanying drawings：
As shown in Figure 1, a kind of thoroughly removing the method that jpg formatted files have been deleted in FAT32 file system, including it is following
Step：
S1：Target file system is obtained, obtains the directory entry of every layer of catalogue by layer since root, analytical bibliography item is looked for
To all directory entries for having deleted jpg formatted files；
S2：According to the jpg file directory items that S1 is obtained, parses each directory entry and obtain the distribution region of jpg files；
S3：Null value " 0x00 " is carried out to the distribution region of the S2 each jpg formatted files obtained, filling is written, reaches thorough
The distribution region is removed in covering；
S4：The clear area position of target file system is obtained by the FAT table of FAT32 file system；
S5：Matching is scanned to each free cluster by the signature identification of jpg files, finds jpg file fragmentation data
Position；
S6：The free cluster for all storage jpg file datas that null value " 0x00 " is filled in clear area is written.
As shown in Fig. 2, the detailed step of the S1 is as follows：
S101：All directory entry contents under one catalogue are read into buffering area；
S102：A directory entry is extracted in order；
S103：Parse directory entry, obtain the deletion attribute of directory entry, directory attribute, filename, expand name, low level cluster number,
High-order cluster number, creation time, modification time；
S104：Otherwise the directory entry for determining whether jpg formatted files executes S106 if so then execute S105；
The detailed step of the S104 is as follows：
S1041：The deletion attribute obtained according to S103 judges whether the directory entry is deleted status；If directory entry is opened
Head is identified as " E5 " and then indicates it is that deleted file executes S1042, if otherwise executing S106；
S1042：The directory attribute obtained according to S103 judges whether the directory entry is file directory item；If so then execute
S1043, if otherwise executing S106；
S1043：The expansion name obtained according to S103, judge the directory entry whether be jpg formatted files expansion name；If
S105 is then executed, if otherwise executing S106.
S105：Record the directory entry of the jpg formatted files；
S106：It determines that all directory entries are parsed, terminates if being completed, if not completing, execute S102.
As shown in figure 3, the detailed step of S2 is as follows：
S201：Transfer the creation time of all normal files of entire catalogue of S1 records and last modification time；
S202：The directory entry for transferring one of S1 records jpg formatted files, obtains the creation time and most of this document
Modification time afterwards；
S203：The temporal information of the jpg document times information of S202 and the normal file of S201 is compared one by one, is sieved
It selects and the immediate normal file of jpg document times；It is immediate to need exist for first documents creation time, if without if
It is immediate to compare last modification time.
S204：The low level cluster number and high-order cluster number for obtaining the normal file obtain the first cluster of file, and according to file size
Obtain the distribution region of file；
S205：By FAT table check before and after the normal file distribution region whether available free region, being indicated if having can
There can be jpg fragment files to execute S206, if not having, then it represents that execute S208 without jpg fragment files；
S206：Jpg file head clusters are formed by the high-order cluster number of normal file and the low level cluster number of jpg files, pass through head
Cluster matches the signature identification " 0xFFD8 " of jpg formatted file heads；
S207：From jpg file head cluster start recordings, until jpg file sizes tail portion is recorded；Size herein refers to energy
All pieces of jpg files have been deleted in enough receivings, for example block size is 4096 bytes, and it is 40965 words to have deleted jpg file sizes
Section, then just needing 11 blocks that could accommodate this has deleted jpg files；
S208：Judge all to have deleted whether jpg file directorys item extracts completion；If then terminating, if otherwise executing
S202。
As shown in figure 4, the detailed step of the S5 is as follows：
S501：A free cluster in clear area is extracted in order；
S502：Scan single free cluster whether containing jpg file characteristics mark " 0xFFD8 ", " 0xFFD9 ", " JFIF ",
" 0xFFE0 ", " 0xFFDA ", " 0xFFDB " execute S503, if without executing S504 if having one of mark；
S503：Record the free cluster；
S504：Judge whether clear area scans completion；If then terminating, if otherwise executing S501.
Above description elaborates detail to fully understand the present invention, but the present invention can also be different from using other
This describing mode is implemented, therefore the present invention is not limited to particular embodiments disclosed above.
