CN105760244A - exFAT formatting recovery method and device based on hypothesis and verification - Google Patents
exFAT formatting recovery method and device based on hypothesis and verification Download PDFInfo
- Publication number
- CN105760244A CN105760244A CN201610073181.XA CN201610073181A CN105760244A CN 105760244 A CN105760244 A CN 105760244A CN 201610073181 A CN201610073181 A CN 201610073181A CN 105760244 A CN105760244 A CN 105760244A
- Authority
- CN
- China
- Prior art keywords
- file
- css
- bunch
- sector
- sector number
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0727—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a storage system, e.g. in a DASD or network based storage system
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Design And Manufacture Of Integrated Circuits (AREA)
Abstract
The invention belongs to the field of computers, and particularly relates to an exFAT formatting recovery method and device based on hypothesis and verification after exFAT partitioning formatting. According to the method, a most possible cluster start sector number and the cluster size are calculated through hypothesis and reverse verification to serve as recovery parameters, and the accuracy of a recovery result is guaranteed to the maximum extent. The method has the advantages that the defects existing in an existing exFAT formatting recovery technique are overcome, the recovery effect is greatly improved, and the method is an important supplement for exFAT obliterated data recovery.
Description
Technical field
The invention belongs to computer realm, after being specifically related to a kind of exFAT partition format, based on the assumption that the exFAT of checking formats restoration methods and device.
Background technology
ExFAT, as the file system that FAT is extended, is a kind of file system being extremely suitable for use on flash memory, is widely used in above mobile memory medium.ExFAT loses the recovery of data and is always up an emphasis of concern inside information security field.The reason of exFAT loss of data can be largely classified into two kinds, and the first is deleted by mistake or malice is deleted, and the second is formatted or malice formatting by mistake.For the first situation, existing recovery technology is highly developed, it is possible to reach good recovery effects.For the second situation, existing recovery technology adopts some parameters after formatting to be used as the parameter in data recovery procedure, there is the recovery inaccurate situation of data.
The initial sector calculation of file content is as follows:
FileDataStartSector=ClusterStartSector+FileDataStartClus er*CluserSize/SectorSize
Wherein, the initial sector of FileDataStartSector representation file content, ClusterStartSector represents a bunch start sector number, and FileDataStartCluser represents the starting cluster number of file content, and CluserSize represents a bunch size.Additionally, ClusterStartSector and CluserSize can be subject to the impact of partition format, FileDataStartCluser records in file record, and the sector-size that SectorSize is disk is generally 512 bytes
When exFAT file system is formatted, in most cases simply having redistributed the relevant area information of file system and structural information, the file record information before formatting generally also can remain in disk.Therefore, the data before formatting can just be recovered by totally searching for the file record information of residual.
Referenced patent document CN102254048B discloses the method and system that a kind of data are recovered, after exFAT subregion is formatted, the file needing to recover scanned by calculating sector number corresponding to No. 2 bunches to demarcate, then passes through disk read operation and is recovered by file data from exFAT subregion.
Existing exFAT form recovery technology adopts bunch start sector number of subregion after formatting and bunch size to format the parameter recovered as exFAT, but owing to bunch size after formatting and two parameters of bunch start sector number have been likely occurred change, and in recovery process, the location recovering file content is again relied on these parameters, so the parameter after directly adopting formatting carries out recovery and there will be the inaccurate problem of restoration result.Although the attribute informations such as file name/size can be recovered, but the file content recovered is wrong.
Summary of the invention
For the weak point that prior art exists, the present invention proposes and a kind of proposes a kind of based on the assumption that the exFAT of checking formats restoration methods and device.The method by assuming that and reversely checking calculate most possible bunch start sector number and bunch size as recovery parameter, ensure that the accuracy of restoration result to the full extent.Experiments verify that, the recovery effects of the method is than the better effects if of existing recovery software.
The present invention adopts the following technical scheme that
It is a kind of that based on the assumption that the exFAT of checking formats restoration methods, it comprises the following steps,
S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize;
S2, obtains start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum;
S3, sets bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj);
S4, from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax);
S5, step S3 and step S4 are performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector';
S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
Further, step S2 includes step in detail below,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0;
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to;
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to;
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file;
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
Further, step S203 file folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
Further, in step S3, a bunch start sector number algorithm is:
Element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS/SectorSize。
Further, in S3, matching degree rule comprises the following steps,
S301, acquisition bunch is sized to CSjAnd bunch start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2,
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
It is a kind of that based on the assumption that the exFAT of checking formats recovery device, it includes,
Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors;
File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum;
Recover parameter acquiring unit, for according to setting bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj), from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax), choose (the CS that matching degree is maximumj, CSSmaxj) and (CSmax, CSSmaxmax) be performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector';
Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
Further, file or folder information acquisition unit performs step in detail below,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0;
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to;
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to;
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file;
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
Further, step S203 file folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
Further, bunch start sector number algorithm recovering parameter acquiring unit execution is:
Element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS/SectorSize。
Further, the matching degree rule recovering parameter acquiring unit employing comprises the following steps,
S301, acquisition bunch is sized to CSjAnd maximum bunch of start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2,
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
Existing exFAT formats the file content of recovery technology recovery and often makes mistakes, and tradition is based on the recovery technology of file characteristic, and the file recovered does not have again the information such as file name/size.The present invention is understanding in depth on the basis of exFAT file system structure, it is proposed that a kind of based on the assumption that the exFAT of checking formats restoration methods.The method by assuming that and reversely checking calculate most possible bunch start sector number and bunch size as recovery parameter, ensure that the accuracy of restoration result to the full extent.The method solves existing exFAT and formats the defect that recovery technology exists, and substantially increases recovery effects, is that exFAT loses great the supplementing that data are recovered.
Accompanying drawing explanation
Fig. 1 is based on the assumption that the exFAT of checking formats the flow chart of restoration methods;
Fig. 2 is that file or folder relevant information obtains flow chart;
Fig. 3 is formatting interface;
Fig. 4 is matching degree rule flow chart;
Fig. 5 is with the R-Studio file view loaded before formatting;
Fig. 6 is with the R-Studio schematic diagram loaded before formatting;
Fig. 7 is with the R-Studio file view recovered after formatting;
Fig. 8 is with the R-Studio schematic diagram recovered after formatting;
Fig. 9 is the schematic diagram that formatting uses that the present invention recovers.
Detailed description of the invention
For further illustrating each embodiment, the present invention is provided with accompanying drawing.These accompanying drawings are the part that the invention discloses content, and it is mainly in order to illustrate embodiment, and the associated description of description can be coordinated to explain the operation principles of embodiment.Coordinating with reference to these contents, those of ordinary skill in the art will be understood that other possible embodiments and advantages of the present invention.Assembly in figure is not necessarily to scale, and similar element numbers is conventionally used to indicate similar assembly.
In conjunction with the drawings and specific embodiments, the present invention is further described.
Consulting shown in Fig. 1, for based on the assumption that the exFAT of checking formats the flow chart of restoration methods, the method comprises the following steps:
S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize.
After exFAT file system is formatted, resolve the volume header of subregion after formatting, it is possible to obtain bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize.
S2, obtains start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum.
Wherein, DSkAnd DCpIt is integer numerical value.FIiInclude 4 property values: FileName (file name, a character string), FileTimeInfo (temporal information, including establishment time, modification time, access time, each temporal information is an integer), FileSize (file size, an integer), FileDataStartCluser (starting cluster number of file is an integer).
Consulting shown in Fig. 2, obtain flow chart for file or folder relevant information of the present invention, namely step S2 specifically includes following steps,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0.
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to.
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to file or folder data judging rules, if it is, forward step S204 to, if not, then when, after CurrentSector=CurrentSector+1, forwarding step S202 to.
Wherein, folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file.
File A includes file txt1, file txt2 and file B, then CurrentSector is the start sector number of file A, down resolve from this initial sector always, obtain the information of file txt1, file txt2 and file B, the information of file txt1, file txt2 and file B is deposited in FileInfoList, and the starting cluster DC of the file B of acquisition is deposited in DirStartCluserList.Therefore the length of DirStartSectorList, DirStartCluserList, FileInfoList is different.
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
If front portion is divided into file or folder information in sector 0, or not then CurrentSector=0, ValidSector=0, CurrentSector are equal to ValidSector, then forward step S202 to after CurrentSector=CurrentSector+1 in rear section.If at sector CurrentSector=0, till being resolved to ValidSector=5, then CurrentSector is not equal to ValidSector, CurrentSector=5.
S3, sets bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj)。
Consulting shown in Fig. 3, for formatting interface, during formatting, " allocation units size " (bunch size) is have certain span.Of the present invention CS={512,1024,2048,4096,8192,16384,32768,65536,131072,262144,524288,1048576,2097152,4194304,8388608,16777216,33554432} represent the value that bunch size is possible, have value 17 kinds possible, i.e. m=17.
For each bunch of size, calculate this bunch of bunch start sector number corresponding to size, with CS1=512 is example, and bunch start sector number algorithm is the element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS1/SectorSize
Pass through above formula, it is possible to obtain multiple bunches of start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum.
Matching degree rule is adopted to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj).Consult shown in Fig. 4, for matching degree rule flow chart.It comprises the following steps:
S301, acquisition bunch is sized to CSjAnd bunch start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2, DirStartSectorList' the same with the element number getting DirStartCluserList list in step S2, and DSh' meet the following conditions:
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
Match (CS is selected from all of matching degreej, CSSxj) maximum (CSj, CSSmaxj), bunch size CSjBunch start sector number of corresponding maximum match degree is CSSmaxj, then corresponding computing formula is as follows:
S4, from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax).Corresponding computing formula is:
S5, chooses successfully, and namely step S3 and step S4 is performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax;Under extreme case, DirStartCluserList or DirStartSectorList is likely sky, causes choosing failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'.
S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
The invention allows for a kind of based on the assumption that the exFAT of checking formats recovery device, it includes,
Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors;
File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum;
Recover parameter acquiring unit, for according to setting bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj), from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax), choose (the CS that matching degree is maximumj, CSSmaxj) and (CSmax, CSSmaxmax) be performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector';
Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
Wherein, file or folder information acquisition unit includes step in detail below,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0.
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to.
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to.
Folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file.
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
It should be noted that a bunch start sector number algorithm is in recovery parameter acquiring unit:
Element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS/SectorSize。
Additionally, matching degree rule comprises the following steps in recovery parameter acquiring unit,
S301, acquisition bunch is sized to CSjAnd maximum bunch of start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2,
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
In order to verify the present invention, do following experiment.Experimentation is:
1), create an exFAT form subregion, be admitted to the files such as some document pictures inside;
2), this zoned format is melted into FAT32 subregion, is respectively adopted R-Studio and the present invention carries out recovering contrast.
Consult shown in Fig. 5 and Fig. 6, for formatting the front R-Studio file view loaded and schematic diagram, it can be seen that the picture file in an exFAT subregion can normally preview before formatting.Consult shown in Fig. 7 and Fig. 8, for after formatting with the R-Studio file view recovered and schematic diagram, although but adopt after formatting R-Studio recovered when recovering the information file such as file name, size cannot preview, file content recovers to make mistakes.
Consult shown in Fig. 9, use the schematic diagram of present invention recovery for formatting.Adopting the present invention to recover not only to have recovered accurately the information such as file name, size to the subregion after formatting, file content can also normally preview.After the analysis of causes: exFAT is formatted, bunch size and a bunch start sector number there occurs change, and existing recovery technology cannot process this situation.
Although specifically showing in conjunction with preferred embodiment and describing the present invention; but those skilled in the art should be understood that; in the spirit and scope without departing from appended claims invention defined; the present invention can be made a variety of changes in the form and details, be protection scope of the present invention.
Claims (10)
1. one kind based on the assumption that checking exFAT format restoration methods, it is characterised in that: it comprises the following steps,
S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize;
S2, obtains start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum;
S3, sets bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj);
S4, from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax);
S5, step S3 and step S4 are performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector';
S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
2. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: described step S2 includes step in detail below,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0;
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to;
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to;
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file;
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
3. as claimed in claim 2 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: described step S203 file folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
4. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: in described step S3, a bunch start sector number algorithm is:
Element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS/SectorSize。
5. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: in described S3, matching degree rule comprises the following steps,
S301, acquisition bunch is sized to CSjAnd bunch start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2,
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
6. one kind based on the assumption that checking exFAT format recovery device, it is characterised in that: it includes,
Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors;
File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS1,DS2,DS3,…,DSn1},DSkFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC1,DCL2,DC3,…,DCn2, DCpFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI1,FI2,FI3,…,FIn},FIiFor file or folder i information, i=1,2,3 ..., n, n be file and file sum;
Recover parameter acquiring unit, for according to setting bunch size CS={CS1, CS2..., CSm, adopt a bunch start sector number algorithm to obtain each CSjCorresponding bunch start sector number CSS={CSS1j, CSS2j..., CSSaj, wherein, a is a bunch size CSjCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CSj, CSSxj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximumj, CSSmaxj), from (CSj, CSSmaxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximummax, CSSmaxmax), choose (the CS that matching degree is maximumj, CSSmaxj) and (CSmax, CSSmaxmax) be performed both by successfully, then bunch size CS=CSmax, bunch start sector number ClusterStartSector=CSSmaxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector';
Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.
It is 7. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: described file or folder information acquisition unit performs step in detail below,
S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0;
S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to;
S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to;
S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file;
S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.
It is 8. as claimed in claim 7 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: described step S203 file folder data judging rules is:
Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1;
Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41;
When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.
9. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: bunch start sector number algorithm that described recovery parameter acquiring unit performs is:
Element DC in DirStartCluserList listpWith the element DS in DirStartSectorList listkWhat represent is same file folder, then computing formula is:
Bunch start sector number=DSk-DCp*CS/SectorSize。
10. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that:
The matching degree rule that described recovery parameter acquiring unit adopts comprises the following steps,
S301, acquisition bunch is sized to CSjAnd maximum bunch of start sector number CSS of correspondencexj;
S302, sets start sector number list DirStartSectorList'={DS1',DS2',DS3',....,DSn2', and h=1,2,3 ..., n2,
DSh'=(DCp*CSj)/SectorSize+CSSxj;
S303, (CSj, CSSxj) matching degree Match (CSj, CSSxj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201610073181.XA CN105760244B (en) | 2016-02-02 | 2016-02-02 | It is a kind of based on the assumption that the exFAT of verification formats restoration methods and device |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201610073181.XA CN105760244B (en) | 2016-02-02 | 2016-02-02 | It is a kind of based on the assumption that the exFAT of verification formats restoration methods and device |
Publications (2)
Publication Number | Publication Date |
---|---|
CN105760244A true CN105760244A (en) | 2016-07-13 |
CN105760244B CN105760244B (en) | 2018-07-03 |
Family
ID=56329911
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201610073181.XA Active CN105760244B (en) | 2016-02-02 | 2016-02-02 | It is a kind of based on the assumption that the exFAT of verification formats restoration methods and device |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN105760244B (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105760473A (en) * | 2016-02-11 | 2016-07-13 | 陈蔡峰 | Recovery method and device used after exFAT file formatting |
CN112380061A (en) * | 2020-11-17 | 2021-02-19 | 深圳市兴之佳科技有限公司 | Data recovery method and device, computer equipment and readable storage medium |
CN112379839A (en) * | 2020-11-13 | 2021-02-19 | 万兴科技集团股份有限公司 | Data recovery method and device, computer equipment and storage medium |
CN112685235A (en) * | 2021-03-11 | 2021-04-20 | 湖南生物机电职业技术学院 | ExFAT data recovery method and system based on BPB key parameters |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101515276A (en) * | 2008-12-29 | 2009-08-26 | 北京握奇数据系统有限公司 | Method for write operation of file data, and recovery method and recovery system for file data |
US20100017443A1 (en) * | 2008-06-16 | 2010-01-21 | Huawei Technologies Co., Ltd. | Method, terminal, and system for soft-deleting, restoring, and synchronizing data |
CN102254048A (en) * | 2011-08-24 | 2011-11-23 | 深圳市万兴软件有限公司 | Data recovering method and system |
-
2016
- 2016-02-02 CN CN201610073181.XA patent/CN105760244B/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100017443A1 (en) * | 2008-06-16 | 2010-01-21 | Huawei Technologies Co., Ltd. | Method, terminal, and system for soft-deleting, restoring, and synchronizing data |
CN101515276A (en) * | 2008-12-29 | 2009-08-26 | 北京握奇数据系统有限公司 | Method for write operation of file data, and recovery method and recovery system for file data |
CN102254048A (en) * | 2011-08-24 | 2011-11-23 | 深圳市万兴软件有限公司 | Data recovering method and system |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105760473A (en) * | 2016-02-11 | 2016-07-13 | 陈蔡峰 | Recovery method and device used after exFAT file formatting |
CN112379839A (en) * | 2020-11-13 | 2021-02-19 | 万兴科技集团股份有限公司 | Data recovery method and device, computer equipment and storage medium |
CN112379839B (en) * | 2020-11-13 | 2022-12-02 | 万兴科技集团股份有限公司 | Data recovery method and device, computer equipment and storage medium |
CN112380061A (en) * | 2020-11-17 | 2021-02-19 | 深圳市兴之佳科技有限公司 | Data recovery method and device, computer equipment and readable storage medium |
CN112685235A (en) * | 2021-03-11 | 2021-04-20 | 湖南生物机电职业技术学院 | ExFAT data recovery method and system based on BPB key parameters |
CN112685235B (en) * | 2021-03-11 | 2021-05-18 | 湖南生物机电职业技术学院 | ExFAT data recovery method and system based on BPB key parameters |
Also Published As
Publication number | Publication date |
---|---|
CN105760244B (en) | 2018-07-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
KR101456757B1 (en) | Method and Apparatus for recovering deleted data for SQLite database | |
CN105760244A (en) | exFAT formatting recovery method and device based on hypothesis and verification | |
CN102737205B (en) | Protection comprises can the file of editing meta-data | |
US20120136842A1 (en) | Partitioning method of data blocks | |
CN110569147B (en) | Deleted file recovery method based on index, terminal device and storage medium | |
CN107193871B (en) | Database recovering method and device | |
EP3848808A1 (en) | Method and system for recovering deleted file based on fat32 file system | |
CN104484427B (en) | A kind of video file storage device and method | |
CN110309019B (en) | Method for rapidly recovering and extracting deleted files in APFS (advanced persistent file system) | |
CN102937926A (en) | Method and device for recovering deleted sqlite files on mobile terminal | |
CN111651127B (en) | Monitoring data storage method and device based on shingled magnetic recording disk | |
EP3798842A1 (en) | Database deleted record recovery method and system | |
CN102289526B (en) | HFS+file system data recovery method and device | |
KR101593184B1 (en) | Method and apparatus for recovering partition based on file system metadata | |
CN103631589B (en) | Method and device for recognizing application | |
US10459807B2 (en) | Determining modified portions of a RAID storage array | |
CN110297781B (en) | Method for recovering deleted data in APFS (advanced File System) based on copy-on-write | |
CN109344163B (en) | Data verification method and device and computer readable medium | |
TWI699663B (en) | Segmentation method, segmentation system and non-transitory computer-readable medium | |
CN113448946B (en) | Data migration method and device and electronic equipment | |
CN105760473A (en) | Recovery method and device used after exFAT file formatting | |
US8407187B2 (en) | Validating files using a sliding window to access and correlate records in an arbitrarily large dataset | |
KR102400723B1 (en) | Apparatus for recovering metadata of deleted files based on FAT32 and apparatus method thereof | |
CN112380174B (en) | XFS file system analysis method containing deleted files, terminal device and storage medium | |
WO2015199533A1 (en) | System and method for managing change data in database |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |