CN109582501A

CN109582501A - File access pattern method, apparatus, computer equipment and storage medium

Info

Publication number: CN109582501A
Application number: CN201811434334.4A
Authority: CN
Inventors: 王志雄; 彭重阳
Original assignee: Wanxing Polytron Technologies Inc
Current assignee: Wanxing Polytron Technologies Inc
Priority date: 2018-11-28
Filing date: 2018-11-28
Publication date: 2019-04-05
Anticipated expiration: 2038-11-28
Also published as: CN109582501B

Abstract

The invention discloses a kind of file access pattern method, apparatus, computer equipment and storage medium, in the storage organization for solving current FAT32 system, the problem not high to deleted document progress file access pattern operation accuracy, success rate.The present invention is the Rule of judgment for storing feature based on file to be arranged in file access pattern operation, the memory space specifically occupied using different size of file is different and then the quantity of clusters that occupies also this different feature, to calculate the length of deleted document, only when the length for actually giving file for change meets the length of deleted document, the deleted document actually giving file for change and restoring for needs is just determined.The invention avoids using filename, file type feature as the uncertainty of file access pattern Rule of judgment and unstability, keep the success rate of file access pattern operation, precision higher in the past.

Description

File access pattern method, apparatus, computer equipment and storage medium

Technical field

The present invention relates to field of computer technology more particularly to a kind of file access pattern method, apparatus, computer equipment and Storage medium.

Background technique

In the storage organization based on FAT32 system, deleted file can be lost in its corresponding file record item A part of address information be again turned on deleted file can not by user, however the physical message of deleted document is still It can be retained among the sector of storage medium.At present to the restoration methods of deleted document, mainly using not deleting file Remaining address information keeps it complete in file record item of the address information to fill up deleted document, according to after filling up Address information searches for the sector, according to spies such as file type, filenames in the file record item of the deleted document Sign is sequentially retrieved in a sector and that extracts the features described above for meeting deleted document gives file for change.This method has been deleted multiple Except meeting confusion reigned in the identical situation of file type or filename of file, in the situation that file type or filename be not complete Lower success rate is also low.

Summary of the invention

The present invention provides a kind of file access pattern method, apparatus, computer equipment and storage medium, it is intended to solve existing skill In art, the not high problem of accuracy rate, the success rate of the file access pattern method based on FAT32 system.

To solve above-mentioned technical problem, in a first aspect, the embodiment of the present invention provides a kind of file access pattern method comprising Following steps:

File record item is obtained from file directory table, is judged in the file record item with the presence or absence of deleted marker；

If there are deleted markers in the file record item, document base information is obtained from the file record item, institute State the file size and the low cluster number of starting that document base information includes deleted document；

The hypothesis starting cluster of the deleted document is constructed according to the low cluster number of the starting and the preset high cluster number of starting Number；

Judge whether the hypothesis starting cluster number exceeds disk management maximum cluster number range；

If hypothesis starting cluster number is without departing from disk management maximum cluster number range, according to the file size and described It is assumed that starting cluster number determines that the hypothesis of the deleted document terminates cluster number；

Judging the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition；

If the hypothesis, which terminates ending cluster corresponding to cluster number, meets preset condition, determine that the hypothesis originates cluster number to institute It states and assumes that end cluster number file corresponding on disk is the deleted document；And

If the hypothesis, which terminates ending cluster corresponding to cluster number, is unsatisfactory for preset condition, institute is reconfigured according to preset rules The hypothesis starting cluster number of deleted document is stated, and returns and described judge that the hypothesis originates whether cluster number exceeds disk management most The step of big cluster number range.

Second aspect, the embodiment of the present invention provide a kind of file restoring device comprising:

Search unit judges whether deposit in the file record item for obtaining file record item from file directory table In deleted marker；

Initial cell, if obtaining text from the file record item for there are deleted markers in the file record item Part essential information, the document base information include the file size and the low cluster number of starting of deleted document；

Structural unit described has deleted text for constructing according to the low cluster number of the starting and the preset high cluster number of starting The hypothesis of part originates cluster number；

Range judging unit, for judging whether the hypothesis starting cluster number exceeds disk management maximum cluster number range；

Computing unit, if for hypothesis starting cluster number without departing from disk management maximum cluster number range, according to the text Part size and hypothesis starting cluster number determine that the hypothesis of the deleted document terminates cluster number；

Cluster number judging unit, for judging that the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition；

End unit determines the hypothesis if terminating ending cluster corresponding to cluster number for the hypothesis meets preset condition It originates cluster number and assumes that terminating cluster number file corresponding on disk is the deleted document to described；And

Return unit, if terminating ending cluster corresponding to cluster number for the hypothesis is unsatisfactory for preset condition, according to default rule The hypothesis starting cluster number of the deleted document is then reconfigured, and returns and described judge that the hypothesis originates whether cluster number surpasses The step of disk management maximum cluster number range out.

The third aspect, the embodiment of the present invention provide a kind of computer equipment again comprising memory, processor and deposit The computer program that can be run on the memory and on the processor is stored up, the processor executes the computer File access pattern method described in above-mentioned first aspect is realized when program.

Fourth aspect, the embodiment of the invention also provides a kind of computer readable storage mediums, wherein the computer can It reads storage medium and is stored with computer program, the computer program when being executed by a processor executes the processor State file access pattern method described in first aspect.

The embodiment of the invention provides a kind of file access pattern method, apparatus, computer equipment and storage mediums, according to text This inherent feature of part size and the starting cluster number presupposed terminate cluster number to obtain the hypothesis of file, and then described in judging It is assumed that terminating whether the corresponding ending cluster of cluster number meets preset condition, for example whether the file knot with the deleted document Shu Tezheng or specific structure, and then obtain and give file for change.The embodiment of the present invention is avoided according to filename, file type feature It searches for and is not known with caused in the case where the filename is identical with file type or lacks when giving deleted document for change Property and low success rate, make that the file access pattern operation accuracy rate based on FAT32 system is higher, has higher success rate.

Detailed description of the invention

Technical solution in order to illustrate the embodiments of the present invention more clearly, below will be to required use in embodiment description Attached drawing be briefly described, it should be apparent that, drawings in the following description are some embodiments of the invention, for ability For the those of ordinary skill of domain, without creative efforts, it can also be obtained according to these attached drawings other attached Figure.

Fig. 1 is the flow diagram of file access pattern method provided in an embodiment of the present invention；

Fig. 2 is the sub-process schematic diagram of file access pattern method provided in an embodiment of the present invention；

Fig. 3 is another sub-process schematic diagram of file access pattern method provided in an embodiment of the present invention；

Fig. 4 is another sub-process schematic diagram of file access pattern method provided in an embodiment of the present invention；

Fig. 5 is another sub-process schematic diagram of file access pattern method provided in an embodiment of the present invention；

Fig. 6 is the schematic block diagram of file restoring device provided in an embodiment of the present invention；

Fig. 7 is the subelement schematic block diagram of file restoring device provided in an embodiment of the present invention；

Fig. 8 is another subelement schematic block diagram of file restoring device provided in an embodiment of the present invention；

Fig. 9 is another subelement schematic block diagram of file restoring device provided in an embodiment of the present invention；

Figure 10 is another subelement schematic block diagram of file restoring device provided in an embodiment of the present invention；

Figure 11 is the schematic block diagram of computer equipment provided in an embodiment of the present invention.

Specific embodiment

Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair Embodiment in bright, every other reality obtained by those of ordinary skill in the art without making creative efforts Example is applied, shall fall within the protection scope of the present invention.

It should be appreciated that ought use in this specification and in the appended claims, term " includes " and "comprising" instruction Described feature, entirety, step, operation, the presence of element and/or component, but be not precluded one or more of the other feature, Entirety, step, operation, the presence or addition of element, component and/or its set.

It is also understood that the term used in this description of the invention is merely for the sake of description specific embodiment Purpose and be not intended to limit the present invention.As description of the invention and it is used in the attached claims, unless Context clearly indicates other situations, and otherwise " one " of singular, "one" and "the" are intended to include plural form.

It will be further appreciated that the term "and/or" used in description of the invention and the appended claims is Refer to any combination and all possible combinations of one or more of associated item listed, and including these combinations.

As shown in Figure 1, file access pattern method provided in an embodiment of the present invention includes step S110~S180.

S110, file record item is obtained from file directory table, judge in the file record item with the presence or absence of deletion mark Will.

File record item is obtained from file directory table, is judged in the file record item with the presence or absence of deleted marker.When After file in FAT32 system is deleted, the content of the file record item of the deleted document can be by according to FAT32 system Ad hoc rules modification, make to exist in the file record item of the deleted document and meet the ad hoc rules of the FAT32 system Deleted marker.It, can be with when retrieving among some file record item there are when the deleted marker in file directory table Determine that the file record item is the file record item of some deleted document, among in the file record item The content that do not modified by the ad hoc rules according to the FAT32 system can carry out the deleted document as initial foundation File access pattern.

File directory table is one of the core content in FAT32 system, is mainly used for record storage in FAT32 system Document base information.The file directory table includes several file record items corresponding with storage file, the file note Record item records the document base information of each storage file, and the document base information includes file in physics magnetic Initial address message (IAM) on disk, the initial address message (IAM) specially originates high cluster number (high-order cluster number) and the low cluster number of starting is (low Position cluster number).When the storage file is deleted, the high cluster number of starting in the initial address message (IAM) is cleared, and makes described deposit Storage file can not be searched because the initial address message (IAM) has been lacked, and then become deleted document.

In one embodiment, as shown in Fig. 2, step S110 includes sub-step S111 and S112.

Whether S111, the initial character for judging the file record record item are preset characters.

Whether the initial character for judging the file record item is preset characters.In the present embodiment, the preset characters tool Body is " E5 ", when becoming deleted document after file is deleted, according to the FAT32 system ad hoc rules will it is described The first character change for deleting the filename character string among the corresponding file record item of file is " E5 ".The file name Symbol string is the character string for being located at the head end of the file record item in the content of the file record item, and then described has been deleted The first character of the content of the corresponding file record item of file is also " E5 ", that is, the deleted marker is made to include being located at " E5 " of the first character of file record item.

If the initial character of S112, the file record item is preset characters, determines to exist in the file record item and delete Mark.

If the initial character of the file record item is preset characters, determine that there are deleted markers in the file record item. The first character of the content of the file record item is judged, if the first character of the file record item is described pre- If character " E5 ", it may be determined that this document entry has deleted marker, then determines that the file record item belongs to and deleted text Part.

If there are deleted markers in S120, the file record item, file is obtained from the file record item and is believed substantially Breath, the document base information include the file size and the low cluster number of starting of deleted document.

If there are deleted markers in the file record item, document base information is obtained from the file record item, institute State the file size and the low cluster number of starting that document base information includes deleted document.It is deleted when existing in the file record item When except mark, the corresponding file of the file record item is deleted document.In order to restore to the deleted document, Foundation of the document base information in the file record item as file access pattern is extracted, the document base information includes: text Part size, for calculating the length of the deleted document；Low cluster number is originated, for constructing the starting of the deleted document Address.In certain embodiments, can also from the document base information extraction document name, for judging described deleted The file characteristic of file.

Specifically, the form of expression of the document base information in the file record item is binary data conversion And the character string come, the document base information includes 16 characters in total, wherein each character is made of two bytes, is made The single file record item is made of 32 bytes.The file size corresponds to 4, the end word of the file record item Section；The starting low cluster number correspond to 2 characters that deviation number in the file record item is 0x1A or 0x1B；The filename 11 bytes of first head of the corresponding file record item, including 3 bytes after corresponding to the root name of preceding 8 bytes and corresponding to Extension name.

S130, the hypothesis that the deleted document is constructed according to the low cluster number of the starting and the preset high cluster number of starting Originate cluster number.

The hypothesis starting cluster of the deleted document is constructed according to the low cluster number of the starting and the preset high cluster number of starting Number.It sets the initial address of affiliated deleted document to assume starting cluster number, and then according to hypothesis starting cluster number to institute Deleted document is stated to be given for change.Among FAT32 system, deviation number is corresponded in the file record item of deleted document The high cluster number of starting for 2 characters of 0x14 or 0x15 can be cleared, in this example, it is assumed that the deleted document The high cluster number of original starting is all 0, and set content is all the 0 preset high cluster number of starting, the preset high cluster of starting Number for construct the deleted document hypothesis starting cluster number.Specifically, it constructs one and possesses the described of 4 character lengths It is assumed that starting cluster number, the content of preceding 2 characters is the preset high cluster number of starting, and the content of rear 2 characters is that sequence is fallen The low cluster number of the starting set.It can find in file allocation table according to hypothesis starting cluster number and deleted described in recording The particular content of file, it is specifically, described to assume that starting cluster number is the number of the file directory item in the file allocation table.

S140, judge whether the hypothesis starting cluster number exceeds disk management maximum cluster number range.

Judge whether the hypothesis starting cluster number exceeds disk management maximum cluster number range.In the FAT32 system, The quantity for the cluster that the disk of different capabilities is managed is different, if the quantity for the cluster that the disk is managed is more, with the cluster one One corresponding cluster number is also more, and the maximum cluster number range is also bigger.When hypothesis starting cluster number exceeds the disk management When maximum cluster number range, then cluster pointed by the hypothesis starting cluster number is not present among the disk, and then can not be restored The deleted document.In an embodiment of the present invention, if hypothesis starting cluster number exceeds disk management maximum cluster number model It encloses, i.e., cluster corresponding to the described hypothesis starting cluster number is not present among the disk, can also institute according to embodiments of the present invention The preset rules of description reconfigure the hypothesis starting cluster number of the deleted document, then judge the hypothesis reconfigured Whether starting cluster number exceeds disk management maximum cluster number range.

If S150, hypothesis starting cluster number without departing from disk management maximum cluster number range, according to the file size and The hypothesis starting cluster number determines that the hypothesis of the deleted document terminates cluster number.

If hypothesis starting cluster number is without departing from disk management maximum cluster number range, according to the file size and described It is assumed that starting cluster number determines that the hypothesis of the deleted document terminates cluster number.Among FAT32 system, All Files are stored Among several clusters, the amount of capacity of several clusters is identical, thus when file it is of different sizes when, it is described different big The quantity for the cluster that small file occupies is also different.The unit-sized of the cluster is pre-arranged, and capacity is 2 (thousand ratios It is special) multiple.By obtaining pre-set disk parameter, the unit-sized of cluster among the disk can be obtained.According to institute State the unit-sized of file size, the cluster, the quantity of the available occupied cluster of deleted document, by the vacation Surely quantity of the starting cluster number in conjunction with the occupied cluster of the deleted document, the hypothesis knot of the available deleted document Fascicle number.

Specifically, among FAT32 system, cluster number be documented in file allocation table (File Allocation Table) it In, the file allocation table is made of several file directory items, each corresponding cluster number of the file directory item, Content among the file directory item to be stored with its one-to-one described cluster number as cluster pointed by address in Hold.It is described to assume that starting cluster number assumes to terminate the content among the file directory item corresponding to cluster number, as institute to described State the hypothesis content of deleted document.

In one embodiment, as shown in figure 3, step S150 includes sub-step S151 and S152.

S151, across the cluster amount that the deleted document is calculated according to the unit-sized of the file size and cluster.

Across the cluster amount of the deleted document is calculated according to the unit-sized of the file size and cluster.By described in The file size of file is deleted divided by the unit-sized of the cluster, if the remainder of calculated result is not 0, in the calculated result Units on plus 1, using the units add the integer part of 1 calculated result as the deleted document across Cluster amount, across the cluster amount are that the deleted document obtained according to the file size of the deleted document occupies cluster Quantity.Each corresponding cluster is used to store the particular content of the deleted document among across the cluster amount.

S152, assume that originating cluster number and across the cluster amount determines the hypothesis ending cluster of the deleted document according to described Number.

Cluster number is originated according to the hypothesis and across the cluster amount determines that the hypothesis of the deleted document terminates cluster number.It will The hypothesis starting cluster number adds across the cluster amount and subtracts the hypothesis knot that 1 cluster number obtained is the deleted document Fascicle number.Described to assume to terminate the ending cluster that cluster number is directed toward the deleted document, the hypothesis terminates text corresponding to cluster number Part directory entry is used to record the particular content of the ending cluster.

S160, judge that the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition.

Judging the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition.The ending cluster is the vacation Surely terminate cluster pointed by cluster number, the content of the ending cluster, which is recorded in the hypothesis, terminates file directory corresponding to cluster number The form of Xiang Zhong, the content of the file directory item are character string, by the spy for judging the character string in the file directory item Sign, can determine whether the ending cluster meets preset condition.The preset condition is, if it is true that the hypothesis, which terminates cluster number, End cluster number, then the hypothesis terminates the presence of content relevant to the end of file in ending cluster corresponding to cluster number, it is described with it is literary It includes end of file feature and end-of-file character that part, which terminates relevant content,.

In one embodiment, as shown in figure 4, step S160 includes sub-step S161, S162, S163 and S164.

S161, judge whether the deleted document has starting according to the filename or hypothesis starting cluster number Feature.

Judge whether the deleted document has initiation feature according to the filename or hypothesis starting cluster number. The initiation feature includes the extension name among the filename, if the extension name, nothing are not present among the filename Method judges the file type of the deleted document by the filename.The initiation feature further includes in disk management Starting cluster number similar with hypothesis starting cluster number, for example, having the same in the structure of the similar starting cluster number Begin low cluster number.If institute can not be passed through there is no starting cluster number similar with hypothesis starting cluster number in the disk management State the file type for assuming that starting cluster number judges the deleted document.Specifically, in FAT32 system, the filename packet The extension name of the deleted document is included, the extension name of the deleted document shows as character string, the character of the extension name Rear 3 bit byte before the string specially occupied file record item of filename character string among 11 bytes.? In FAT32 system, the file of same type may be stored in cluster similar in physical location, and then make the same type File there is similar starting cluster number, therefore can not delete the starting cluster number of file by comparing and judge to have deleted text The file type of part can originate low cluster number by comparison to judge the deleted document in an embodiment of the present invention Type.

If S162, the deleted document have initiation feature, file type, and root are determined according to the initiation feature Judge whether the deleted document has end feature according to identified file type.

If the deleted document has initiation feature, file type is determined according to the initiation feature, and according to really Fixed file type judges whether the deleted document has end feature.Specifically, if the deleted document there are institutes Extension name is stated, determines that the deleted document has initiation feature, it is true according to content represented by the character string of the extension name The file type of the fixed deleted document.If having the hypothesis with the deleted document in the disk management to originate The similar starting cluster number of cluster number determines that the deleted document has initiation feature, according to similar to hypothesis starting cluster number Starting cluster number corresponding to the file type recorded in file record item, determine the file type of the deleted document.According to It can determine whether the deleted document has end feature according to the file type of the deleted document.

If S163, the deleted document, which have, terminates feature, judge that the hypothesis terminates in ending cluster corresponding to cluster number It whether include the end feature.

If the deleted document, which has, terminates feature, judge in ending cluster corresponding to hypothesis end cluster number whether Include the end feature.The end feature is to be present in hypothesis to terminate among the corresponding file directory item of cluster number as knot The character string of bundle flag, for example, the character string as end mark is " 55AA ".If the deleted document is described File type is with the file type for terminating feature, and the hypothesis for searching the deleted document terminates corresponding to cluster number File directory item in content with the presence or absence of character string as the end mark.If the hypothesis terminates cluster number, institute is right There is the character string as end mark in the file directory item answered, determines that the hypothesis terminates ending cluster pointed by cluster number In comprising terminate feature.

If S164, the hypothesis terminate in ending cluster corresponding to cluster number to include the end feature, the ending cluster is determined Meet preset condition.

If the hypothesis terminates to include the end feature in ending cluster corresponding to cluster number, determine that the ending cluster meets Preset condition.The preset condition includes that the hypothesis, which terminates file directory item corresponding to cluster number, has the reflection end The termination character of feature determines that the ending cluster is the last one cluster for storing the particular content of the deleted document.

In one embodiment, as shown in figure 4, step S160 further includes sub-step S165, S166 and S167.

If S165, the deleted document, which do not have initiation feature or do not have, terminates feature, judge that the hypothesis terminates The whether all skies of ending cluster corresponding to cluster number.

If the deleted document, which does not have initiation feature or do not have, terminates feature, judge that the hypothesis terminates cluster number The whether all skies of corresponding ending cluster.If judging by above-mentioned steps, determine that the deleted document does not have the starting Feature and the end feature check the content for terminating file directory item corresponding to cluster number with the hypothesis, if the file Whole character strings is all zero among directory entry, determines that the hypothesis terminates all skies of ending cluster corresponding to cluster number.

If the not all skies of S166, the ending cluster, judge the termination character of deleted document described in the ending cluster The whether all skies of content later.

If the not all skies of the ending cluster, after the termination character for judging deleted document described in the ending cluster The whether all skies of content.If the hypothesis starting of the deleted document assumes to terminate the file directory corresponding to cluster number Uncomplete content be zero, the termination character in the content of the file directory item is obtained, for example, the termination character can be with Be " 55AA " or other be not 0 character.Judge to whether there is content after termination character described in the file directory item It is all zero character string, if determining the ending cluster there are the character string of content all zero after the end-of-file character Described in deleted document the termination character after all skies of content.

If all skies of content after the termination character in S167, the ending cluster, determine that the ending cluster is full Sufficient preset condition.

If all skies of content after the termination character in the ending cluster, it is pre- to determine that the ending cluster meets If condition.The preset condition includes that the hypothesis terminates have termination character, institute in file directory item corresponding to cluster number Stating termination character, there are all zero character strings later, then it is not all to terminate ending cluster pointed by cluster number for the hypothesis The all skies of content after termination character in the empty and described ending cluster determine that the ending cluster is that storage is described and has deleted The last one cluster of the particular content of file.

If S170, the hypothesis terminate ending cluster corresponding to cluster number and meet preset condition, the hypothesis starting cluster number is determined Assume that terminating cluster number file corresponding on disk is the deleted document to described.

If the hypothesis, which terminates ending cluster corresponding to cluster number, meets preset condition, determine that the hypothesis originates cluster number to institute It states and assumes that end cluster number file corresponding on disk is the deleted document.The hypothesis is originated into cluster number to described It is assumed that terminating content shown by the character string among file directory item corresponding to cluster number as in the deleted document Hold, further, by the contents extraction of the deleted document and generates the deleted document.

If S180, the hypothesis terminate ending cluster corresponding to cluster number and are unsatisfactory for preset condition, according to preset rules again structure The hypothesis starting cluster number of the deleted document is made, and returns and described judge that the hypothesis originates whether cluster number exceeds disk pipe The step of managing maximum cluster number range.

If the hypothesis, which terminates ending cluster corresponding to cluster number, is unsatisfactory for preset condition, institute is reconfigured according to preset rules The hypothesis starting cluster number of deleted document is stated, and returns and described judge that the hypothesis originates whether cluster number exceeds disk management most The step of big cluster number range.Specifically, the hypothesis is reconfigured according to the preset rules and originate cluster number, can obtain new It is assumed that starting cluster number continues if the new hypothesis starting cluster number is unsatisfactory for the preset condition according to the preset rules The new hypothesis starting cluster number is reconfigured.By to the hypothesis starting cluster that can not restore the deleted document It number constructs repeatedly, can gradually obtain the true starting cluster number of the deleted document, and then according to the true starting cluster number pair The deleted document carries out file recovery step.

In one embodiment, as shown in figure 5, step S180 includes sub-step S181, S182 and S183.

S181, it carries out the high cluster number of starting described in hypothesis starting cluster number to add a processing.

The hypothesis is originated the high cluster number of starting described in cluster number to carry out adding a processing.Specifically, in first time process It is assumed that starting cluster number is made of the high cluster number of preset starting and the low cluster number of the starting, obtains and assume described in this process The high cluster number of starting in beginning cluster number adds 1 to the character medium size yardage of the high cluster number of starting, makes by the character medium size Add the 1 high cluster number of the starting different from the high cluster number of the starting in this process on code and in the character on number Advance one.

S182, described plus treated a high cluster number of starting and the low cluster number of the starting are constructed and generate one New hypothesis originates cluster number.

Described plus treated a high cluster number of starting and the low cluster number of the starting are constructed and generate a new vacation Surely cluster number is originated.Specifically, the high cluster number of starting by described in character on number plus after 1 and the low cluster number of the starting construct And generate a new hypothesis and originate cluster number, the hypothesis starting cluster number in new the hypothesis starting cluster number and this process exists The part of low cluster number is identical, and the number of the high cluster number part of the new hypothesis starting cluster number rises than the hypothesis in this process The number of the high cluster number part of beginning cluster number is big by one.

S183, the new hypothesis starting cluster number is originated into cluster number as the hypothesis.

The new hypothesis starting cluster number is originated into cluster number as the hypothesis.The new hypothesis originates cluster number and this Hypothesis starting cluster number in secondary process is different, and then terminates according to the hypothesis that the new hypothesis starting cluster number obtains Cluster number is different, according to all judgement results of the new hypothesis starting cluster number acquisition and according to the original institute Stating the judgement result for assuming that starting cluster number obtains may also be different.Hypothesis starting cluster number in this process is deleted, Determine that new hypothesis starting cluster number is to assume starting cluster number and for next process.

As shown in fig. 6, the file access pattern method more than corresponding to, the present invention also provides a kind of file restoring device 100, It includes that search unit 110, initial cell 120, structural unit 130, range judging unit 140, computing unit 150, cluster number are sentenced Disconnected unit 160, end unit 170 and return unit 180.

Described search unit 110 judges the file record item for obtaining file record item from file directory table In whether there is deleted marker.

In one embodiment, as shown in fig. 7, described search unit 110 includes following subelement: 111 He of initial character unit Initial character judging unit 112.

The initial character unit 111, for judging whether the initial character of the file record item is preset characters.

The preset characters are specially " E5 ", when becoming deleted document after file is deleted, according to the FAT32 The ad hoc rules of system repairs the first character of the filename character string among the corresponding file record item of the deleted document It is changed to " E5 ".The filename character string is the head end for being located at the file record item in the content of the file record item Character string, and then the first character of the content of the corresponding file record item of the deleted document is also " E5 ", is made described Deleted marker includes " E5 " positioned at the first character of file record item.

The initial character judging unit 112 determines institute if the initial character for the file record item is preset characters State in file record item that there are deleted markers.

To judging for the first character of the content of the file record item, if the first word of the file record item Symbol is the preset characters " E5 ", then determines that the file record item belongs to deleted document, further, belong to it is described The file record item for deleting file has deleted marker.

The initial cell 120, if for there are deleted markers in the file record item, from the file record item Middle acquisition document base information, wherein the document base information includes the file size and the low cluster of starting of deleted document Number.

When there are when deleted marker, the corresponding file of the file record item is to have deleted text in the file record item Part.In order to restore to the deleted document, the document base information extracted in the file record item is extensive as file Multiple foundation, wherein file size is used to calculate the length of the deleted document；Originate low cluster number for construct it is described Delete the initial address of file.

The structural unit 130, for according to the low cluster number of the starting and the preset high cluster number of starting construct it is described The hypothesis for deleting file originates cluster number.

It sets the initial address of affiliated deleted document to assume starting cluster number, and then according to the hypothesis starting cluster Number the deleted document is given for change.In this example, it is assumed that the high cluster number of original starting of the deleted document It is all 0, set content is all the 0 preset high cluster number of starting, to construct the hypothesis starting cluster of the deleted document Number.According to the particular content for assuming starting cluster number and can finding the deleted document recorded in file allocation table.

The range judging unit 140, for judging whether the hypothesis starting cluster number exceeds disk management maximum cluster number Range.

When hypothesis starting cluster number exceeds the disk management maximum cluster number range, then the hypothesis originates cluster number Pointed cluster is not present among the disk, and then can not restore the deleted document.In one embodiment of the invention In, it, can also be described according to embodiments of the present invention if hypothesis starting cluster number exceeds disk management maximum cluster number range Preset rules reconfigure the hypothesis starting cluster number of the deleted document, then judge the hypothesis starting cluster reconfigured Number whether exceed disk management maximum cluster number range.

The computing unit 150, if for hypothesis starting cluster number without departing from disk management maximum cluster number range, root Determine that the hypothesis of the deleted document terminates cluster number according to the file size and hypothesis starting cluster number.

According to the file size, the unit-sized of the cluster, the available occupied cluster of deleted document Quantity, by it is described assume starting cluster number in conjunction with the quantity of the occupied cluster of the deleted document, it is available described to have deleted The hypothesis of file terminates cluster number.

In one embodiment, as shown in figure 8, the computing unit 150 includes following subelement: across cluster 151 He of amount unit Terminate cluster number unit 152.

Across the cluster amount unit 151, for calculating described deleted according to the unit-sized of the file size and cluster Across the cluster amount of file.

By the file size of the deleted document divided by the unit-sized of the cluster, if the remainder of calculated result is not 0,1 is added on the units of the calculated result, adds the integer part of 1 calculated result as institute the units State across the cluster amount of deleted document, across the cluster amount be according to the deleted document file size obtain described in Delete the quantity that file occupies cluster.

The end cluster number unit 152, for determining described deleted according to hypothesis starting cluster number and across the cluster amount Except the hypothesis of file terminates cluster number.

It is described to have deleted text that hypothesis starting cluster number, which is added across the cluster amount, and subtracts 1 cluster number obtained The hypothesis of part terminates cluster number.

The cluster number judging unit 160, for judging it is default whether ending cluster corresponding to the hypothesis end cluster number meets Condition.

By judging the feature of the character string in the file directory item, it is default to can determine whether the ending cluster meets Condition.

In one embodiment, as shown in figure 9, the cluster number judging unit 160 includes following subelement: initiation feature is sentenced Disconnected unit 161 terminates feature judging unit 162, ending cluster content judging unit 163 and the first judging unit 164.

The initiation feature judging unit 161, for according to the filename or hypothesis starting cluster number judgement Whether deleted document has initiation feature.

The initiation feature include extension name among the filename and in disk management with the hypothesis starting cluster Number similar starting cluster number.

The end feature judging unit 162, if there is initiation feature for the deleted document, according to described Beginning feature determines file type, and judges whether the deleted document has end feature according to identified file type.

If there are the extension name for the deleted document, true according to content represented by the character string of the extension name The file type of the fixed deleted document.If having the hypothesis with the deleted document in the disk management to originate The similar starting cluster number of cluster number, according in file record item corresponding to starting cluster number similar with hypothesis starting cluster number The file type of record determines the file type of the deleted document.

The ending cluster content judging unit 163, if having for the deleted document terminates feature, described in judgement It is assumed that terminating in ending cluster corresponding to cluster number whether to include the end feature.

If the file type of the deleted document is to search described deleted with the file type for terminating feature It whether there is except the hypothesis of file terminates the content in file directory item corresponding to cluster number as the end mark Character string.If the character string for assuming to terminate to have as end mark in file directory item corresponding to cluster number, determines institute Stating hypothesis terminates in ending cluster pointed by cluster number comprising terminating feature.

First judging unit 164, if terminating to include the end in ending cluster corresponding to cluster number for the hypothesis Feature determines that the ending cluster meets preset condition.

In one embodiment, as shown in figure 9, the cluster number judging unit 160 further includes following subelement: ending cluster knot Structure judging unit 165, ending cluster character judging unit 166 and the second judging unit 167.

The ending cluster structure decision unit 165, if not having initiation feature for the deleted document or not having Terminate feature, judges that the hypothesis terminates the whether all skies of ending cluster corresponding to cluster number.

The content for terminating file directory item corresponding to cluster number with the hypothesis is checked, if among the file directory item Whole character strings are all zero, determine that the hypothesis terminates all skies of ending cluster corresponding to cluster number.

The ending cluster character judging unit 166 judges the ending cluster if being used for the not all skies of the ending cluster Described in deleted document termination character after the whether all skies of content.

The termination character in the content of the file directory item is obtained, judges to terminate word described in the file directory item It whether there is the character string that content is all zero after symbol, if there are the words of content all zero after the end-of-file character Symbol string, determines all skies of content after the termination character of deleted document described in the ending cluster.

Second judging unit 167, if the content for after the termination character in the ending cluster is all Sky determines that the ending cluster meets preset condition.

The end unit 170, if determining that hypothesis starting cluster number to the hypothesis is tied for meeting preset condition Fascicle number file corresponding on disk is the deleted document.

Assume that starting cluster number assumes that the character string terminated among file directory item corresponding to cluster number is shown to described for described Content of the content shown as the deleted document.

The return unit 180, if reconfiguring described deleted according to preset rules for being unsatisfactory for preset condition The hypothesis of file originates cluster number, and returns and described judge that the hypothesis originates whether cluster number exceeds disk management maximum cluster number model The step of enclosing.

The hypothesis starting cluster number is reconfigured according to the preset rules, new hypothesis starting cluster number can be obtained, if institute It states new hypothesis starting cluster number and is unsatisfactory for the preset condition, then continue to play the new hypothesis according to the preset rules Beginning cluster number is reconfigured.It is constructed repeatedly by originating cluster number to the hypothesis that can not restore the deleted document, it can be gradually Obtain the true starting cluster number of the deleted document, so according to the true starting cluster number to the deleted document into Row file recovery step.

In one embodiment, as shown in Figure 10, the return unit 180 includes following subelement: addition unit 181, again Group unit 182 and replacement unit 183.

The addition unit 181, for originating the hypothesis, the high cluster number of starting described in cluster number is carried out plus one is handled.

Hypothesis starting cluster number in first time process is made of the high cluster number of preset starting and the low cluster number of the starting, is obtained The high cluster number of starting in the cluster number of hypothesis starting described in this process is taken, the character medium size yardage of the high cluster number of starting is added 1。

The recomposition unit 182, for carrying out described plus treated a high cluster number of starting and the low cluster number of the starting It constructs and generates a new hypothesis and originate cluster number.

The high cluster number of starting in character on number plus after 1 and the low cluster number of the starting are constructed and generate one New hypothesis originates cluster number.

The replacement unit 183, for the new hypothesis starting cluster number to be originated cluster number as the hypothesis.

Hypothesis starting cluster number in this process is deleted, determines that new hypothesis starting cluster number is to assume Beginning cluster number is simultaneously used for next process.

It should be noted that it is apparent to those skilled in the art that, above-mentioned file restoring device and each The specific implementation process of unit can refer to the corresponding description in preceding method embodiment, for convenience of description and succinctly, Details are not described herein.

Above-mentioned file restoring device can be implemented as the form of computer program, which can be in such as Figure 11 Shown in run in computer equipment.

Figure 11 is please referred to, Figure 11 is the schematic block diagram of computer equipment provided in an embodiment of the present invention.

Refering to fig. 11, the computer equipment 500 include the processor 502 connected by system bus 501, memory and Network interface 505, wherein memory may include non-volatile memory medium 503 and built-in storage 504.

The non-volatile memory medium 503 can storage program area 5031 and computer program 5032.The computer program 5032 are performed, and processor 502 may make to execute file access pattern method.

The processor 502 supports the operation of entire computer equipment 500 for providing calculating and control ability.

The built-in storage 504 provides environment for the operation of the computer program 5032 in non-volatile memory medium 503, When the computer program 5032 is executed by processor 502, processor 502 may make to execute file access pattern method.

The network interface 505 is for carrying out network communication.It will be understood by those skilled in the art that being tied shown in Figure 11 Structure, the only block diagram of part-structure relevant to the present invention program are not constituted and are applied thereon to the present invention program The restriction of computer equipment 500, specific computer equipment 500 may include than more or fewer components as shown in the figure, or Person combines certain components, or with different component layouts.

Wherein, the processor 502 is as follows to realize for running computer program 5032 stored in memory Function: obtaining file record item from file directory table, judges in the file record item with the presence or absence of deleted marker；If institute It states in file record item that there are deleted markers, document base information is obtained from the file record item, the file is believed substantially Breath includes the file size and the low cluster number of starting of deleted document；According to the low cluster number of the starting and the preset high cluster number of starting Construct the hypothesis starting cluster number of the deleted document；Judge whether the hypothesis starting cluster number exceeds disk management maximum Cluster number range；If hypothesis starting cluster number is without departing from disk management maximum cluster number range, according to the file size and described It is assumed that starting cluster number determines that the hypothesis of the deleted document terminates cluster number；Judge that the hypothesis terminates the corresponding end of cluster number Whether cluster meets preset condition；If the hypothesis terminates ending cluster corresponding to cluster number and meets preset condition, determines and described assume Beginning cluster number assumes that terminating cluster number file corresponding on disk is the deleted document to described；If the hypothesis terminates Ending cluster corresponding to cluster number is unsatisfactory for preset condition, is originated according to the hypothesis that preset rules reconfigure the deleted document Cluster number, and return to described the step of whether hypothesis starting cluster number exceeds disk management maximum cluster number range judged.

In one embodiment, processor 502 is executing the step for judging to whether there is deleted marker in the file record item When rapid, specifically perform the following operations: whether the initial character for judging the file record item is preset characters；If the file note The initial character for recording item is preset characters, determines that there are deleted markers in the file record item.

In one embodiment, processor 502 determines institute according to the file size and hypothesis starting cluster number in execution When stating the hypothesis of deleted document terminates the step of cluster number, specifically perform the following operations: according to the list of the file size and cluster Position size calculates across the cluster amount of the deleted document；According to the hypothesis originates cluster number and across the cluster amount determines The hypothesis of deleted document terminates cluster number.

In one embodiment, processor 502 judges that the hypothesis terminates whether ending cluster corresponding to cluster number meets in execution It when the step of preset condition, specifically performs the following operations: described according to the filename or hypothesis starting cluster number judgement Delete whether file has initiation feature；If the deleted document has initiation feature, text is determined according to the initiation feature Part type, and judge whether the deleted document has end feature according to identified file type；If described deleted File has end feature, judges that whether the hypothesis terminates in ending cluster corresponding to cluster number comprising the end feature；If institute Stating hypothesis terminates to determine that the ending cluster meets preset condition comprising the end feature in ending cluster corresponding to cluster number.

In one embodiment, processor 502 judges that the hypothesis terminates whether ending cluster corresponding to cluster number meets in execution It when the step of preset condition, specifically performs the following operations: described according to the filename or hypothesis starting cluster number judgement Delete whether file has initiation feature；If the deleted document has initiation feature, text is determined according to the initiation feature Part type, and judge whether the deleted document has end feature according to identified file type；If described deleted File does not have initiation feature or does not have end feature, judges whether all the hypothesis terminates ending cluster corresponding to cluster number For sky；If the not all skies of the ending cluster, judge interior after the termination character of deleted document described in the ending cluster Hold whether all skies；If all skies of content after the termination character in the ending cluster, determine the ending cluster Meet preset condition.

In one embodiment, processor 502 is executing the hypothesis that the deleted document is reconfigured according to preset rules It when originating the step of cluster number, specifically performs the following operations: the hypothesis being originated into the high cluster number of starting described in cluster number and carries out adding one Processing；Described plus treated a high cluster number of starting and the low cluster number of the starting are constructed and generate a new hypothesis Originate cluster number；The new hypothesis starting cluster number is originated into cluster number as the hypothesis.

It will be understood by those skilled in the art that the embodiment of computer equipment shown in Figure 11 is not constituted to calculating The restriction of machine equipment specific composition, in other embodiments, computer equipment may include than illustrating more or fewer portions Part perhaps combines certain components or different component layouts.For example, in some embodiments, computer equipment can be only Including memory and processor, in such embodiments, implement shown in the structure and function and Figure 11 of memory and processor Example is consistent, and details are not described herein.

It should be appreciated that in embodiments of the present invention, processor 502 can be central processing unit (Central Processing Unit, CPU), which can also be other general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other can Programmed logic device, discrete gate or transistor logic, discrete hardware components etc..Wherein, general processor can be micro- Processor or the processor are also possible to any conventional processor etc..

Computer readable storage medium is provided in another embodiment of the invention.The computer readable storage medium can Think non-volatile computer readable storage medium.The computer-readable recording medium storage has computer program, falls into a trap Calculation machine program performs the steps of the acquisition file record item from file directory table when being executed by processor, judge the file It whether there is deleted marker in entry；If there are deleted markers in the file record item, obtained from the file record item Document base information is taken, the document base information includes the file size and the low cluster number of starting of deleted document；According to described It originates low cluster number and the preset high cluster number of starting constructs the hypothesis starting cluster number of the deleted document；Judge the hypothesis Whether starting cluster number exceeds disk management maximum cluster number range；If the hypothesis starting cluster number is without departing from disk management maximum cluster Number range determines that the hypothesis of the deleted document terminates cluster number according to the file size and hypothesis starting cluster number； Judging the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition；If the hypothesis terminates the corresponding knot of cluster number Fascicle meets preset condition, determines the file for assuming that starting cluster number is corresponding on disk to the hypothesis end cluster number For the deleted document；If the hypothesis, which terminates ending cluster corresponding to cluster number, is unsatisfactory for preset condition, according to preset rules weight The hypothesis of deleted document described in neotectonics originates cluster number, and returns and described judge that the hypothesis originates whether cluster number exceeds magnetic The step of disk management maximum cluster number range.

In one embodiment, the step of whether there is deleted marker in the judgement file record item includes: judgement Whether the initial character of the file record item is preset characters；If the initial character of the file record item is preset characters, determine There are deleted markers in the file record item.

In one embodiment, described to have deleted text according to described in the file size and hypothesis starting cluster number determination It includes: to be calculated described to have deleted text according to the unit-sized of the file size and cluster that the hypothesis of part, which terminates the step of cluster number, Across the cluster amount of part；Cluster number is originated according to the hypothesis and across the cluster amount determines that the hypothesis of the deleted document terminates cluster number.

In one embodiment, described to judge that the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition Step includes: to judge whether the deleted document has initiation feature according to the filename or hypothesis starting cluster number； If the deleted document has initiation feature, file type is determined according to the initiation feature, and according to identified file Type judges whether the deleted document has end feature；If the deleted document, which has, terminates feature, described in judgement It is assumed that terminating in ending cluster corresponding to cluster number whether to include the end feature；If the hypothesis terminates, cluster number is corresponding to be terminated Include the end feature in cluster, determines that the ending cluster meets preset condition.

In one embodiment, described to judge that the hypothesis terminates whether ending cluster corresponding to cluster number meets preset condition Step includes: to judge whether the deleted document has initiation feature according to the filename or hypothesis starting cluster number； If the deleted document has initiation feature, file type is determined according to the initiation feature, and according to identified file Type judges whether the deleted document has end feature；If the deleted document does not have initiation feature or does not have There is end feature, judges that the hypothesis terminates the whether all skies of ending cluster corresponding to cluster number；If the ending cluster is not all Sky judges the whether all skies of content after the termination character of deleted document described in the ending cluster；If the end The all skies of content after the termination character in cluster, determine that the ending cluster meets preset condition.

In one embodiment, the hypothesis for reconfiguring the deleted document according to preset rules originates cluster number Step includes: that the hypothesis is originated the high cluster number of starting described in cluster number to carry out adding a processing；It will be described plus one treated rises The high cluster number that begins and the low cluster number of the starting are constructed and generate a new hypothesis starting cluster number；The new hypothesis is risen Beginning cluster number originates cluster number as the hypothesis.

It is apparent to those skilled in the art that for convenience of description and succinctly, foregoing description is set The specific work process of standby, device and unit, can refer to corresponding processes in the foregoing method embodiment, and details are not described herein. Those of ordinary skill in the art may be aware that unit described in conjunction with the examples disclosed in the embodiments of the present disclosure and calculation Method step, can be realized with electronic hardware, computer software, or a combination of the two, in order to clearly demonstrate hardware and soft The interchangeability of part generally describes each exemplary composition and step according to function in the above description.These function It can be implemented in hardware or software the specific application and design constraint depending on technical solution actually.Professional skill Art personnel can use different methods to achieve the described function each specific application, but this realization is not answered Think beyond the scope of this invention.

In several embodiments provided by the present invention, it should be understood that disclosed unit and method, it can be with It realizes by another way.For example, the apparatus embodiments described above are merely exemplary, for example, the unit It divides, only logical function partition, there may be another division manner in actual implementation, can also will have identical function Unit set at a unit, such as multiple units or components can be combined or can be integrated into another system or one A little features can be ignored, or not execute.In addition, shown or discussed mutual coupling or direct-coupling or communication link Connect can be through some interfaces, the indirect coupling or communication connection of device or unit, be also possible to electricity, it is mechanical or its Its form connection.

The unit as illustrated by the separation member may or may not be physically separated, as unit The component of display may or may not be physical unit, it can and it is in one place, or may be distributed over more In a network unit.Some or all of unit therein can be selected to realize the embodiment of the present invention according to the actual needs The purpose of scheme.

It, can also be in addition, the functional units in various embodiments of the present invention may be integrated into one processing unit It is that each unit physically exists alone, is also possible to two or more units and is integrated in one unit.It is above-mentioned integrated Unit both can take the form of hardware realization, can also realize in the form of software functional units.

If the integrated unit is realized in the form of SFU software functional unit and sells or use as independent product When, it can store in a computer readable storage medium.Based on this understanding, technical solution of the present invention is substantially The all or part of the part that contributes to existing technology or the technical solution can be with the shape of software product in other words Formula embodies, which is stored in a computer readable storage medium, including some instructions are to make It obtains a computer equipment (can be personal computer, server or the network equipment etc.) and executes each embodiment of the present invention The all or part of the steps of the method.And computer readable storage medium above-mentioned includes: USB flash disk, mobile hard disk, read-only deposits The various media that can store program code such as reservoir (ROM, Read-Only Memory), magnetic or disk.

The above description is merely a specific embodiment, but scope of protection of the present invention is not limited thereto, appoints What those familiar with the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications Or replacement, these modifications or substitutions should be covered by the protection scope of the present invention.Therefore, protection scope of the present invention is answered It is subject to the protection scope in claims.

Claims

1. a kind of file access pattern method characterized by comprising

If there are deleted markers in the file record item, document base information, the text are obtained from the file record item Part essential information includes the file size and the low cluster number of starting of deleted document；

Cluster number is originated according to the hypothesis that the low cluster number of the starting and the preset high cluster number of starting construct the deleted document；

If hypothesis starting cluster number without departing from disk management maximum cluster number range, according to the file size and described assumes Beginning cluster number determines that the hypothesis of the deleted document terminates cluster number；

If the hypothesis, which terminates ending cluster corresponding to cluster number, meets preset condition, determine that the hypothesis originates cluster number to the hypothesis Terminating cluster number file corresponding on disk is the deleted document；And

If the hypothesis, which terminates ending cluster corresponding to cluster number, is unsatisfactory for preset condition, described deleted is reconfigured according to preset rules Except the hypothesis of file originates cluster number, and returns and described judge that the hypothesis originates whether cluster number exceeds disk management maximum cluster number model The step of enclosing.

2. file access pattern method according to claim 1, which is characterized in that it is described judge in the file record item whether The step of there are deleted markers, comprising:

Whether the initial character for judging the file record item is preset characters；And

If the initial character of the file record item is preset characters, determine that there are deleted markers in the file record item.

3. file access pattern method according to claim 1, which is characterized in that described according to the file size and the vacation Surely starting cluster number determines the step of hypothesis of the deleted document terminates cluster number, comprising:

Across the cluster amount of the deleted document is calculated according to the unit-sized of the file size and cluster；And

Cluster number is originated according to the hypothesis and across the cluster amount determines that the hypothesis of the deleted document terminates cluster number.

4. file access pattern method according to claim 1, which is characterized in that the document base information further includes having deleted The filename of file, it is described to judge the hypothesis terminates the step of whether ending cluster corresponding to cluster number meets preset condition, comprising:

Judge whether the deleted document has initiation feature according to the filename or hypothesis starting cluster number；

If the deleted document has initiation feature, file type is determined according to the initiation feature, and according to identified File type judges whether the deleted document has end feature；

If the deleted document, which has, terminates feature, judge that whether the hypothesis terminates in ending cluster corresponding to cluster number comprising institute State end feature；And

If the hypothesis terminates to include the end feature in ending cluster corresponding to cluster number, determine that the ending cluster meets default item Part.

5. file access pattern method according to claim 1, which is characterized in that the document base information includes also having deleted The filename of file, it is described to judge the hypothesis terminates the step of whether ending cluster corresponding to cluster number meets preset condition, comprising:

If the deleted document, which does not have initiation feature or do not have, terminates feature, judge that the hypothesis terminates corresponding to cluster number The whether all skies of ending cluster；

If the not all skies of the ending cluster, judge the content after the termination character of deleted document described in the ending cluster Whether all skies；And

If all skies of content after the termination character in the ending cluster, determine that the ending cluster meets default item Part.

6. file access pattern method according to claim 1, which is characterized in that it is described reconfigured according to preset rules it is described The hypothesis of deleted document originates the step of cluster number, comprising:

The hypothesis is originated the high cluster number of starting described in cluster number to carry out adding a processing；

Described plus treated a high cluster number of starting and the low cluster number of the starting are constructed and generates a new hypothesis and rises Beginning cluster number；And

The new hypothesis starting cluster number is originated into cluster number as the hypothesis.

7. a kind of file restoring device characterized by comprising

Search unit, for obtaining file record item from file directory table, judging, which whether there is in the file record item, is deleted Except mark；

Initial cell, if obtaining file base from the file record item for there are deleted markers in the file record item This information, the document base information include the file size and the low cluster number of starting of deleted document；

Structural unit, for constructing the vacation of the deleted document according to the low cluster number of the starting and the preset high cluster number of starting Surely cluster number is originated；

Computing unit, if for hypothesis starting cluster number without departing from disk management maximum cluster number range, it is big according to the file The small and described hypothesis starting cluster number determines that the hypothesis of the deleted document terminates cluster number；

End unit determines the hypothesis starting if terminating ending cluster corresponding to cluster number for the hypothesis meets preset condition Cluster number assumes that terminating cluster number file corresponding on disk is the deleted document to described；And

Return unit, if terminating ending cluster corresponding to cluster number for the hypothesis is unsatisfactory for preset condition, according to preset rules weight The hypothesis of deleted document described in neotectonics originates cluster number, and returns and described judge that the hypothesis originates whether cluster number exceeds disk The step of managing maximum cluster number range.

8. file restoring device according to claim 7, which is characterized in that the cluster number judging unit, comprising:

Initiation feature judging unit, for judging that the deleted document is according to the filename or hypothesis starting cluster number It is no that there is initiation feature；

Terminate feature judging unit, if there is initiation feature for the deleted document, text is determined according to the initiation feature Part type, and judge whether the deleted document has end feature according to identified file type；

Ending cluster content judging unit judges that the hypothesis terminates cluster number if having for the deleted document terminates feature It whether include the end feature in corresponding ending cluster；

First judging unit determines institute if terminating to include the end feature in ending cluster corresponding to cluster number for the hypothesis It states ending cluster and meets preset condition；

Ending cluster structure decision unit is sentenced if not having initiation feature for the deleted document or do not have terminates feature The hypothesis of breaking terminates the whether all skies of ending cluster corresponding to cluster number；

Ending cluster character judging unit judges to have deleted described in the ending cluster if being used for the not all skies of the ending cluster The whether all skies of content after the termination character of file；And

Second judging unit, if for all skies of content after the termination character in the ending cluster, described in judgement Ending cluster meets preset condition.

9. a kind of computer equipment, including memory, processor and it is stored on the memory and can be on the processor The computer program of operation, which is characterized in that the processor realizes such as claim 1 to 6 when executing the computer program Any one of described in file access pattern method.

10. a kind of computer readable storage medium, which is characterized in that the computer-readable recording medium storage has computer journey Sequence, the computer program execute the processor as described in any one of claims 1 to 6 File access pattern method.