CN109582501B

CN109582501B - File recovery method and device, computer equipment and storage medium

Info

Publication number: CN109582501B
Application number: CN201811434334.4A
Authority: CN
Inventors: 王志雄; 彭重阳
Original assignee: Wondershare Technology Co ltd
Current assignee: Wondershare Technology Co ltd
Priority date: 2018-11-28
Filing date: 2018-11-28
Publication date: 2021-09-03
Anticipated expiration: 2038-11-28
Also published as: CN109582501A

Abstract

The invention discloses a file recovery method, a file recovery device, computer equipment and a storage medium, which solve the problems of low accuracy and success rate of file recovery operation on deleted files in the storage structure of the conventional FAT32 system. The invention sets a judgment condition in file recovery operation based on file storage characteristics, and particularly calculates the length of a deleted file by utilizing the characteristics that different sizes of files occupy different storage spaces and further occupy different numbers of clusters, and only when the length of an actual retrieved file meets the length of the deleted file, the actual retrieved file is judged to be the deleted file needing to be recovered. The invention avoids the uncertainty and instability of the file name and the file type characteristics as the file recovery judgment conditions in the past, and ensures that the success rate and the accuracy of the file recovery operation are higher.

Description

File recovery method and device, computer equipment and storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a file recovery method and apparatus, a computer device, and a storage medium.

Background

In the storage structure based on the FAT32 system, a deleted file loses a part of the address information in its corresponding file entry, so that the deleted file cannot be opened again by a user, but the physical information of the deleted file still remains in a sector of the storage medium. The present method for recovering deleted file mainly utilizes the address information of undeleted file to fill up the residual address information in the file record item of deleted file to make it complete, and according to the filled address information the described sector can be searched, according to the characteristics of file type and file name in the file record item of deleted file the search back file which is in accordance with the above-mentioned characteristics of deleted file can be searched in the sector in sequence and extracted. This method causes confusion when the file types or file names of a plurality of deleted files are the same, and has a low success rate when the file types or file names are not complete.

Disclosure of Invention

The invention provides a file recovery method, a file recovery device, computer equipment and a storage medium, and aims to solve the problems that in the prior art, the accuracy and the success rate of a file recovery method based on a FAT32 system are low.

In order to solve the foregoing technical problem, in a first aspect, an embodiment of the present invention provides a file recovery method, including the following steps:

acquiring a file record item from a file directory table, and judging whether a deletion mark exists in the file record item;

if the file record item has a deletion mark, acquiring file basic information from the file record item, wherein the file basic information comprises the file size and the initial low cluster number of the deleted file;

constructing an assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number;

judging whether the assumed initial cluster number exceeds the maximum cluster number range of disk management;

if the assumed initial cluster number does not exceed the disk management maximum cluster number range, determining the assumed end cluster number of the deleted file according to the file size and the assumed initial cluster number;

judging whether an end cluster corresponding to the assumed end cluster number meets a preset condition or not;

if the end cluster corresponding to the assumed end cluster number meets a preset condition, determining that the file corresponding to the assumed start cluster number to the assumed end cluster number on the disk is the deleted file; and

if the end cluster corresponding to the assumed end cluster number does not meet the preset condition, reconstructing the assumed start cluster number of the deleted file according to the preset rule, and returning to the step of judging whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

In a second aspect, an embodiment of the present invention provides a file recovery apparatus, including:

the searching unit is used for acquiring a file record item from a file directory table and judging whether a deletion mark exists in the file record item;

an initial unit, configured to obtain basic file information from the file entry if a deletion flag exists in the file entry, where the basic file information includes a file size and a starting low cluster number of a deleted file;

a constructing unit, configured to construct the assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number;

a range judging unit, configured to judge whether the assumed initial cluster number exceeds a maximum cluster number range for disk management;

a computing unit, configured to determine, if the assumed starting cluster number does not exceed the disk management maximum cluster number range, an assumed ending cluster number of the deleted file according to the file size and the assumed starting cluster number;

a cluster number judging unit, configured to judge whether an end cluster corresponding to the assumed end cluster number satisfies a preset condition;

an end unit, configured to determine, if an end cluster corresponding to the assumed end cluster number satisfies a preset condition, that a file corresponding to the assumed start cluster number to the assumed end cluster number on a disk is the deleted file; and

and a returning unit, configured to, if an end cluster corresponding to the assumed end cluster number does not satisfy a preset condition, reconstruct the assumed start cluster number of the deleted file according to a preset rule, and return to the step of determining whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the file recovery method according to the first aspect when executing the computer program.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and the computer program, when executed by a processor, causes the processor to execute the file recovery method according to the first aspect.

Embodiments of the present invention provide a file recovery method, an apparatus, a computer device, and a storage medium, where an assumed end cluster number of a file is obtained according to an inherent characteristic of a file size and a pre-assumed start cluster number, and it is further determined whether an end cluster corresponding to the assumed end cluster number meets a preset condition, for example, whether a file end characteristic or a specific structure of the deleted file exists, so as to obtain a retrieved file. The embodiment of the invention avoids the uncertainty and low success rate caused by the condition that the file name and the file type are the same or are missing when the deleted file is searched and retrieved according to the file name and the file type characteristics, and ensures that the file recovery operation based on the FAT32 system has higher accuracy and higher success rate.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a schematic flowchart of a file recovery method according to an embodiment of the present invention;

FIG. 2 is a schematic sub-flow chart of a file recovery method according to an embodiment of the present invention;

FIG. 3 is a schematic view of another sub-flow of a file recovery method according to an embodiment of the present invention;

FIG. 4 is a schematic view of another sub-flow of a file recovery method according to an embodiment of the present invention;

FIG. 5 is a schematic view of another sub-flow of a file recovery method according to an embodiment of the present invention;

FIG. 6 is a schematic block diagram of a file recovery apparatus according to an embodiment of the present invention;

FIG. 7 is a schematic block diagram of a sub-unit of a file recovery apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic block diagram of another sub-unit of a file recovery apparatus according to an embodiment of the present invention;

FIG. 9 is a schematic block diagram of another sub-unit of a file recovery apparatus according to an embodiment of the present invention;

FIG. 10 is a schematic block diagram of another sub-unit of a file recovery apparatus according to an embodiment of the present invention;

FIG. 11 is a schematic block diagram of a computer device provided by an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the specification of the present invention and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

It should be further understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

As shown in fig. 1, the file recovery method provided by the embodiment of the present invention includes steps S110 to S180.

S110, acquiring a file record item from a file directory table, and judging whether a deletion mark exists in the file record item.

And acquiring a file record item from a file directory table, and judging whether a deletion mark exists in the file record item. When a file in the FAT32 system is deleted, the content of the file entry of the deleted file is modified according to the specific rule of the FAT32 system, so that the deletion mark which conforms to the specific rule of the FAT32 system exists in the file entry of the deleted file. In the file directory table, when it is found that the deletion flag exists in a certain file entry, it may be determined that the file entry is a file entry of a certain deleted file, and the deleted file may be restored by using, as an initial basis, a content of the file entry that is not modified according to a specific rule of the FAT32 system.

The file directory table is one of the core contents in the FAT32 system, and is mainly used for recording the basic information of files stored in the FAT32 system. The file directory table includes a plurality of file entries corresponding to storage files, where the file entries record the file basic information of each storage file, and the file basic information includes start address information of the file on a physical disk, where the start address information specifically includes a start high cluster number (high-order cluster number) and a start low cluster number (low-order cluster number). When the storage file is deleted, the initial high cluster number in the initial address information is cleared, so that the storage file cannot be searched due to the lack of the initial address information, and the storage file becomes a deleted file.

In one embodiment, as shown in FIG. 2, step S110 includes sub-steps S111 and S112.

And S111, judging whether the initial character of the file entry is a preset character.

And judging whether the first character of the file entry is a preset character or not. In this embodiment, the preset character is specifically "E5", and when a file becomes a deleted file after being deleted, the first character of the file name string in the file entry corresponding to the deleted file is modified to "E5" according to the specific rule of the FAT32 system. The file name character string is a character string located at the head of the file entry in the contents of the file entry, and further the first character of the contents of the file entry corresponding to the deleted file is also "E5", that is, the deletion flag is made to include "E5" located at the first character of the file entry.

And S112, if the first character of the file entry is a preset character, judging that a deletion mark exists in the file entry.

And if the first character of the file entry is a preset character, judging that a deletion mark exists in the file entry. And judging the first character of the content of the file entry, and if the first character of the file entry is the preset character 'E5', determining that the file entry has a deletion mark, and judging that the file entry belongs to a deleted file.

S120, if the file record item has the deletion mark, file basic information is obtained from the file record item, and the file basic information comprises the file size and the initial low cluster number of the deleted file.

And if the file record item has a deletion mark, acquiring basic file information from the file record item, wherein the basic file information comprises the file size and the initial low cluster number of the deleted file. And when the file record item has a deletion mark, the file corresponding to the file record item is a deleted file. In order to recover the deleted file, extracting file basic information in the file entry as a basis for file recovery, wherein the file basic information comprises: a file size for calculating a length of the deleted file; a start low cluster number for constructing a start address of the deleted file. In some embodiments, a file name may be further extracted from the file basic information, and the file name is used to determine a file characteristic of the deleted file.

Specifically, the presentation form of the file basic information in the file entry is a character string converted from binary data, the file basic information including 16 characters in total, wherein each character is composed of two bytes, so that a single file entry is composed of 32 bytes. The file size corresponds to the last 4 bytes of the file entry; the starting low cluster number corresponds to 2 characters of the file entry having an offset number of 0x1A or 0x 1B; the file name corresponds to the first 11 bytes of the file record item, and comprises a main file name corresponding to the first 8 bytes and an extension name corresponding to the last 3 bytes.

S130, constructing the assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number.

And constructing the assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number. And setting the initial address of the deleted file as an assumed initial cluster number, and then retrieving the deleted file according to the assumed initial cluster number. In the FAT32 system, the initial high cluster numbers of 2 characters corresponding to the offset numbers 0x14 or 0x15 in the file entries of the deleted file are cleared, and in this embodiment, assuming that the original initial high cluster numbers of the deleted file are all 0, the preset initial high cluster numbers with the content of all 0 are set, and the preset initial high cluster numbers are used to construct the assumed initial cluster numbers of the deleted file. Specifically, the assumed initial cluster number with the length of 4 characters is constructed, the content of the first 2 characters is the preset initial high cluster number, and the content of the last 2 characters is the initial low cluster number with the reverse order. The specific content of the deleted file recorded in the file allocation table can be found according to the assumed starting cluster number, specifically, the assumed starting cluster number is the number of the file directory entry in the file allocation table.

S140, judging whether the assumed initial cluster number exceeds the maximum cluster number range of the disk management.

And judging whether the assumed initial cluster number exceeds the maximum cluster number range of the disk management. In the FAT32 system, the number of clusters managed by disks with different capacities is different, and if the number of clusters managed by the disk is larger, the cluster numbers corresponding to the clusters one to one are also larger, and the maximum cluster number range is also larger. When the assumed starting cluster number exceeds the disk management maximum cluster number range, the cluster pointed by the assumed starting cluster number does not exist in the disk, and the deleted file cannot be recovered. In an embodiment of the present invention, if the assumed starting cluster number exceeds the range of the maximum cluster number for disk management, that is, the cluster corresponding to the assumed starting cluster number does not exist in the disk, the assumed starting cluster number of the deleted file may be reconstructed according to the preset rule described in the embodiment of the present invention, and then it is determined whether the reconstructed assumed starting cluster number exceeds the range of the maximum cluster number for disk management.

S150, if the assumed starting cluster number does not exceed the disk management maximum cluster number range, determining the assumed ending cluster number of the deleted file according to the file size and the assumed starting cluster number.

And if the assumed starting cluster number does not exceed the disk management maximum cluster number range, determining the assumed ending cluster number of the deleted file according to the file size and the assumed starting cluster number. In the FAT32 system, all files are stored in several clusters, and the capacity of several clusters is the same, so when the size of the files is different, the number of clusters occupied by the files with different sizes is also different. The unit size of the cluster is set in advance, and the capacity thereof is a multiple of 2 (kilobits). The unit size of the cluster in the disk can be obtained by obtaining the preset disk parameters. The number of clusters occupied by the deleted file can be obtained according to the file size and the unit size of the clusters, and the assumed end cluster number of the deleted file can be obtained by combining the assumed start cluster number with the number of clusters occupied by the deleted file.

Specifically, in the FAT32 system, the cluster number is recorded in a file allocation Table (file allocation Table), the file allocation Table is composed of a plurality of file directory entries, each file directory entry corresponds to one cluster number, and the content in the file directory entries is the content stored in the cluster pointed to by the cluster number as the address, which corresponds to the file directory entry one by one. The contents in the file directory entry corresponding to the assumed start cluster number to the assumed end cluster number are assumed contents of the deleted file.

In one embodiment, as shown in FIG. 3, step S150 includes sub-steps S151 and S152.

And S151, calculating the cluster crossing amount of the deleted file according to the file size and the unit size of the cluster.

And calculating the cluster crossing amount of the deleted file according to the file size and the unit size of the cluster. Dividing the file size of the deleted file by the unit size of the cluster, if the remainder of the calculation result is not 0, adding 1 to the unit digit of the calculation result, and taking the integer part of the calculation result of adding 1 to the unit digit as the cluster spanning amount of the deleted file, wherein the cluster spanning amount is the number of clusters occupied by the deleted file obtained according to the file size of the deleted file. And each corresponding cluster in the cluster spanning amount is used for storing the specific content of the deleted file.

S152, determining the assumed end cluster number of the deleted file according to the assumed start cluster number and the cluster spanning amount.

And determining the assumed end cluster number of the deleted file according to the assumed start cluster number and the cluster spanning amount. And the cluster number obtained by adding the assumed starting cluster number to the cluster spanning amount and subtracting 1 is the assumed ending cluster number of the deleted file. The assumed end cluster number points to the end cluster of the deleted file, and the file directory entry corresponding to the assumed end cluster number is used for recording the specific content of the end cluster.

And S160, judging whether the end cluster corresponding to the assumed end cluster number meets a preset condition.

And judging whether the end cluster corresponding to the assumed end cluster number meets a preset condition or not. The end cluster is a cluster pointed to by the assumed end cluster number, the content of the end cluster is recorded in a file directory entry corresponding to the assumed end cluster number, the content of the file directory entry is in a character string form, and whether the end cluster meets a preset condition or not can be judged by judging the characteristics of the character string in the file directory entry. The preset condition is that if the assumed end cluster number is a real end cluster number, the end cluster corresponding to the assumed end cluster number has content related to file end, and the content related to file end includes file end characteristics and file end characters.

In an embodiment, as shown in fig. 4, step S160 includes sub-steps S161, S162, S163 and S164.

S161, judging whether the deleted file has the initial characteristic or not according to the file name or the assumed initial cluster number.

And judging whether the deleted file has an initial characteristic or not according to the file name or the assumed initial cluster number. The initial feature includes an extension in the file name, and if the extension does not exist in the file name, the file type of the deleted file cannot be determined by the file name. The start feature also includes a start cluster number that is similar to the hypothetical start cluster number in the magnetic coil management, e.g., the similar start cluster number has the same start low cluster number in its structure. If the initial cluster number similar to the assumed initial cluster number does not exist in the disk management, the file type of the deleted file cannot be judged according to the assumed initial cluster number. Specifically, in the FAT32 system, the filename includes an extension of the deleted file, the extension of the deleted file is represented as a character string, and the character string of the extension is specifically the last 3 bytes of the first 11 bytes of the file entry occupied by the filename character string. In the FAT32 system, files of the same type may be stored in clusters with similar physical locations, so that the files of the same type have similar starting cluster numbers, and therefore the file type of a deleted file can be determined by comparing the starting cluster numbers of the undeleted files, and in an embodiment of the present invention, the type of the deleted file can be determined by comparing the starting low cluster numbers.

And S162, if the deleted file has the initial characteristic, determining the file type according to the initial characteristic, and judging whether the deleted file has the ending characteristic according to the determined file type.

If the deleted file has the initial feature, determining the file type according to the initial feature, and judging whether the deleted file has the ending feature according to the determined file type. Specifically, if the deleted file has the extension, it is determined that the deleted file has an initial feature, and the file type of the deleted file is determined according to the content indicated by the character string of the extension. If an initial cluster number similar to the assumed initial cluster number of the deleted file exists in the magnetic disk management, judging that the deleted file has an initial characteristic, and determining the file type of the deleted file according to the file type recorded in the file record item corresponding to the initial cluster number similar to the assumed initial cluster number. And judging whether the deleted file has an ending characteristic or not according to the file type of the deleted file.

S163, if the deleted file has an end feature, determining whether the end cluster corresponding to the assumed end cluster number contains the end feature.

And if the deleted file has an end feature, judging whether an end cluster corresponding to the assumed end cluster number contains the end feature. The ending feature is a character string as an ending flag existing in the file directory entry corresponding to the assumed ending cluster number, for example, the character string as the ending flag is "55 AA". If the file type of the deleted file is a file type with an end feature, searching whether the content in the file directory entry corresponding to the assumed end cluster number of the deleted file has a character string as the end mark. And if the character string serving as the ending mark exists in the file directory entry corresponding to the assumed ending cluster number, judging that the ending cluster pointed by the assumed ending cluster number contains ending characteristics.

S164, if the end cluster corresponding to the assumed end cluster number contains the end feature, judging that the end cluster meets a preset condition.

And if the end cluster corresponding to the assumed end cluster number contains the end feature, judging that the end cluster meets a preset condition. The preset condition includes that the file directory entry corresponding to the assumed end cluster number has an end character reflecting the end characteristic, and the end cluster is determined to be the last cluster storing the specific content of the deleted file.

In one embodiment, as shown in fig. 4, step S160 further includes sub-steps S165, S166, and S167.

S165, if the deleted file does not have the starting feature or the ending feature, judging whether all the ending clusters corresponding to the assumed ending cluster number are empty.

And if the deleted file does not have the starting characteristic or the ending characteristic, judging whether all the ending clusters corresponding to the assumed ending cluster number are empty. If the deleted file is judged to have no starting feature and no ending feature through the steps, the content of the file directory entry corresponding to the assumed ending cluster number is checked, and if all character strings in the file directory entry are zero, all ending clusters corresponding to the assumed ending cluster number are determined to be empty.

And S166, if the end cluster is not completely empty, judging whether all the contents behind the end character of the deleted file in the end cluster are completely empty.

And if the end cluster is not completely empty, judging whether the contents behind the end character of the deleted file in the end cluster are completely empty. If the contents of the file directory entry corresponding to the assumed start assumed end cluster number of the deleted file are not all zero, an end character in the contents of the file directory entry is obtained, for example, the end character may be "55 AA" or other characters different from 0. And judging whether a character string with all zero contents exists after the ending character in the file directory entry, and if the character string with all zero contents exists after the ending character of the file, determining that all the contents after the ending character of the deleted file in the ending cluster are empty.

And S167, if the content behind the ending character in the ending cluster is all empty, judging that the ending cluster meets a preset condition.

And if the content behind the ending character in the ending cluster is all empty, judging that the ending cluster meets a preset condition. The preset conditions include that a file directory entry corresponding to the assumed end cluster number has an end character, and a character string with all zero exists after the end character, so that the end cluster pointed by the assumed end cluster number is not all empty and the content behind the end character in the end cluster is all empty, and the end cluster is determined to be the last cluster storing the specific content of the deleted file.

S170, if the end cluster corresponding to the assumed end cluster number meets a preset condition, determining that the file corresponding to the assumed start cluster number to the assumed end cluster number on the disk is the deleted file.

And if the end cluster corresponding to the assumed end cluster number meets a preset condition, determining that the file corresponding to the assumed start cluster number to the assumed end cluster number on the disk is the deleted file. And taking the content displayed by the character string in the file directory entry corresponding to the assumed starting cluster number to the assumed ending cluster number as the content of the deleted file, and further extracting the content of the deleted file and generating the deleted file.

S180, if the end cluster corresponding to the assumed end cluster number does not meet the preset condition, reconstructing the assumed start cluster number of the deleted file according to the preset rule, and returning to the step of judging whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

If the end cluster corresponding to the assumed end cluster number does not meet the preset condition, reconstructing the assumed start cluster number of the deleted file according to the preset rule, and returning to the step of judging whether the assumed start cluster number exceeds the maximum cluster number range of the disk management. Specifically, the assumed starting cluster number is reconstructed according to the preset rule, a new assumed starting cluster number can be obtained, and if the new assumed starting cluster number does not satisfy the preset condition, the new assumed starting cluster number is continuously reconstructed according to the preset rule. Repeatedly constructing the assumed initial cluster number which can not recover the deleted file, gradually acquiring the real initial cluster number of the deleted file, and further performing a file recovery step on the deleted file according to the real initial cluster number.

In one embodiment, as shown in FIG. 5, step S180 includes sub-steps S181, S182, and S183.

And S181, adding one to the initial high cluster number in the assumed initial cluster number.

And adding one to the initial high cluster number in the assumed initial cluster number. Specifically, the assumed initial cluster number in the first process is composed of a preset initial high cluster number and the initial low cluster number, the initial high cluster number in the assumed initial cluster number in the current process is obtained, 1 is added to the number of the number in the character of the initial high cluster number, so that the initial high cluster number added with 1 to the number in the character is different from the initial high cluster number in the current process and advances by one digit to the number in the character.

S182, constructing the initial high cluster number and the initial low cluster number after the addition processing to generate a new assumed initial cluster number.

And constructing the initial high cluster number and the initial low cluster number after the one-adding processing to generate a new assumed initial cluster number. Specifically, the initial high cluster number obtained by adding 1 to the number in the character and the initial low cluster number are constructed and a new assumed initial cluster number is generated, the new assumed initial cluster number is the same as the assumed initial cluster number in the current process in the low cluster number part, and the number of the new assumed initial cluster number in the high cluster number part is one more than the number of the assumed initial cluster number in the current process in the high cluster number part.

And S183, taking the new assumed initial cluster number as the assumed initial cluster number.

Taking the new hypothetical start cluster number as the hypothetical start cluster number. The new assumed starting cluster number is different from the assumed starting cluster number in the current process, and further, the assumed ending cluster number obtained according to the new assumed starting cluster number is different, and all the determination results obtained according to the new assumed starting cluster number may also be different from the determination results obtained according to the original assumed starting cluster number. Deleting the assumed initial cluster number in the process, and determining the new assumed initial cluster number as the assumed initial cluster number for the next process.

As shown in fig. 6, the present invention also provides a file restoring apparatus 100, which includes a search unit 110, an initial unit 120, a construction unit 130, a range judgment unit 140, a calculation unit 150, a cluster number judgment unit 160, an end unit 170, and a return unit 180, corresponding to the above file restoring method.

The searching unit 110 is configured to obtain a file entry from a file directory table, and determine whether a deletion flag exists in the file entry.

In one embodiment, as shown in FIG. 7, the search unit 110 includes the following sub-units: a first character unit 111 and a first character determination unit 112.

The first character unit 111 is configured to determine whether the first character of the file entry is a preset character.

The preset character is specifically 'E5', and when a file becomes a deleted file after being deleted, the first character of a file name character string in a file record item corresponding to the deleted file is modified into 'E5' according to a specific rule of the FAT32 system. The file name character string is a character string located at the head of the file entry in the contents of the file entry, and further the head character of the contents of the file entry corresponding to the deleted file is also "E5", so that the deletion flag includes "E5" located at the head character of the file entry.

The first character determination unit 112 is configured to determine that a deletion flag exists in the file entry if the first character of the file entry is a preset character.

And judging the first character of the content of the file entry, if the first character of the file entry is the preset character 'E5', judging that the file entry belongs to the deleted file, and further judging that the file entry belonging to the deleted file has a deletion mark.

The initialization unit 120 is configured to, if a deletion flag exists in the file entry, obtain basic file information from the file entry, where the basic file information includes a file size and a starting low cluster number of a deleted file.

And when the file record item has a deletion mark, the file corresponding to the file record item is a deleted file. In order to recover the deleted file, extracting file basic information in the file record item as a basis for file recovery, wherein the file size is used for calculating the length of the deleted file; the start low cluster number is used to construct the start address of the deleted file.

The constructing unit 130 is configured to construct the assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number.

And setting the initial address of the deleted file as an assumed initial cluster number, and then retrieving the deleted file according to the assumed initial cluster number. In this embodiment, assuming that the original starting high cluster numbers of the deleted file are all 0, the preset starting high cluster number with all 0 contents is set to construct the assumed starting cluster number of the deleted file. The specific content of the deleted file recorded in the file allocation table can be found according to the assumed starting cluster number.

The range determining unit 140 is configured to determine whether the assumed starting cluster number exceeds the maximum cluster number range of the disk management.

When the assumed starting cluster number exceeds the disk management maximum cluster number range, the cluster pointed by the assumed starting cluster number does not exist in the disk, and the deleted file cannot be recovered. In an embodiment of the present invention, if the assumed starting cluster number exceeds the disk management maximum cluster number range, the assumed starting cluster number of the deleted file may be reconstructed according to the preset rule described in the embodiment of the present invention, and then it is determined whether the reconstructed assumed starting cluster number exceeds the disk management maximum cluster number range.

The calculating unit 150 is configured to determine the assumed end cluster number of the deleted file according to the file size and the assumed start cluster number if the assumed start cluster number does not exceed the disk management maximum cluster number range.

The number of clusters occupied by the deleted file can be obtained according to the file size and the unit size of the clusters, and the assumed end cluster number of the deleted file can be obtained by combining the assumed start cluster number with the number of clusters occupied by the deleted file.

In one embodiment, as shown in fig. 8, the computing unit 150 includes the following sub-units: a cross cluster amount unit 151 and an end cluster number unit 152.

The cluster spanning unit 151 is configured to calculate a cluster spanning amount of the deleted file according to the file size and the unit size of the cluster.

Dividing the file size of the deleted file by the unit size of the cluster, if the remainder of the calculation result is not 0, adding 1 to the unit digit of the calculation result, and taking the integer part of the calculation result of adding 1 to the unit digit as the cluster spanning amount of the deleted file, wherein the cluster spanning amount is the number of clusters occupied by the deleted file obtained according to the file size of the deleted file.

The end cluster number unit 152 is configured to determine the assumed end cluster number of the deleted file according to the assumed start cluster number and the cross-cluster amount.

And the cluster number obtained by adding the assumed starting cluster number to the cluster spanning amount and subtracting 1 is the assumed ending cluster number of the deleted file.

The cluster number determining unit 160 is configured to determine whether an end cluster corresponding to the assumed end cluster number satisfies a preset condition.

And judging whether the end cluster meets a preset condition or not by judging the characteristics of the character strings in the file directory entries.

In one embodiment, as shown in fig. 9, the cluster number determination unit 160 includes the following sub-units: a start feature judgment unit 161, an end feature judgment unit 162, an end cluster content judgment unit 163, and a first judgment unit 164.

The start feature determining unit 161 is configured to determine whether the deleted file has a start feature according to the file name or the assumed start cluster number.

The start feature includes an extension among the file names and a start cluster number similar to the assumed start cluster number in disk management.

The ending characteristic determining unit 162 is configured to determine a file type according to the starting characteristic if the deleted file has the starting characteristic, and determine whether the deleted file has an ending characteristic according to the determined file type.

And if the deleted file has the extension, determining the file type of the deleted file according to the content represented by the character string of the extension. And if the starting cluster number similar to the assumed starting cluster number of the deleted file exists in the magnetic disk management, determining the file type of the deleted file according to the file type recorded in the file record item corresponding to the starting cluster number similar to the assumed starting cluster number.

The end cluster content determining unit 163 is configured to determine whether an end cluster corresponding to the assumed end cluster number includes an end feature if the deleted file has the end feature.

If the file type of the deleted file is a file type with an end feature, searching whether the content in the file directory entry corresponding to the assumed end cluster number of the deleted file has a character string as the end mark. And if the character string serving as the ending mark exists in the file directory entry corresponding to the assumed ending cluster number, judging that the ending cluster pointed by the assumed ending cluster number contains ending characteristics.

The first determining unit 164 is configured to determine that the end cluster satisfies a preset condition if the end cluster corresponding to the assumed end cluster number includes the end feature.

In one embodiment, as shown in fig. 9, the cluster number determination unit 160 further includes the following sub-units: an end cluster structure determination unit 165, an end cluster character determination unit 166, and a second determination unit 167.

The end cluster structure determining unit 165 is configured to determine whether all end clusters corresponding to the assumed end cluster number are empty if the deleted file does not have the start feature or the end feature.

And checking the content of the file directory entry corresponding to the assumed end cluster number, and if all character strings in the file directory entry are zero, determining that all end clusters corresponding to the assumed end cluster number are empty.

The end cluster character determining unit 166 is configured to determine whether all contents after the end character of the deleted file in the end cluster are empty if the end cluster is not empty.

Acquiring an ending character in the content of the file directory entry, judging whether a character string with all zero contents exists after the ending character in the file directory entry, and if the character string with all zero contents exists after the ending character of the file, determining that all the contents after the ending character of the deleted file in the ending cluster are empty.

The second determining unit 167 is configured to determine that the end cluster satisfies a preset condition if all contents after the end character in the end cluster are empty.

The ending unit 170 is configured to determine that the file corresponding to the assumed starting cluster number to the assumed ending cluster number on the disk is the deleted file if a preset condition is met.

And taking the content displayed by the character string in the file directory entry corresponding to the assumed starting cluster number to the assumed ending cluster number as the content of the deleted file.

The returning unit 180 is configured to, if the preset condition is not satisfied, reconstruct the assumed start cluster number of the deleted file according to a preset rule, and return to the step of determining whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

Reconstructing the assumed initial cluster number according to the preset rule to obtain a new assumed initial cluster number, and if the new assumed initial cluster number does not satisfy the preset condition, continuing to reconstruct the new assumed initial cluster number according to the preset rule. Repeatedly constructing the assumed initial cluster number which can not recover the deleted file, gradually acquiring the real initial cluster number of the deleted file, and further performing a file recovery step on the deleted file according to the real initial cluster number.

In one embodiment, as shown in FIG. 10, the return unit 180 includes the following sub-units: an adding unit 181, a recombining unit 182, and a replacing unit 183.

The adding unit 181 is configured to add one to the initial high cluster number in the assumed initial cluster number.

The assumed initial cluster number in the first process is composed of a preset initial high cluster number and the initial low cluster number, the initial high cluster number in the assumed initial cluster number in the current process is obtained, and 1 is added to the number of the numbers in the characters of the initial high cluster number.

The restructuring unit 182 is configured to construct the one-added initial high cluster number and the initial low cluster number to generate a new assumed initial cluster number.

And constructing the initial high cluster number and the initial low cluster number after adding 1 to the number in the character and generating a new assumed initial cluster number.

The replacing unit 183 is configured to use the new assumed start cluster number as the assumed start cluster number.

Deleting the assumed initial cluster number in the process, and determining the new assumed initial cluster number as the assumed initial cluster number for the next process.

It should be noted that, as can be clearly understood by those skilled in the art, the specific implementation processes of the file recovery apparatus and each unit may refer to the corresponding descriptions in the foregoing method embodiments, and for convenience and brevity of description, no further description is provided herein.

The above-described file restoration apparatus may be implemented in the form of a computer program that can be run on a computer device as shown in fig. 11.

Referring to fig. 11, fig. 11 is a schematic block diagram of a computer device according to an embodiment of the present invention.

Referring to fig. 11, the computer device 500 includes a processor 502, memory, and a network interface 505 connected by a system bus 501, where the memory may include a non-volatile storage medium 503 and an internal memory 504.

The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. The computer program 5032, when executed, may cause the processor 502 to perform a file recovery method.

The processor 502 is used to provide computing and control capabilities that support the operation of the overall computer device 500.

The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503, and when the computer program 5032 is executed by the processor 502, the processor 502 can be caused to execute a file recovery method.

The network interface 505 is used for network communication. Those skilled in the art will appreciate that the configuration shown in fig. 11 is a block diagram of only a portion of the configuration associated with aspects of the present invention and is not intended to limit the computing device 500 to which aspects of the present invention may be applied, and that a particular computing device 500 may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

Wherein the processor 502 is configured to run the computer program 5032 stored in the memory to implement the following functions: acquiring a file record item from a file directory table, and judging whether a deletion mark exists in the file record item; if the file record item has a deletion mark, acquiring file basic information from the file record item, wherein the file basic information comprises the file size and the initial low cluster number of the deleted file; constructing an assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number; judging whether the assumed initial cluster number exceeds the maximum cluster number range of disk management; if the assumed initial cluster number does not exceed the disk management maximum cluster number range, determining the assumed end cluster number of the deleted file according to the file size and the assumed initial cluster number; judging whether an end cluster corresponding to the assumed end cluster number meets a preset condition or not; if the end cluster corresponding to the assumed end cluster number meets a preset condition, determining that the file corresponding to the assumed start cluster number to the assumed end cluster number on the disk is the deleted file; if the end cluster corresponding to the assumed end cluster number does not meet the preset condition, reconstructing the assumed start cluster number of the deleted file according to the preset rule, and returning to the step of judging whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

In an embodiment, when the processor 502 performs the step of determining whether the file entry has the deletion flag, the following operations are specifically performed: judging whether the first character of the file entry is a preset character or not; and if the first character of the file entry is a preset character, judging that a deletion mark exists in the file entry.

In an embodiment, when the processor 502 executes the step of determining the assumed end cluster number of the deleted file according to the file size and the assumed start cluster number, the following operations are specifically executed: calculating the cluster crossing amount of the deleted file according to the file size and the unit size of the cluster; and determining the assumed end cluster number of the deleted file according to the assumed start cluster number and the cluster spanning amount.

In an embodiment, when the processor 502 performs the step of determining whether the end cluster corresponding to the assumed end cluster number satisfies the preset condition, the following operations are specifically performed: judging whether the deleted file has an initial characteristic or not according to the file name or the assumed initial cluster number; if the deleted file has the initial characteristic, determining the file type according to the initial characteristic, and judging whether the deleted file has the ending characteristic according to the determined file type; if the deleted file has an end feature, judging whether an end cluster corresponding to the assumed end cluster number contains the end feature; and if the end cluster corresponding to the assumed end cluster number contains the end feature, judging that the end cluster meets a preset condition.

In an embodiment, when the processor 502 performs the step of determining whether the end cluster corresponding to the assumed end cluster number satisfies the preset condition, the following operations are specifically performed: judging whether the deleted file has an initial characteristic or not according to the file name or the assumed initial cluster number; if the deleted file has the initial characteristic, determining the file type according to the initial characteristic, and judging whether the deleted file has the ending characteristic according to the determined file type; if the deleted file does not have the starting characteristic or the ending characteristic, judging whether all the ending clusters corresponding to the assumed ending cluster number are empty; if the end cluster is not completely empty, judging whether all contents behind the end character of the deleted file in the end cluster are completely empty; and if the content behind the ending character in the ending cluster is all empty, judging that the ending cluster meets a preset condition.

In an embodiment, when the processor 502 performs the step of reconstructing the assumed starting cluster number of the deleted file according to the preset rule, the following operations are specifically performed: adding one to the initial high cluster number in the assumed initial cluster number; constructing the initial high cluster number and the initial low cluster number after the one adding treatment to generate a new assumed initial cluster number; taking the new hypothetical start cluster number as the hypothetical start cluster number.

Those skilled in the art will appreciate that the embodiment of a computer device illustrated in fig. 11 does not constitute a limitation on the specific construction of the computer device, and that in other embodiments a computer device may include more or fewer components than those illustrated, or some components may be combined, or a different arrangement of components. For example, in some embodiments, the computer device may only include a memory and a processor, and in such embodiments, the structures and functions of the memory and the processor are consistent with those of the embodiment shown in fig. 11, and are not described herein again.

It should be understood that, in the embodiment of the present invention, the Processor 502 may be a Central Processing Unit (CPU), and the Processor 502 may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components, and the like. Wherein a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

In another embodiment of the invention, a computer-readable storage medium is provided. The computer readable storage medium may be a non-volatile computer readable storage medium. The computer-readable storage medium stores a computer program, wherein the computer program when executed by a processor implements the steps of: acquiring a file record item from a file directory table, and judging whether a deletion mark exists in the file record item; if the file record item has a deletion mark, acquiring file basic information from the file record item, wherein the file basic information comprises the file size and the initial low cluster number of the deleted file; constructing an assumed initial cluster number of the deleted file according to the initial low cluster number and a preset initial high cluster number; judging whether the assumed initial cluster number exceeds the maximum cluster number range of disk management; if the assumed initial cluster number does not exceed the disk management maximum cluster number range, determining the assumed end cluster number of the deleted file according to the file size and the assumed initial cluster number; judging whether an end cluster corresponding to the assumed end cluster number meets a preset condition or not; if the end cluster corresponding to the assumed end cluster number meets a preset condition, determining that the file corresponding to the assumed start cluster number to the assumed end cluster number on the disk is the deleted file; if the end cluster corresponding to the assumed end cluster number does not meet the preset condition, reconstructing the assumed start cluster number of the deleted file according to the preset rule, and returning to the step of judging whether the assumed start cluster number exceeds the maximum cluster number range of the disk management.

In one embodiment, the step of determining whether a deletion flag exists in the file entry comprises: judging whether the first character of the file entry is a preset character or not; and if the first character of the file entry is a preset character, judging that a deletion mark exists in the file entry.

In one embodiment, the step of determining the presumed end cluster number of the deleted file according to the file size and the presumed start cluster number comprises: calculating the cluster crossing amount of the deleted file according to the file size and the unit size of the cluster; and determining the assumed end cluster number of the deleted file according to the assumed start cluster number and the cluster spanning amount.

In an embodiment, the step of determining whether an end cluster corresponding to the assumed end cluster number satisfies a preset condition includes: judging whether the deleted file has an initial characteristic or not according to the file name or the assumed initial cluster number; if the deleted file has the initial characteristic, determining the file type according to the initial characteristic, and judging whether the deleted file has the ending characteristic according to the determined file type; if the deleted file has an end feature, judging whether an end cluster corresponding to the assumed end cluster number contains the end feature; and if the end cluster corresponding to the assumed end cluster number contains the end feature, judging that the end cluster meets a preset condition.

In an embodiment, the step of determining whether an end cluster corresponding to the assumed end cluster number satisfies a preset condition includes: judging whether the deleted file has an initial characteristic or not according to the file name or the assumed initial cluster number; if the deleted file has the initial characteristic, determining the file type according to the initial characteristic, and judging whether the deleted file has the ending characteristic according to the determined file type; if the deleted file does not have the starting characteristic or the ending characteristic, judging whether all the ending clusters corresponding to the assumed ending cluster number are empty; if the end cluster is not completely empty, judging whether all contents behind the end character of the deleted file in the end cluster are completely empty; and if the content behind the ending character in the ending cluster is all empty, judging that the ending cluster meets a preset condition.

In an embodiment, the step of reconstructing the assumed start cluster number of the deleted file according to a preset rule includes: adding one to the initial high cluster number in the assumed initial cluster number; constructing the initial high cluster number and the initial low cluster number after the one adding treatment to generate a new assumed initial cluster number; taking the new hypothetical start cluster number as the hypothetical start cluster number.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described apparatuses, devices and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again. Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the examples described in connection with the embodiments disclosed herein may be embodied in electronic hardware, computer software, or combinations of both, and that the components and steps of the examples have been described in a functional general in the foregoing description for the purpose of illustrating clearly the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

In the embodiments provided by the present invention, it should be understood that the disclosed apparatus, device and method can be implemented in other ways. For example, the above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only a logical division, and there may be other divisions when the actual implementation is performed, or units having the same function may be grouped into one unit, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may also be an electric, mechanical or other form of connection.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment of the present invention.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention essentially contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product stored in a computer-readable storage medium, which includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned computer-readable storage media comprise: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a magnetic disk, or an optical disk.

While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and various equivalent modifications and substitutions can be easily made by those skilled in the art within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A file recovery method, comprising:

the basic file information further includes the file name of the deleted file, and whether the end cluster corresponding to the assumed end cluster number meets a preset condition is judged, wherein the preset condition is that if the assumed end cluster number is a real end cluster number, the end cluster corresponding to the assumed end cluster number has content related to file ending, and the content related to file ending includes file ending characteristics and file ending characters;

judging whether the end cluster corresponding to the assumed end cluster number meets a preset condition or not, including: judging whether the deleted file has an initial feature according to the file name or the assumed initial cluster number, wherein the initial feature comprises an extension name in the file name and an initial cluster number similar to the assumed initial cluster number in disk management, if the deleted file has the initial feature, determining the file type according to the initial feature, judging whether the deleted file has an end feature according to the determined file type, wherein the end feature is a character string which exists in a file directory entry corresponding to an assumed end cluster number and serves as an end mark, if the deleted file has the end feature, judging whether an end cluster corresponding to the assumed end cluster number contains the end feature, and if the end cluster corresponding to the assumed end cluster number contains the end feature, judging that the end cluster meets a preset condition；

Determining the assumed end cluster numberWhether the corresponding end cluster meets the preset condition further comprises the following steps: if the deleted file does not have the starting feature or the ending feature, judging whether all ending clusters corresponding to the assumed ending cluster number are empty, if not, judging whether all contents behind the ending character of the deleted file in the ending clusters are empty, and if all the contents behind the ending character in the ending clusters are empty, judging that the ending clusters meet preset conditions；

2. The file recovery method according to claim 1, wherein said step of determining whether a deletion flag exists in said file entry comprises:

judging whether the first character of the file entry is a preset character or not; and

and if the first character of the file entry is a preset character, judging that a deletion mark exists in the file entry.

3. The method of claim 1, wherein the step of determining the presumed end cluster number of the deleted file based on the file size and the presumed start cluster number comprises:

calculating the cluster crossing amount of the deleted file according to the file size and the unit size of the cluster; and

and determining the assumed end cluster number of the deleted file according to the assumed start cluster number and the cluster spanning amount.

4. The file recovery method according to claim 1, wherein said step of reconstructing the assumed start cluster number of the deleted file according to a preset rule comprises:

adding one to the initial high cluster number in the assumed initial cluster number;

constructing the initial high cluster number and the initial low cluster number after the one adding treatment to generate a new assumed initial cluster number; and

taking the new hypothetical start cluster number as the hypothetical start cluster number.

5. A file recovery apparatus, comprising:

a cluster number determination unit, configured to determine whether an end cluster corresponding to the assumed end cluster number meets a preset condition, where the preset condition is that, if the assumed end cluster number is a real end cluster number, content related to file end exists in the end cluster corresponding to the assumed end cluster number, and the content related to file end includes a file end feature and a file end character;

a returning unit, configured to, if an end cluster corresponding to the assumed end cluster number does not satisfy a preset condition, reconstruct an assumed start cluster number of the deleted file according to a preset rule, and return to the step of determining whether the assumed start cluster number exceeds a maximum cluster number range of disk management;

a starting feature judging unit, configured to judge whether the deleted file has a starting feature according to a file name or the assumed starting cluster number, where the starting feature includes an extension in the file name and a starting cluster number similar to the assumed starting cluster number in disk management;

an ending feature determining unit, configured to determine a file type according to the starting feature if the deleted file has the starting feature, and determine whether the deleted file has an ending feature according to the determined file type, where the ending feature is a character string that exists in a file directory entry corresponding to the assumed ending cluster number and serves as an ending flag;

an end cluster content determining unit, configured to determine whether an end cluster corresponding to the assumed end cluster number includes an end feature if the deleted file has the end feature;

a first determining unit, configured to determine that an end cluster satisfies a preset condition if the end cluster corresponding to the assumed end cluster number includes the end feature;

an end cluster structure determining unit, configured to determine whether all end clusters corresponding to the assumed end cluster number are empty if the deleted file does not have a start feature or an end feature;

an end cluster character determination unit, configured to determine whether all contents after the end character of the deleted file in the end cluster are empty if the end cluster is not empty; and

and the second judging unit is used for judging that the end cluster meets a preset condition if all the contents behind the end character in the end cluster are empty.

6. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the file recovery method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, causes the processor to execute the file recovery method according to any one of claims 1 to 4.