CN110659162A - Data recovery method, device and system of TPSFS file system and storage medium - Google Patents
Data recovery method, device and system of TPSFS file system and storage medium Download PDFInfo
- Publication number
- CN110659162A CN110659162A CN201910932367.XA CN201910932367A CN110659162A CN 110659162 A CN110659162 A CN 110659162A CN 201910932367 A CN201910932367 A CN 201910932367A CN 110659162 A CN110659162 A CN 110659162A
- Authority
- CN
- China
- Prior art keywords
- node
- data
- file
- tpsfs
- file system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1446—Point-in-time backing up or restoration of persistent data
- G06F11/1448—Management of the data involved in backup or backup restore
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- Human Computer Interaction (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention provides a data recovery method, a device, a system and a storage medium of a TPSFS file system, which are used for acquiring log data of the TPSFS file system; obtaining a sector interval list set based on the log data; acquiring and analyzing historical node information according to the sector interval list set; filtering the historical node information to obtain deleted node information; and constructing a file structure based on the deleted node information for data recovery. According to the method, the device, the system and the storage medium, the directory structure of the file system is reconstructed and recovered by extracting the historical node information recorded in the log block of the file system, so that the deleted file is recovered, the complete recovery of the deleted data is realized, and the evidence obtaining safety of the computer data is greatly improved.
Description
Technical Field
The invention relates to the technical field of data processing, in particular to a TPSFS file system recovery process.
Background
The TPSFS file system is a power-fail safety file system, supports power-fail safety of EB level file length, is widely applied to embedded equipment, and is mainly applied to the fields of vehicle-mounted rail transit, new energy and the like. With the development and popularization of the current internet of things technology, the TPSFS file system is taken as a SylixOS built-in file system, and the file deletion recovery technology of the TPSFS file system is also emphasized in the fields of intelligent device security and the like. However, the data recovery technology based on the TPSFS file system is less researched at present, and the data recovery of deleted files cannot be well realized, so that the data forensics security of the computer is adversely affected.
Therefore, the TPSFS file system in the prior art has the problem that the data cannot be restored or the restoration effect is not good after the data is deleted, and cannot meet the requirement of the evidence obtaining safety of the computer data.
Disclosure of Invention
The present invention has been made in view of the above problems. The invention provides a TPSFS file system recovery method, a TPSFS file system recovery device, a TPSFS file system recovery system and a computer storage medium, which aim to solve the problems that the TPSFS file system cannot be recovered or the recovery effect is poor after data deletion.
According to a first aspect of the present invention, there is provided a data recovery method for a TPSFS file system, comprising:
acquiring log data of the TPSFS file system;
obtaining a sector interval list set based on the log data;
acquiring and analyzing historical node information according to the sector interval list set;
filtering the historical node information to obtain deleted node information;
and constructing a file structure based on the deleted node information for data recovery.
According to a second aspect of the present invention, there is provided a data recovery apparatus of a TPSFS file system, comprising:
the acquisition module is used for acquiring the log data of the TPSFS file system;
the list module is used for obtaining a sector interval list set based on the log data;
the analysis module is used for acquiring and analyzing historical node information according to the sector interval list set;
the filtering module is used for filtering the historical node information to obtain deleted node information;
and the recovery module is used for constructing a file structure based on the deleted node information so as to recover data.
According to a third aspect of the present invention, there is provided a data recovery system of a TPSFS file system, comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the processor implements the steps of the method of the first aspect when executing the computer program.
According to a fourth aspect of the present invention, there is provided a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a computer, implements the steps of the method of the first aspect.
According to the data recovery method, device and system of the TPSFS file system and the computer storage medium, the characteristic that the TPSFS file system uses a transaction submission mechanism is utilized, the directory structure of the file system is reconstructed and recovered by extracting the historical node information recorded in the log block of the file system, and then the deleted file is recovered, so that the complete recovery of the deleted data is realized, and the evidence obtaining safety of the computer data is greatly improved.
Drawings
The above and other objects, features and advantages of the present invention will become more apparent by describing in more detail embodiments of the present invention with reference to the attached drawings. The accompanying drawings are included to provide a further understanding of the embodiments of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention. In the drawings, like reference numbers generally represent like parts or steps.
FIG. 1 is an example of a TPSFS file system;
FIG. 2 is an example of nodes in a TPSFS file system;
FIG. 3 is an example of log data in a TPSFS file system;
FIG. 4 is a schematic flow chart diagram of a TPSFS file system recovery method according to an embodiment of the present invention;
FIG. 5 is an example of a TPSFS file system recovery method according to an embodiment of the present invention;
fig. 6 is a schematic block diagram of a TPSFS file system recovery apparatus according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, exemplary embodiments according to the present invention will be described in detail below with reference to the accompanying drawings. It is to be understood that the described embodiments are merely a subset of embodiments of the invention and not all embodiments of the invention, with the understanding that the invention is not limited to the example embodiments described herein. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the invention described herein without inventive step, shall fall within the scope of protection of the invention.
The TPSFS file system is a B + tree file system based on transactions, and the modification of metadata uses a transaction submission mechanism to ensure the consistency of the file system; and the B + tree is used for managing the disk space and the file space, so that the file data storage and positioning speed is higher, and the space management efficiency is higher.
Referring to fig. 1, fig. 1 illustrates an example of a TPSFS file system. As shown in fig. 1, a disk structure of a TPSFS file system includes: the system comprises a superblock, a space management Inode block, a root directory Inode block, a B + tree buffer table, a data block and a log block. The superblock is used to describe basic information of a file system, such as the block size of the file system, the total number of blocks, the overall layout of the file system in the disk partition (such as the location and size of a data area, a log area, etc.), an opened file chain table, and the like. The TPSFS file system stores the super blocks in the 0 th block of each disk partition, and each disk partition is only provided with one super block structure body.
Referring to fig. 2, fig. 2 illustrates an example of nodes in a TPSFS file system. The TPSFS file system employs B + tree management, so the related index employed by it is mainly composed of three kinds as shown in fig. 2. As shown in fig. 2, the INODE in the TPSFS file system mainly consists of Magic, version number, physical block number of the node, file length, attribute block length, time information, and the like; the BTREE _ NODE mainly comprises a Magic, a NODE type, an item number, a maximum operating item number, a physical block number to which the NODE belongs, a next block area list and the like; FILE/DIR _ NODE mainly records the FILE directory name or FILE name and the physical block number of the NODE-related INODE.
Referring to fig. 3, fig. 3 illustrates an example of log data in a TPSFS file system. As shown in FIG. 3, the structure of the log block, which consists essentially of a commit transaction data block and a data block that records the history node. The mark of the node transaction commit status mainly includes a series of magics, sequence numbers, transaction types, sector numbers (dataseccnum) pointing to history node records, and the like, and the data block recording the history nodes mainly includes a series of history node records (as shown in fig. 2) including deleted and non-deleted, and a sector interval list, wherein the sector interval list records information such as the interval sizes of the data blocks recorded by the history nodes and the offset positions of the data blocks in the intervals.
Next, a data recovery method 4 of the TPSFS file system according to an embodiment of the present invention will be described with reference to fig. 4. As shown in fig. 4, a data recovery method 4 of a TPSFS file system includes:
step S4-1, acquiring the log data of the TPSFS file system;
step S4-2, obtaining a sector interval list set based on the log data;
step S4-3, obtaining and analyzing historical node information according to the sector interval list set;
step S4-4, filtering the historical node information to obtain deleted node information;
and step S4-5, constructing a file structure based on the deleted node information for data recovery.
Wherein, a series of historical node records including deletion and non-deletion can be recorded at the tail part of the disk by analyzing the disk structure of the TPSFS file system. The method comprises the steps of obtaining the position of a log area by reading the initial position information of a log data block in a super block, positioning a mark block in a node transaction submitting state of the log area to the tail part of a history node record, then scanning and extracting history node information by combining a sector interval list, finally filtering the information of a deleted node to reconstruct a directory structure, and finally achieving the purpose of deletion and recovery. The method and the device have the advantages that the deleted data can be quickly and effectively recovered, the defect that the deleted data of the TPSFS file system cannot be recovered is overcome, the evidence obtaining safety of the computer data is greatly improved, the method and the device are suitable for being widely applied to occasions needing the data recovery of the TPSFS file system, the data recovery is quick and effective, and a large amount of time and labor cost are saved.