Claims (6)
1. a kind of thoroughly removing the method for having deleted jpg formatted files in FAT32 file system, it is characterised in that including following step
Suddenly：
S1：Target file system is obtained, obtains the directory entry of every layer of catalogue by layer since root, analytical bibliography item finds institute
There is the directory entry for having deleted jpg formatted files；
S2：According to the jpg file directory items that S1 is obtained, parses each directory entry and obtain the distribution region of jpg files；
S3：The write-in filling of null value is carried out to the distribution region of the S2 each jpg formatted files obtained；
S4：The clear area position of target file system is obtained by the FAT table of FAT32 file system；
S5：Matching is scanned to each free cluster by the signature identification of jpg files, finds jpg file fragmentation Data Positions；
S6：The free cluster of all storage jpg file datas in null value filling clear area is written.
2. it is according to claim 1 it is a kind of thoroughly remove the method that jpg formatted files have been deleted in FAT32 file system, it is special
Sign is that the detailed step of the S1 is as follows：
S101：All directory entry contents under one catalogue are read into buffering area；
S102：A directory entry is extracted in order；
S103：Directory entry is parsed, directory entry attribute is obtained；
S104：Otherwise the directory entry for determining whether jpg formatted files executes S106 if so then execute S105；
S105：Record the directory entry of the jpg formatted files；
S106：It determines that all directory entries are parsed, terminates if being completed, if not completing, execute S102.
3. it is according to claim 2 it is a kind of thoroughly remove the method that jpg formatted files have been deleted in FAT32 file system, it is special
Sign is that the detailed step of the S104 is as follows：
S1041：The catalogue entry deletion attribute obtained according to S103 judges whether the directory entry is deleted status；If then holding
Row S1042, if otherwise executing S106；
S1042：The directory entry directory attribute obtained according to S103 judges whether the directory entry is file directory item；If then holding
Row S1043, if otherwise executing S106；
S1043：Name information is expanded according to the directory entry that S103 is obtained, judges whether the directory entry is jpg formatted file directory entries；
If so then execute S105, if otherwise executing S106.
4. it is according to claim 1 it is a kind of thoroughly remove the method that jpg formatted files have been deleted in FAT32 file system, it is special
Sign is that the detailed step of the S2 is as follows：
S201：Transfer the creation time of all normal files of entire catalogue of S1 records and last modification time；
S202：The directory entry for transferring one of S1 records jpg formatted files obtains the creation time of this document and finally repaiies
Change the time；
S203：The temporal information of the jpg document times information of S202 and the normal file of S201 is compared one by one, is filtered out
With the immediate normal file of jpg document times；
S204：The low level cluster number and high-order cluster number for obtaining the normal file obtain the first cluster of file, and are obtained according to file size
The distribution region of file；
S205：By FAT table check before and after the normal file whether available free region, indicate may there is jpg fragments if having
File executes S206, if not having, then it represents that executes S208 without jpg fragment files；
S206：Jpg file head clusters are formed by the high-order cluster number of normal file and the low level cluster number of jpg files, pass through first cluster
Signature identification with jpg formatted files；
S207：From jpg file head cluster start recordings, until jpg file sizes tail portion is recorded；
S208：Judge all to have deleted whether jpg file directorys item extracts completion；If then terminating, if otherwise executing S202.
5. it is according to claim 1 it is a kind of thoroughly remove the method that jpg formatted files have been deleted in FAT32 file system, it is special
Sign is：Comparison in the S203 is that first documents creation time is immediate, if comparing last modification time without if
It is immediate.
6. it is according to claim 1 it is a kind of thoroughly remove the method that jpg formatted files have been deleted in FAT32 file system, it is special
Sign is that the detailed step of the S5 is as follows：
S501：A free cluster in clear area is extracted in order；
S502：It scans whether single free cluster identifies containing jpg file characteristics, S503 is executed if having mark, if not holding
Row S504；
S503：Record the free cluster；
S504：Judge whether clear area scans completion；If then terminating, if otherwise executing S501.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510116689.9A CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510116689.9A CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104699794A CN104699794A (en) | 2015-06-10 |
| CN104699794B true CN104699794B (en) | 2018-11-13 |
Family
ID=53346914
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510116689.9A Active CN104699794B (en) | 2015-03-18 | 2015-03-18 | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104699794B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104991940A (en) * | 2015-07-07 | 2015-10-21 | 广东欧珀移动通信有限公司 | Method and apparatus for filtering files in file system of terminal |
| CN107943804A (en) * | 2016-10-12 | 2018-04-20 | 中标软件有限公司 | The system and method for data is periodically deleted on mobile terminal |
| CN107704595A (en) * | 2017-10-13 | 2018-02-16 | 苏州亿科赛卓电子科技有限公司 | A kind of method and device of quickly deleting file |
| CN108170372B (en) * | 2017-12-08 | 2021-02-19 | 厦门集微科技有限公司 | Data processing method and device based on cloud hard disk |
| CN109522756A (en) * | 2018-09-27 | 2019-03-26 | 中国科学院信息工程研究所 | A kind of data method for deleting and device |
| RU2715288C1 (en) * | 2018-12-28 | 2020-02-26 | Акционерное общество "Лаборатория Касперского" | System and method of deleting files and counteracting recovery thereof |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1928868A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for completely crashing file data in FAT roll |
| CN1928869A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for deleting files in FAT roll |
| CN104504117A (en) * | 2014-12-31 | 2015-04-08 | 四川秘无痕信息安全技术有限责任公司 | Method for clearing tail fragment data of normal file |
-
2015
- 2015-03-18 CN CN201510116689.9A patent/CN104699794B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1928868A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for completely crashing file data in FAT roll |
| CN1928869A (en) * | 2006-09-19 | 2007-03-14 | 珠海金山软件股份有限公司 | Method for deleting files in FAT roll |
| CN104504117A (en) * | 2014-12-31 | 2015-04-08 | 四川秘无痕信息安全技术有限责任公司 | Method for clearing tail fragment data of normal file |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104699794A (en) | 2015-06-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104699794B (en) | A method of it thoroughly removes and has deleted jpg formatted files in FAT32 file system | |
| CN103942058B (en) | A kind of EMBEDDED AVIONICS method for upgrading software and system | |
| CN102567427B (en) | Method and device for processing object data | |
| KR101456757B1 (en) | Method and Apparatus for recovering deleted data for SQLite database | |
| CN104123280B (en) | File comparison method and equipment | |
| US9063664B1 (en) | Method and system for processing checksum of a data stream to optimize deduplication | |
| US20170353475A1 (en) | Threat intelligence cloud | |
| CN107832625B (en) | Document processing method and device | |
| KR101575246B1 (en) | Corrupted record recovery method in SQLite database file | |
| CN111382126B (en) | System and method for deleting file and preventing file recovery | |
| Sitompul et al. | File reconstruction in digital forensic | |
| CN106155570A (en) | A kind of information technology for eliminating of storage medium | |
| Sari et al. | A review of graph theoretic and weightage techniques in file carving | |
| CN107220146B (en) | File scanning recovery method and device | |
| Sanap et al. | Comparative study and simulation of digital forensic tools | |
| Ravi et al. | A method for carving fragmented document and image files | |
| CN102737171B (en) | Method and device for storing virus file and storage equipment | |
| CN105653385B (en) | A kind of vehicle-mounted kinescope method | |
| CN103605600A (en) | Method and system for recording reading and writing times of memory units of memory card of mobile terminal | |
| Sengupta et al. | A platform independent and forensically sound method to extract WhatsApp data from mobile phones | |
| JP2010257330A (en) | System and method for managing log file, and program | |
| CN108874953A (en) | A kind of Office file content increases, deletes, changing separating latent marks method | |
| Common Digital Evidence Storage Format Working Group | Standardizing digital evidence storage | |
| CN109977121B (en) | Big data rapid storage system | |
| KR101539617B1 (en) | File wiping method according to file type structure in mobile system, and apparatus thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Huang Xu Inventor after: Yang Xianmin Inventor before: Huang Xu |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address | ||
| CP03 | Change of name, title or address |
Address after: 641000 South side of Songshan South Road, Zhongqu District, Neijiang City, Sichuan Province Patentee after: Sichuan Miwu Traceless Science and Technology Co.,Ltd. Country or region after: China Address before: No. 183 Songshan Road, Neijiang, Sichuan, Sichuan Patentee before: SICHUAN MWH INFORMATION SECURITY TECHNOLOGY CO.,LTD. Country or region before: China |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20240529 Address after: 641100 No.1 Hanyu Avenue, Shizhong District, Neijiang City, Sichuan Province Patentee after: XLY SALVATIONDATA TECHNOLOGY Inc. Country or region after: China Address before: 641000 Songshan South Road 253, Neijiang City, Sichuan Province Patentee before: Sichuan Miwu Traceless Science and Technology Co.,Ltd. Country or region before: China |