CN105760244A - exFAT formatting recovery method and device based on hypothesis and verification - Google Patents

Abstract

The invention belongs to the field of computers, and particularly relates to an exFAT formatting recovery method and device based on hypothesis and verification after exFAT partitioning formatting. According to the method, a most possible cluster start sector number and the cluster size are calculated through hypothesis and reverse verification to serve as recovery parameters, and the accuracy of a recovery result is guaranteed to the maximum extent. The method has the advantages that the defects existing in an existing exFAT formatting recovery technique are overcome, the recovery effect is greatly improved, and the method is an important supplement for exFAT obliterated data recovery.

Description

It is a kind of based on the assumption that the exFAT of checking formats restoration methods and device

Technical field

The invention belongs to computer realm, after being specifically related to a kind of exFAT partition format, based on the assumption that the exFAT of checking formats restoration methods and device.

Background technology

ExFAT, as the file system that FAT is extended, is a kind of file system being extremely suitable for use on flash memory, is widely used in above mobile memory medium.ExFAT loses the recovery of data and is always up an emphasis of concern inside information security field.The reason of exFAT loss of data can be largely classified into two kinds, and the first is deleted by mistake or malice is deleted, and the second is formatted or malice formatting by mistake.For the first situation, existing recovery technology is highly developed, it is possible to reach good recovery effects.For the second situation, existing recovery technology adopts some parameters after formatting to be used as the parameter in data recovery procedure, there is the recovery inaccurate situation of data.

The initial sector calculation of file content is as follows:

FileDataStartSector=ClusterStartSector+FileDataStartClus er*CluserSize/SectorSize

Wherein, the initial sector of FileDataStartSector representation file content, ClusterStartSector represents a bunch start sector number, and FileDataStartCluser represents the starting cluster number of file content, and CluserSize represents a bunch size.Additionally, ClusterStartSector and CluserSize can be subject to the impact of partition format, FileDataStartCluser records in file record, and the sector-size that SectorSize is disk is generally 512 bytes

When exFAT file system is formatted, in most cases simply having redistributed the relevant area information of file system and structural information, the file record information before formatting generally also can remain in disk.Therefore, the data before formatting can just be recovered by totally searching for the file record information of residual.

Referenced patent document CN102254048B discloses the method and system that a kind of data are recovered, after exFAT subregion is formatted, the file needing to recover scanned by calculating sector number corresponding to No. 2 bunches to demarcate, then passes through disk read operation and is recovered by file data from exFAT subregion.

Existing exFAT form recovery technology adopts bunch start sector number of subregion after formatting and bunch size to format the parameter recovered as exFAT, but owing to bunch size after formatting and two parameters of bunch start sector number have been likely occurred change, and in recovery process, the location recovering file content is again relied on these parameters, so the parameter after directly adopting formatting carries out recovery and there will be the inaccurate problem of restoration result.Although the attribute informations such as file name/size can be recovered, but the file content recovered is wrong.

Summary of the invention

For the weak point that prior art exists, the present invention proposes and a kind of proposes a kind of based on the assumption that the exFAT of checking formats restoration methods and device.The method by assuming that and reversely checking calculate most possible bunch start sector number and bunch size as recovery parameter, ensure that the accuracy of restoration result to the full extent.Experiments verify that, the recovery effects of the method is than the better effects if of existing recovery software.

The present invention adopts the following technical scheme that

It is a kind of that based on the assumption that the exFAT of checking formats restoration methods, it comprises the following steps,

S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize；

S2, obtains start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum；

S3, sets bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj)；

S4, from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax)；

S5, step S3 and step S4 are performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'；

S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

Further, step S2 includes step in detail below,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0；

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to；

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to；

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file；

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

Further, step S203 file folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

Further, in step S3, a bunch start sector number algorithm is:

Element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS/SectorSize。

Further, in S3, matching degree rule comprises the following steps,

S301, acquisition bunch is sized to CS_jAnd bunch start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2,

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.

It is a kind of that based on the assumption that the exFAT of checking formats recovery device, it includes,

Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors；

File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum；

Recover parameter acquiring unit, for according to setting bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj), from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax), choose (the CS that matching degree is maximum_j, CSS_maxj) and (CS_max, CSS_maxmax) be performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'；

Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

Further, file or folder information acquisition unit performs step in detail below,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0；

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to；

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to；

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file；

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

Further, step S203 file folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

Further, bunch start sector number algorithm recovering parameter acquiring unit execution is:

Element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS/SectorSize。

Further, the matching degree rule recovering parameter acquiring unit employing comprises the following steps,

S301, acquisition bunch is sized to CS_jAnd maximum bunch of start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2,

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.

Existing exFAT formats the file content of recovery technology recovery and often makes mistakes, and tradition is based on the recovery technology of file characteristic, and the file recovered does not have again the information such as file name/size.The present invention is understanding in depth on the basis of exFAT file system structure, it is proposed that a kind of based on the assumption that the exFAT of checking formats restoration methods.The method by assuming that and reversely checking calculate most possible bunch start sector number and bunch size as recovery parameter, ensure that the accuracy of restoration result to the full extent.The method solves existing exFAT and formats the defect that recovery technology exists, and substantially increases recovery effects, is that exFAT loses great the supplementing that data are recovered.

Accompanying drawing explanation

Fig. 1 is based on the assumption that the exFAT of checking formats the flow chart of restoration methods；

Fig. 2 is that file or folder relevant information obtains flow chart；

Fig. 3 is formatting interface；

Fig. 4 is matching degree rule flow chart；

Fig. 5 is with the R-Studio file view loaded before formatting；

Fig. 6 is with the R-Studio schematic diagram loaded before formatting；

Fig. 7 is with the R-Studio file view recovered after formatting；

Fig. 8 is with the R-Studio schematic diagram recovered after formatting；

Fig. 9 is the schematic diagram that formatting uses that the present invention recovers.

Detailed description of the invention

For further illustrating each embodiment, the present invention is provided with accompanying drawing.These accompanying drawings are the part that the invention discloses content, and it is mainly in order to illustrate embodiment, and the associated description of description can be coordinated to explain the operation principles of embodiment.Coordinating with reference to these contents, those of ordinary skill in the art will be understood that other possible embodiments and advantages of the present invention.Assembly in figure is not necessarily to scale, and similar element numbers is conventionally used to indicate similar assembly.

In conjunction with the drawings and specific embodiments, the present invention is further described.

Consulting shown in Fig. 1, for based on the assumption that the exFAT of checking formats the flow chart of restoration methods, the method comprises the following steps:

S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize.

After exFAT file system is formatted, resolve the volume header of subregion after formatting, it is possible to obtain bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize.

S2, obtains start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum.

Wherein, DS_kAnd DC_pIt is integer numerical value.FI_iInclude 4 property values: FileName (file name, a character string), FileTimeInfo (temporal information, including establishment time, modification time, access time, each temporal information is an integer), FileSize (file size, an integer), FileDataStartCluser (starting cluster number of file is an integer).

Consulting shown in Fig. 2, obtain flow chart for file or folder relevant information of the present invention, namely step S2 specifically includes following steps,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0.

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to.

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to file or folder data judging rules, if it is, forward step S204 to, if not, then when, after CurrentSector=CurrentSector+1, forwarding step S202 to.

Wherein, folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file.

File A includes file txt1, file txt2 and file B, then CurrentSector is the start sector number of file A, down resolve from this initial sector always, obtain the information of file txt1, file txt2 and file B, the information of file txt1, file txt2 and file B is deposited in FileInfoList, and the starting cluster DC of the file B of acquisition is deposited in DirStartCluserList.Therefore the length of DirStartSectorList, DirStartCluserList, FileInfoList is different.

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

If front portion is divided into file or folder information in sector 0, or not then CurrentSector=0, ValidSector=0, CurrentSector are equal to ValidSector, then forward step S202 to after CurrentSector=CurrentSector+1 in rear section.If at sector CurrentSector=0, till being resolved to ValidSector=5, then CurrentSector is not equal to ValidSector, CurrentSector=5.

S3, sets bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj)。

Consulting shown in Fig. 3, for formatting interface, during formatting, " allocation units size " (bunch size) is have certain span.Of the present invention CS={512,1024,2048,4096,8192,16384,32768,65536,131072,262144,524288,1048576,2097152,4194304,8388608,16777216,33554432} represent the value that bunch size is possible, have value 17 kinds possible, i.e. m=17.

For each bunch of size, calculate this bunch of bunch start sector number corresponding to size, with CS₁=512 is example, and bunch start sector number algorithm is the element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS₁/SectorSize

Pass through above formula, it is possible to obtain multiple bunches of start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum.

Matching degree rule is adopted to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj).Consult shown in Fig. 4, for matching degree rule flow chart.It comprises the following steps:

S301, acquisition bunch is sized to CS_jAnd bunch start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2, DirStartSectorList' the same with the element number getting DirStartCluserList list in step S2, and DS_h' meet the following conditions:

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.

Match (CS is selected from all of matching degree_j, CSS_xj) maximum (CS_j, CSS_maxj), bunch size CS_jBunch start sector number of corresponding maximum match degree is CSS_maxj, then corresponding computing formula is as follows:

$Match({\mathrm{CS}}_j,{\mathrm{CSS}}_{\max j})=\underset{x}{\overset{a}{\Σ}}\max \left(Match\right({\mathrm{CS}}_j,{\mathrm{CSS}}_{xj}\left)\right).$

S4, from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax).Corresponding computing formula is:

$Match({\mathrm{CS}}_{\max },{\mathrm{CSS}}_{\max \max })=\underset{j}{\overset{17}{\Σ}}\max \left(Match\right({\mathrm{CS}}_j,{\mathrm{CSS}}_{\max j}\left)\right).$

S5, chooses successfully, and namely step S3 and step S4 is performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax；Under extreme case, DirStartCluserList or DirStartSectorList is likely sky, causes choosing failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'.

S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

The invention allows for a kind of based on the assumption that the exFAT of checking formats recovery device, it includes,

Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors；

File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum；

Recover parameter acquiring unit, for according to setting bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj), from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax), choose (the CS that matching degree is maximum_j, CSS_maxj) and (CS_max, CSS_maxmax) be performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'；

Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

Wherein, file or folder information acquisition unit includes step in detail below,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0.

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to.

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to.

Folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file.

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

It should be noted that a bunch start sector number algorithm is in recovery parameter acquiring unit:

Element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS/SectorSize。

Additionally, matching degree rule comprises the following steps in recovery parameter acquiring unit,

S301, acquisition bunch is sized to CS_jAnd maximum bunch of start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2,

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.

In order to verify the present invention, do following experiment.Experimentation is:

1), create an exFAT form subregion, be admitted to the files such as some document pictures inside；

2), this zoned format is melted into FAT32 subregion, is respectively adopted R-Studio and the present invention carries out recovering contrast.

Consult shown in Fig. 5 and Fig. 6, for formatting the front R-Studio file view loaded and schematic diagram, it can be seen that the picture file in an exFAT subregion can normally preview before formatting.Consult shown in Fig. 7 and Fig. 8, for after formatting with the R-Studio file view recovered and schematic diagram, although but adopt after formatting R-Studio recovered when recovering the information file such as file name, size cannot preview, file content recovers to make mistakes.

Consult shown in Fig. 9, use the schematic diagram of present invention recovery for formatting.Adopting the present invention to recover not only to have recovered accurately the information such as file name, size to the subregion after formatting, file content can also normally preview.After the analysis of causes: exFAT is formatted, bunch size and a bunch start sector number there occurs change, and existing recovery technology cannot process this situation.

Although specifically showing in conjunction with preferred embodiment and describing the present invention; but those skilled in the art should be understood that; in the spirit and scope without departing from appended claims invention defined; the present invention can be made a variety of changes in the form and details, be protection scope of the present invention.

Claims (10)

1. one kind based on the assumption that checking exFAT format restoration methods, it is characterised in that: it comprises the following steps,

S1, by searching for the subregion after formatting, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize；

S2, obtains start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum；

S3, sets bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj)；

S4, from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax)；

S5, step S3 and step S4 are performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'；

S6, using ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

2. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: described step S2 includes step in detail below,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0；

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to；

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to；

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file；

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

3. as claimed in claim 2 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: described step S203 file folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

4. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: in described step S3, a bunch start sector number algorithm is:

Element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS/SectorSize。

5. as claimed in claim 1 based on the assumption that the exFAT of checking formats restoration methods, it is characterised in that: in described S3, matching degree rule comprises the following steps,

S301, acquisition bunch is sized to CS_jAnd bunch start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2,

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.

6. one kind based on the assumption that checking exFAT format recovery device, it is characterised in that: it includes,

Resolution unit, is used for resolving formatting subregion volume header, obtains bunch start sector number ClusterStartSector', bunch size CluserSize', sector-size SectorSize and total sector number TotalSectors；

File or folder information acquisition unit, is used for obtaining start sector number list DirStartSectorList={DS₁,DS₂,DS₃,…,DS_n1},DS_kFor the start sector number of file k, k=1,2,3 ..., n1, n1 be file initial sector sum, starting cluster list DirStartCluserList={DC₁,DCL₂,DC₃,…,DC_n2, DC_pFor the starting cluster number of file p, p=1,2,3 ..., n2, n2 be file starting cluster sum, information list FileInfoList={FI₁,FI₂,FI₃,…,FI_n},FI_iFor file or folder i information, i=1,2,3 ..., n, n be file and file sum；

Recover parameter acquiring unit, for according to setting bunch size CS={CS₁, CS₂..., CS_m, adopt a bunch start sector number algorithm to obtain each CS_jCorresponding bunch start sector number CSS={CSS_1j, CSS_2j..., CSS_aj, wherein, a is a bunch size CS_jCorresponding bunch start sector number sum, adopts matching degree rule to obtain (CS_j, CSS_xj) corresponding matching degree, wherein, x=1,2,3 ..., a, choose (the CS that matching degree is maximum_j, CSS_maxj), from (CS_j, CSS_maxj) in, j=1,2,3 ..., m, choose (the CS that matching degree is maximum_max, CSS_maxmax), choose (the CS that matching degree is maximum_j, CSS_maxj) and (CS_max, CSS_maxmax) be performed both by successfully, then bunch size CS=CS_max, bunch start sector number ClusterStartSector=CSS_maxmax, choose failure, then bunch size CS=CS', bunch start sector number ClusterStartSector=ClusterStartSector'；

Recover file unit, be used for ClusterStartSector and CluserSize as recovering parameter and recovering file in conjunction with FileInfoList.

It is 7. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: described file or folder information acquisition unit performs step in detail below,

S201, after resolving formatting, subregion rolls up header, obtains total sector number TotalSectors of subregion, initializes current sector number CurrentSector=0；

S202, it is judged that CurrentSector TotalSectors, if it is, terminate, if it is not, then forward step S203 to；

S203, reads the data of CurrentSector sector, and judges that whether this sector is the sector of file according to folder data judging rules, if, then forward step S204 to, if it is not, then forward step S202 after CurrentSector=CurrentSector+1 to；

S204, CurrentSector is stored in DirStartSectorList, start down to resolve corresponding file or folder information until running into the directory entry not meeting architectural feature and just stopping according to the structure of exFAT file directory item from CurrentSector always, the sector number of this sector is ValidSector, the file/folder information being resolved to is deposited in FileInfoList, simultaneously if corresponding starting cluster DC is deposited in DirStartCluserList by file；

S205, it is judged that whether CurrentSector is equal to ValidSector, if it is, forward step S202 after CurrentSector=CurrentSector+1 to, if it is not, then forward step S202 after CurrentSector=ValidSector to.

It is 8. as claimed in claim 7 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: described step S203 file folder data judging rules is:

Condition one: the 1st byte of sector is 0x85 and the 16th byte is 0xC0 and the 32nd byte is 0xC1；

Condition two: the 1st byte of sector is 0x05 and the 16th byte is 0x40 and the 32nd byte is 0x41；

When the data of this sector meet any one in two above condition, then this sector is the sector of file, is not otherwise the sector of file.

9. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that: bunch start sector number algorithm that described recovery parameter acquiring unit performs is:

Element DC in DirStartCluserList list_pWith the element DS in DirStartSectorList list_kWhat represent is same file folder, then computing formula is:

Bunch start sector number=DS_k-DC_p*CS/SectorSize。

10. as claimed in claim 6 based on the assumption that the exFAT of checking formats recovery device, it is characterised in that:

The matching degree rule that described recovery parameter acquiring unit adopts comprises the following steps,

S301, acquisition bunch is sized to CS_jAnd maximum bunch of start sector number CSS of correspondence_xj；

S302, sets start sector number list DirStartSectorList'={DS₁',DS₂',DS₃',....,DS_n2', and h=1,2,3 ..., n2,

DS_h'=(DC_p*CS_j)/SectorSize+CSS_xj；

S303, (CS_j, CSS_xj) matching degree Match (CS_j, CSS_xj) equal to the number of identical element in two lists of DirStartSectorList' and DirStartSectorList.