Alternatively, the data recovery method of the TPSFS file system according to an embodiment of the present invention may be implemented in a device, an apparatus, or a system having a memory and a processor.
According to the data recovery method of the TPSFS file system, the directory structure of the file system is reconstructed and recovered by extracting the historical node information recorded in the log block of the file system, so that the deleted file is recovered, the complete recovery of the deleted data is realized, and the evidence obtaining safety of the computer data is greatly improved.
According to an embodiment of the present invention, in step S4-1, the acquiring log data of the TPSFS file system may further include:
acquiring data of a middle super block of the TPSFS file system to acquire initial position information of the log data;
and acquiring the log data according to the initial position information of the log data.
Optionally, the obtaining of the data of the middle superblock of the TPSFS file system to obtain the start position information of the log data may include: and reading the initial position information of the log data block in the super block to obtain the position of the log data.
Optionally, the obtaining the log data according to the start position information of the log data may include: the data stored in the location of the log data is read.
According to an embodiment of the present invention, in step S4-2, the obtaining a set of sector interval lists based on the log data includes:
and positioning the node transaction submission state marking data based on the log data to the tail of the historical node record data to obtain the sector interval list set.
Where, SCM is assumed to be { M ═ M1，M2，M3，...，MNRepresents a set of sector interval lists of the history node record data, wherein each element MiRepresents a sector interval list, and the structure of each node Mi is roughly divided into: interval start sector, offset of sector data in transaction data, number of sectors.
According to the embodiment of the present invention, in step S4-3, the history node information includes: INDDE NODE information, BTREE _ NODE NODE information, and FILE/DIR _ NODE NODE information.
Optionally, the parsing the INODE node information includes: at least the attribute information of the INODE node, such as the creation, modification, access time and file length of the file or directory, is obtained.
Where, assuming that MIO ═ IO1, IO2, IO3, ION } denotes an INODE set, each element IOi of which represents an INODE node, the structure of each node IOi is roughly: magic, version number, physical block number of the node, file length, attribute block length, time information and the like.
Optionally, the parsing the BTREE _ NODE information includes: at least sector physical location information of the BTREE _ NODE is obtained.
Wherein, suppose BMI ═ { I ═ I1，I2，I3，...，INDenotes a set of BTREE _ NODE, each element I of whichiRepresents a BTREE _ NODE, and the structure of each NODE Ii is roughly divided into: magic, node type, number of entries, maximum number of entries, number of physical blocks to which the node belongs, next block area list and the like.
Optionally, the parsing FILE/DIR _ NODE information includes: at least the FILE directory name or FILE name of the FILE/DIR _ NODE is obtained.
Where, let TDE ═ { E ═ E1，E2，E3，...，ENDenotes the DENT NODE set. Wherein each element EiRepresents a FILE/DIR _ NODE NODE for eachThe structure of each node Ei is as follows: the length of the current file name or directory name, the physical block number of the INODE related to the node, and the file directory name or file name.
According to an embodiment of the present invention, in step S4-4, the filtering the history node information to obtain the deleted node information may include: and selecting the deleted node information in the analyzed historical node information.
It should be noted that the data recovery method of the TPSFS file system according to the embodiment of the present invention is not limited by the construction method for constructing the file structure based on the deleted node information, and the data recovery method of the TPSFS file system according to the embodiment of the present invention can be used in both the existing construction method and the construction method developed in the future, and is not limited herein.
Referring to fig. 5, fig. 5 illustrates an example of a data recovery method of a TPSFS file system according to an embodiment of the present invention. As shown in fig. 5, the data recovery method of the TPSFS file system includes:
firstly, acquiring initial position information of a log data block and a root node physical block number from a super block;
then, positioning to a log data area according to the initial position information of the log data block, positioning to a rearmost sector interval list of the history node record through a node transaction submission state marking block of the log data area, and recording as an SCM; SCM ═ M1，M2，M3，...，MNRepresents a set of sector interval lists of the history node record data, wherein each element MiRepresents a sector interval list, and the structure of each node Mi is roughly divided into: interval starting sector, offset of sector data in transaction data, and sector number;
then, respectively acquiring and analyzing NODE information of an IINODE NODE, a FILE/DIR _ NODE NODE and a BTREE _ NODE NODE according to the SCM and the physical block number of the root NODE; the method specifically comprises the following steps:
acquiring a FILE directory name or a FILE name TDE of a FILE/DIR _ NODE NODE; TDE ═ E1，E2，E3，...，ENDenotes a DENT NODE set, where each element EiRepresents a FILE/DIR _ NODE whose structure for each NODE Ei is: the length of the current file name or directory name, the physical block number of the INODE related to the node, the file directory name or file name;
acquiring attribute information of the IINODE node, such as information of creating, modifying, accessing time, file length and the like of a file or a directory, and recording the attribute information as MIO; MIO ═ IO1, IO2, IO3,., ION } denotes an INODE set, each element IOi of which represents an INODE node, and for each node IOi the structure is roughly divided into: magic, version number, physical block number of the node, file length, attribute block length, time information and the like;
acquiring sector physical position information of a BTREE _ NODE NODE and recording the sector physical position information as BMI; BMI ═ I1，I2，I3，...，INDenotes a set of BTREE _ NODE, each element I of whichiRepresents a BTREE _ NODE, and the structure of each NODE Ii is roughly divided into: magic, node type, number of entries, maximum number of entries, number of physical blocks to which the node belongs, next block area list and the like;
then, judging whether the historical node information in all the log data is analyzed completely, if not, continuing the steps for analysis, and if so, continuing the next step;
then, filtering out deleted node information according to the TDE, the MIO and the CMD;
and finally, constructing a file structure according to the deleted TDE, MIO and BMI information.
Further, experiments were conducted according to the method of an embodiment of the present invention, including: making a mirror image of the TPSFS file system; using formatting software to format a TPSFS file system in WINDOWS environment, adding, deleting and modifying files in the equipment and then exporting mirror images; this mirror image is parsed to this scheme of adoption. Finally, the data recovery method of the TPSFS file system according to the embodiment of the invention can quickly and effectively recover the deleted data. And restoring deleted node information according to the historical node information recorded in the log block by using the characteristics of the power-down safety file of the TPSFS file system so as to achieve the aim of deleting and restoring the data. Meanwhile, the method provided by the embodiment of the invention can be used as a supplement for normal analysis of the TPSFS file system, can recover effective data information, and provides a basis for further data analysis.
Fig. 6 illustrates a schematic block diagram of a data recovery apparatus of a TPSFS file system according to an embodiment of the present invention. Only the main functions of the components of the data recovery apparatus of the TPSFS file system will be described below, and details that have been described above will be omitted. As shown in fig. 6, the data recovery apparatus 6 of the TPSFS file system according to an embodiment of the present invention includes:
the obtaining module 6-1 is used for obtaining the log data of the TPSFS file system;
a list module 6-2, configured to obtain a sector interval list set based on the log data;
the analysis module 6-3 is used for acquiring and analyzing historical node information according to the sector interval list set;
the filtering module 6-4 is used for filtering the historical node information to obtain deleted node information;
and the recovery module 6-5 is used for constructing a file structure based on the deleted node information so as to recover data.
Wherein, a series of historical node records including deletion and non-deletion can be recorded at the tail part of the disk by analyzing the disk structure of the TPSFS file system. The method comprises the steps of obtaining the position of a log area by reading the initial position information of a log data block in a super block, positioning a mark block in a node transaction submitting state of the log area to the tail part of a history node record, then scanning and extracting history node information by combining a sector interval list, finally filtering the information of a deleted node to reconstruct a directory structure, and finally achieving the purpose of deletion and recovery. The method and the device have the advantages that the deleted data can be quickly and effectively recovered, the defect that the deleted data of the TPSFS file system cannot be recovered is overcome, the evidence obtaining safety of the computer data is greatly improved, the method and the device are suitable for being widely applied to occasions needing the data recovery of the TPSFS file system, the data recovery is quick and effective, and a large amount of time and labor cost are saved.
Therefore, according to the data recovery device of the TPSFS file system, the directory structure of the file system is reconstructed and recovered by extracting the historical node information recorded in the log block of the file system, so that the deleted file is recovered, the complete recovery of the deleted data is realized, and the evidence obtaining safety of the computer data is greatly improved.
On the other hand, the data recovery system of the TPSFS file system according to the embodiment of the present invention includes: a storage device and a processor; the storage device stores program codes for implementing respective steps in the data recovery method of the TPSFS file system according to the embodiment of the present invention; the processor is used for operating the program codes stored in the storage device to execute the corresponding steps of the TPSFS file system recovery method according to the embodiment of the invention, and is used for realizing the data recovery device of the TPSFS file system according to the embodiment of the invention.
Further, according to an embodiment of the present invention, there is also provided a storage medium on which program instructions are stored, which when executed by a computer or a processor, are configured to perform the corresponding steps of the TPSFS file system recovery method according to an embodiment of the present invention, and to implement the corresponding modules in the TPSFS file system recovery apparatus according to an embodiment of the present invention. The storage medium may include, for example, a memory card of a smart phone, a storage component of a tablet computer, a hard disk of a personal computer, a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM), a portable compact disc read only memory (CD-ROM), a USB memory, or any combination of the above storage media. The computer readable storage medium may be any combination of one or more computer readable storage media, e.g., one containing computer readable program code for randomly generating a sequence of action instructions and another containing computer readable program code for performing TPSFS file system recovery.
In one embodiment, the computer program instructions may implement, when executed by a computer, various functional modules of a data recovery apparatus of a TPSFS file system according to an embodiment of the present invention, and/or may perform a data recovery method of a TPSFS file system according to an embodiment of the present invention.
The modules in the data recovery system of the TPSFS file system according to the embodiment of the present invention may be implemented by a processor of an electronic device for data recovery of the TPSFS file system according to the embodiment of the present invention running computer program instructions stored in a memory, or may be implemented when computer instructions stored in a computer-readable storage medium of a computer program product according to the embodiment of the present invention are run by a computer.
According to the data recovery method, device, system and storage medium of the TPSFS file system, the directory structure of the file system is reconstructed and recovered by extracting the historical node information recorded in the log block of the file system, so that the deleted file is recovered, the complete recovery of the deleted data is realized, and the evidence obtaining safety of the computer data is greatly improved.
Although the illustrative embodiments have been described herein with reference to the accompanying drawings, it is to be understood that the foregoing illustrative embodiments are merely exemplary and are not intended to limit the scope of the invention thereto. Various changes and modifications may be effected therein by one of ordinary skill in the pertinent art without departing from the scope or spirit of the present invention. All such changes and modifications are intended to be included within the scope of the present invention as set forth in the appended claims.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
It should be understood that the method and apparatus disclosed in the embodiments of the present invention can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical functional division, and there may be other divisions when actually implementing, for example, a plurality of units or components may be combined or integrated into another device, or some features may be omitted, or not implemented.
The above description is only for the specific embodiment of the present invention or the description thereof, and the protection scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and the changes or substitutions should be covered within the protection scope of the present invention. The protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (10)
1. A data recovery method of a TPSFS file system is characterized by comprising the following steps:
acquiring log data of the TPSFS file system;
obtaining a sector interval list set based on the log data;
acquiring and analyzing historical node information according to the sector interval list set;
filtering the historical node information to obtain deleted node information;
and constructing a file structure based on the deleted node information for data recovery.
2. The method of claim 1, wherein the historical node information comprises: INDDE NODE information, BTREE _ NODE NODE information, and FILE/DIR _ NODE NODE information.
3. The method of claim 2, wherein the parsing INODE node information comprises: at least the attribute information of the INODE node, such as the creation, modification, access time and file length of the file or directory, is obtained.
4. The method of claim 2, wherein the parsing the BTREE _ NODE information comprises: at least sector physical location information of the BTREE _ NODE is obtained.
5. The method of claim 2, wherein parsing FILE/DIR _ NODE information comprises: at least the FILE directory name or FILE name of the FILE/DIR _ NODE is obtained.
6. The method of claim 1, wherein the deriving a set of sector interval lists based on the log data comprises:
and positioning the node transaction submission state marking data based on the log data to the tail of the historical node record data to obtain the sector interval list set.
7. The method of claim 1, wherein the obtaining log data for the TPSFS file system comprises:
acquiring data of a middle super block of the TPSFS file system to acquire initial position information of the log data;
and acquiring the log data according to the initial position information of the log data.
8. A data recovery apparatus of a TPSFS file system, the apparatus comprising:
the acquisition module is used for acquiring the log data of the TPSFS file system;
the list module is used for obtaining a sector interval list set based on the log data;
the analysis module is used for acquiring and analyzing historical node information according to the sector interval list set;
the filtering module is used for filtering the historical node information to obtain deleted node information;
and the recovery module is used for constructing a file structure based on the deleted node information so as to recover data.
9. A data recovery system for a TPSFS file system comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the steps of the method of any one of claims 1 to 7 are implemented when the computer program is executed by the processor.
10. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a computer, implements the steps of the method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910932367.XA CN110659162B (en) | 2019-09-27 | 2019-09-27 | Data recovery method, device and system of TPSFS file system and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910932367.XA CN110659162B (en) | 2019-09-27 | 2019-09-27 | Data recovery method, device and system of TPSFS file system and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110659162A true CN110659162A (en) | 2020-01-07 |
| CN110659162B CN110659162B (en) | 2022-10-25 |
Family
ID=69039823
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910932367.XA Active CN110659162B (en) | 2019-09-27 | 2019-09-27 | Data recovery method, device and system of TPSFS file system and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110659162B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111694989A (en) * | 2020-06-09 | 2020-09-22 | 中国民用航空飞行学院 | Analysis method and equipment for AE300 aeroengine data log file |
| CN112380174A (en) * | 2020-12-01 | 2021-02-19 | 厦门市美亚柏科信息股份有限公司 | XFS file system analysis method containing deleted files, terminal equipment and storage medium |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1524221A (en) * | 2001-07-06 | 2004-08-25 | ���������˼�빫˾ | Systems and methods of information backup |
| US20050071336A1 (en) * | 2003-09-30 | 2005-03-31 | Microsoft Corporation | Systems and methods for logging and recovering updates to data structures |
| US20060271809A1 (en) * | 2005-05-31 | 2006-11-30 | Hitachi Global Storage Technologies Netherlands B.V. | Data storage device and error recovery method |
| US20070174682A1 (en) * | 2006-01-17 | 2007-07-26 | Allen King | Apparatus, system, and method for a storage device's enforcing write recovery of erroneous data |
| CN101743546A (en) * | 2007-08-06 | 2010-06-16 | 国际商业机器公司 | Hierarchical storage management for a file system providing snapshots |
| CN102289526A (en) * | 2011-09-29 | 2011-12-21 | 深圳市万兴软件有限公司 | HFS+file system data recovery method and device |
| CN102289524A (en) * | 2011-09-26 | 2011-12-21 | 深圳市万兴软件有限公司 | Data recovery method and system |
| CN104199750A (en) * | 2014-08-26 | 2014-12-10 | 上海天脉聚源文化传媒有限公司 | File recovery method and device of linux system |
| CN105204959A (en) * | 2015-08-28 | 2015-12-30 | 小米科技有限责任公司 | Method and device for restoring deleted files in ext file system |
| CN106126555A (en) * | 2016-06-16 | 2016-11-16 | 北京翼辉信息技术有限公司 | A kind of file management method and file system |
| US20170139950A1 (en) * | 2014-05-30 | 2017-05-18 | Datto, Inc. | Management of data replication and storage apparatuses, methods and systems |
-
2019
- 2019-09-27 CN CN201910932367.XA patent/CN110659162B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1524221A (en) * | 2001-07-06 | 2004-08-25 | ���������˼�빫˾ | Systems and methods of information backup |
| US20050071336A1 (en) * | 2003-09-30 | 2005-03-31 | Microsoft Corporation | Systems and methods for logging and recovering updates to data structures |
| US20060271809A1 (en) * | 2005-05-31 | 2006-11-30 | Hitachi Global Storage Technologies Netherlands B.V. | Data storage device and error recovery method |
| US20070174682A1 (en) * | 2006-01-17 | 2007-07-26 | Allen King | Apparatus, system, and method for a storage device's enforcing write recovery of erroneous data |
| CN101743546A (en) * | 2007-08-06 | 2010-06-16 | 国际商业机器公司 | Hierarchical storage management for a file system providing snapshots |
| CN102289524A (en) * | 2011-09-26 | 2011-12-21 | 深圳市万兴软件有限公司 | Data recovery method and system |
| CN102289526A (en) * | 2011-09-29 | 2011-12-21 | 深圳市万兴软件有限公司 | HFS+file system data recovery method and device |
| US20170139950A1 (en) * | 2014-05-30 | 2017-05-18 | Datto, Inc. | Management of data replication and storage apparatuses, methods and systems |
| CN104199750A (en) * | 2014-08-26 | 2014-12-10 | 上海天脉聚源文化传媒有限公司 | File recovery method and device of linux system |
| CN105204959A (en) * | 2015-08-28 | 2015-12-30 | 小米科技有限责任公司 | Method and device for restoring deleted files in ext file system |
| CN106126555A (en) * | 2016-06-16 | 2016-11-16 | 北京翼辉信息技术有限公司 | A kind of file management method and file system |
Non-Patent Citations (2)
| Title |
|---|
| CHAO WANG等: "On-the-Fly Recovery of Job Input Data in Supercomputers", 《2008 37TH INTERNATIONAL CONFERENCE ON PARALLEL PROCESSING》 * |
| 丁云冰等: "Android智能终端中基于日志的文件恢复方法", 《长春工程学院学报(自然科学版)》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111694989A (en) * | 2020-06-09 | 2020-09-22 | 中国民用航空飞行学院 | Analysis method and equipment for AE300 aeroengine data log file |
| CN111694989B (en) * | 2020-06-09 | 2023-03-10 | 中国民用航空飞行学院 | Analysis method and equipment for AE300 aeroengine data log file |
| CN112380174A (en) * | 2020-12-01 | 2021-02-19 | 厦门市美亚柏科信息股份有限公司 | XFS file system analysis method containing deleted files, terminal equipment and storage medium |
| CN112380174B (en) * | 2020-12-01 | 2022-07-15 | 厦门市美亚柏科信息股份有限公司 | XFS file system analysis method containing deleted files, terminal device and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110659162B (en) | 2022-10-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9703640B2 (en) | Method and system of performing incremental SQL server database backups | |
| Garfinkel | Digital forensics research: The next 10 years | |
| CN103955530B (en) | Data reconstruction and optimization method of on-line repeating data deletion system | |
| Walls et al. | Forensic Triage for Mobile Phones with {DEC0DE} | |
| CN102609337A (en) | Rapid data recovery method for memory database | |
| CN110659162B (en) | Data recovery method, device and system of TPSFS file system and storage medium | |
| KR101484882B1 (en) | Forensic data recovery method and system | |
| CN103019891A (en) | Method and system for restoring deleted file | |
| Yang et al. | A security carving approach for AVI video based on frame size and index | |
| CN103177022A (en) | Method and device of malicious file search | |
| CN111008183B (en) | Storage method and system for business wind control log data | |
| CN102567472B (en) | Built-in database based high-efficient data deleting and restoring method | |
| Hilgert et al. | Extending The Sleuth Kit and its underlying model for pooled storage file system forensic analysis | |
| Shi et al. | A novel file carving algorithm for National Marine Electronics Association (NMEA) logs in GPS forensics | |
| CN109254827B (en) | Virtual machine safety protection method and system based on big data and machine learning | |
| Zhang et al. | Recovering SQLite data from fragmented flash pages | |
| CN111382126A (en) | System and method for deleting files and hindering file recovery | |
| Oh et al. | Forensic recovery of file system metadata for digital forensic investigation | |
| CN111176901B (en) | HDFS deleted file recovery method, terminal device and storage medium | |
| Billard et al. | Making sense of unstructured flash-memory dumps | |
| Yadav et al. | Analysis of digital forensic tools and investigation process | |
| Soltani et al. | Developing software signature search engines using paragraph vector model: a triage approach for digital forensics | |
| Sansurooah | A forensics overview and analysis of USB flash memory devices | |
| CN107526548B (en) | Multi-namespace solid state disk and data deleting method and device | |
| CN106126555A (en) | A kind of file management method and file system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |