CN112650725A - Method for recovering DM8 database log file - Google Patents

Method for recovering DM8 database log file Download PDF

Info

Publication number
CN112650725A
CN112650725A CN202011603260.XA CN202011603260A CN112650725A CN 112650725 A CN112650725 A CN 112650725A CN 202011603260 A CN202011603260 A CN 202011603260A CN 112650725 A CN112650725 A CN 112650725A
Authority
CN
China
Prior art keywords
log
record
executing
data
current
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202011603260.XA
Other languages
Chinese (zh)
Inventor
梁效宁
许超明
张强
刘涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xly Salvationdata Technology Inc
Original Assignee
Xly Salvationdata Technology Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xly Salvationdata Technology Inc filed Critical Xly Salvationdata Technology Inc
Priority to CN202011603260.XA priority Critical patent/CN112650725A/en
Publication of CN112650725A publication Critical patent/CN112650725A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types
    • G06F16/1805—Append-only file systems, e.g. using logs or journals to store data
    • G06F16/1815—Journaling file systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/14—Details of searching files based on file metadata
    • G06F16/148—File search processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Library & Information Science (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The invention discloses a method for recovering a DM8 database log file, which is characterized by comprising the following steps: s000: loading a DM8 database file or a DM8 database mirror image file, and reading the first sector data; s100: searching the identification of the log record head of the next DM8 database, if so, executing S200, otherwise, ending the process; s200: judging whether the record type is local, if so, executing the step S300, otherwise, executing the step S100; s300: judging whether the operation code is any one of an inserting operation, a deleting operation and an updating operation, if so, executing a step S400, otherwise, executing a step S100; s400: acquiring the byte length of the current log record; s500: acquiring the record data of the current log; s600: according to the operation code, performing data extraction on the insertion operation, the deletion operation and the updating operation by adopting a corresponding log record format; s700: whether the scanning of the database file or the database mirror image file is finished, if so, the process is ended, otherwise, the step S100 is executed.

Description

Method for recovering DM8 database log file
Technical Field
The invention belongs to the field of electronic forensics and data recovery, and relates to a method for recovering a DM8 database log file.
Background
The DM8 database is an excellent product in the database. The DM8 database is used in many important industries and departments, such as the power grid, government agencies, etc. In the DM8 database, all user actions are written into the log file, so the log file is a very important aspect for electronic forensics and data recovery.
In the prior art, the analysis of the DM8 database log file is based on the complete log file and structure, and needs to be processed depending on the environment of the DM8 database. In the case of a log file being corrupted or deleted, there is no method in the prior art to recover the DM8 database log file.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides a method for recovering a DM8 database log file, which can extract effective operation information of a user and recover a DM8 database log file by analyzing log records of local types, thereby providing an effective evidence for judging user behaviors and identifying data results. The invention comprises the following steps:
s000: loading a DM8 database file or a DM8 database mirror image file, and reading the data of a first sector, wherein the byte length of the sector is 0x 200;
s100: searching the identification of the log record head of the next DM8 database, if so, executing S200, otherwise, ending the process;
s200: taking the identified address as a starting address, shifting 44 bytes forward and reading the content of 1 byte as a record type, judging whether the record type is local, if so, executing a step S300, otherwise, executing a step S100;
s300: using the identified address as a starting address, shifting forward by 38 bytes and reading the content of continuous 2 bytes as an operation code, and judging whether the operation code is any one of an inserting operation, a deleting operation and an updating operation, if so, executing a step S400, otherwise, executing a step S100;
s400: using the identified address as a starting address, shifting 42 bytes forward and reading the content of continuous 4 bytes as the byte length of the current log record;
s500: using the identified address as a starting address, shifting forward by 44 bytes and reading the content of the current log record with the byte length of +2 bytes as the record data of the current log;
s600: according to the operation code, performing data extraction on the insertion operation by adopting an insertion log record format; for deletion operation, data extraction is carried out by adopting a deletion log record format; for the updating operation, data extraction is carried out by adopting an updating log record format;
s700: and judging whether the scanning of the DM8 database file or the DM8 database image file is finished, if so, ending the flow, otherwise, executing the step S100.
Preferably, the step S100 includes the steps of:
s101: initial addressing of the current sector: taking the first byte address of the current sector as an initial address;
s102: reading the content of the continuous 4 bytes and comparing the content with the identification of the log recording head, if the content is equal to the identification of the log recording head, executing the step S200, otherwise executing the step S103, wherein the identification of the log recording head is flag, and the value of the flag is 0x0133EF 57;
s103: the current address is the current address +1,
s104: judging whether the current sector is searched, if so, executing a step S105, otherwise, executing a step S102;
s105: judging whether the DM8 database file or the DM8 database mirror image file is searched, if so, ending the process, otherwise, executing the step S106;
s106: the next sector is addressed and step S101 is performed.
Preferably, the step S200 includes the steps of: according to the data structure of the local log record header of the following table 1, with the address 0x2C of the identification of the log record header as the starting address, shifting forward by 44 bytes and reading the content of 1 byte as the record type, judging whether the record type is local, if so, executing step S300, otherwise, executing step S100, wherein, for the log record with the type of local, the byte is 0x0 f.
Table 1: data structure of local log recording head
Offset Size Contents
00H 1 Log record format, with a type of local log record, having a value of 0x0f
01H 1 Log version, fixed value 0x04
02H 4 The total byte length of this log record, including the field itself
06H 2 Operation code of Logical record, 0 represents insertion operation, 1 represents deletion operation, and 2 represents update operation
08H 8 Current transaction id
10H 4 Record set id
14H 12 Transaction start time
20H 4 Record the segment id to which it belongs
24H 4 Record the affiliated table id
28H 4 Record affiliated user id
2CH 4 flag, fixed to 0x0133EF57
30H 4 Padding bit, default 0
Preferably, in step S500, the byte length of the current log record does not include the log record format and the log version in table 1.
Preferably, the step S600 includes the steps of:
s601, if the operation code is 0, performing an inserting operation, wherein the current record is in an inserting log record format and records data inserted by a user, and extracting the inserted data according to a data structure of an inserting log record shown in the following table 2:
table 2: data structure for inserting log records
Figure BDA0002871952750000031
S602: if the operation code is 1, the operation is a delete operation, the current record is in a delete log record format and records data deleted by the user, and the deleted data is extracted according to the data structure of delete log record shown in the following table 3:
table 3: data structure for deleting log records
Figure BDA0002871952750000041
S603: if the operation code is 2, the operation is an updating operation, the current record is in an updating log record format and records the data updated by the user, and the updated data is extracted according to the data structure of the updating log record shown in the following table 4;
table 4: data structure for updating log records
Figure BDA0002871952750000042
S604: according to the data extracted in step S603, the data is parsed using the field type and type code mapping relationship of table 5 below.
Table 5: mapping relation between field type and type code
Serial number Name of type Type coding Length of Whether it is longer
1 char/charACTER 1 - Is that
2 VARchar/VARchar2/BFILE 2 - Is that
3 NUMERIC/DECIMAL/NUMBER/DEC 9 34 Whether or not
4 BIT 3 10 Whether or not
5 INTEGER/INT 7 10 Whether or not
6 BIGINT 8 14 Whether or not
7 TINYINT/BYTE 5 10 Whether or not
8 SMALLINT 6 10 Whether or not
9 BINARY 17 - Is that
10 VARBINARY 18 - Is that
11 FLOAT/DOUBLE/DOUBLE PRECIS 11 14 Whether or not
12 REAL 10 10 Whether or not
13 DATE 14 18 Whether or not
14 TIME 15 18 Whether or not
15 TIMESTAMP/DATETIME 16 18 Whether or not
16 TIME WITH TIME ZONE 22 18 Whether or not
17 DATETIME WITH TIME ZONE 23 18 Whether or not
18 TEXT/LONGVARchar/CLOB 19 - Is that
19 IMAGE/LONGVARBINARY/BLOB 12 - Is that
20 INTERVAL YEAR 20(0) 18 Whether or not
21 INTERVAL YEAR TO MONTH 20(1) 18 Whether or not
22 INTERVAL MONTH 20(2) 18 Whether or not
23 INTERVAL DAY 21(3) 30 Whether or not
24 INTERVAL DAY TO HOUR 21(4) 30 Whether or not
25 INTERVAL DAY TO MINUTE 21(5) 30 Whether or not
26 INTERVAL DAY TO SECOND 21(6) 30 Whether or not
27 INTERVAL HOUR 21(7) 30 Whether or not
28 INTERVAL HOUR TO MINUTE 21(8) 30 Whether or not
29 INTERVAL HOUR TO SECOND 21(9) 30 Whether or not
30 INTERVAL MINUTE 21(10) 30 Whether or not
31 INTERVAL MINUTE TO SECOND 21(11) 30 Whether or not
32 INTERVAL SECOND 21(12) 30 Whether or not
The invention has the beneficial effect of solving the technical problem that no method for recovering the DM8 database log file exists in the prior art.
Drawings
FIG. 1 is a general flow diagram of the method provided by the present invention;
fig. 2 is a specific flowchart of the method provided by the present invention for finding the identity of the logging header of the DM8 database.
Detailed Description
Fig. 1 shows a general flow chart of the method provided by the present invention. As shown in fig. 1, the method comprises the following steps:
s000: loading a DM8 database file or a DM8 database mirror image file, and reading the data of a first sector, wherein the byte length of the sector is 0x 200;
s100: searching the identification of the log record head of the next DM8 database, if so, executing S200, otherwise, ending the process;
fig. 2 shows a specific flowchart of looking up the identification of the logging header of the DM8 database in the method provided by the present invention. As shown in fig. 1, step S100 includes the steps of:
s101: initial addressing of the current sector: taking the first byte address of the current sector as an initial address;
s102: reading the content of the continuous 4 bytes and comparing the content with the identification of the log recording head, if the content is equal to the identification of the log recording head, executing the step S200, otherwise executing the step S103, wherein the identification of the log recording head is flag, and the value of the flag is 0x0133EF 57;
s103: the current address is the current address +1,
s104: judging whether the current sector is searched, if so, executing a step S105, otherwise, executing a step S102;
s105: judging whether the DM8 database file or the DM8 database mirror image file is searched, if so, ending the process, otherwise, executing the step S106;
s106: the next sector is addressed and step S101 is performed.
S200: and with the identified address as a starting address, shifting forward by 44 bytes and reading the content of 1 byte as a record type, judging whether the record type is local, if so, executing the step S300, otherwise, executing the step S100.
There are 15 types of logging in the DM8 database, and there is only a local logging type of logging related to user behavior, and the local logging type has the same data structure of logging header.
Step S200 includes the steps of: according to the data structure of the local log record header of the following table 1, with address 0x2C of the identification of the log record header as the starting address, shifting forward by 44 bytes and reading the content of 1 byte as the record type, judging whether the record type is local, if so, executing step S300, otherwise, executing step S100, wherein, for the log record with the type of local, the byte is 0x0 f.
Table 1: data structure of local log recording head
Offset Size Contents
00H 1 Log record format, with a type of local log record, having a value of 0x0f
01H 1 Log version, fixed value 0x04
02H 4 The total byte length of this log record, including the field itself
06H 2 Operation code of Logical record, 0 represents insertion operation, 1 represents deletion operation, and 2 represents update operation
08H 8 Current affairsService id
10H 4 Record set id
14H 12 Transaction start time
20H 4 Record the segment id to which it belongs
24H 4 Record the affiliated table id
28H 4 Record affiliated user id
2CH 4 flag, fixed to 0x0133EF57
30H 4 Padding bit, default 0
S300: using the identified address as a starting address, shifting forward by 38 bytes and reading the content of continuous 2 bytes as an operation code, and judging whether the operation code is any one of an inserting operation, a deleting operation and an updating operation, if so, executing a step S400, otherwise, executing a step S100; the operation code of the insert operation is 0, the operation code of the delete operation is 1, and the operation code of the update operation is 2.
S400: using the identified address as a starting address, shifting 42 bytes forward and reading the content of continuous 4 bytes as the byte length of the current log record;
s500: shifting forward by 44 bytes by taking the identified address as a starting address, and reading the content of the current log record with the byte length of +2 bytes as the record data of the current log;
it should be noted that the byte length of the current log record is calculated from the byte length of the current log record itself, and does not include the log record format and log version in table 1, so that 2 bytes are required to be added when taking the complete record.
S600: according to the operation code, performing data extraction on the insertion operation by adopting an insertion log record format; for deletion operation, data extraction is carried out by adopting a deletion log record format; for the updating operation, data extraction is carried out by adopting an updating log record format;
step S600 includes the following steps:
s601, if the operation code is 0, performing an inserting operation, wherein the current record is in an inserting log record format and records data inserted by a user, and extracting the inserted data according to a data structure of an inserting log record shown in the following table 2:
table 2: data structure for inserting log records
Figure BDA0002871952750000081
S602: if the operation code is 1, the operation is a delete operation, the current record is in a delete log record format and records data deleted by the user, and the deleted data is extracted according to the data structure of delete log record shown in the following table 3:
table 3: data structure for deleting log records
Figure BDA0002871952750000082
S603: if the operation code is 2, the operation is an updating operation, the current record is in an updating log record format and records the data updated by the user, and the updated data is extracted according to the data structure of the updating log record shown in the following table 4;
table 4: data structure for updating log records
Figure BDA0002871952750000083
Figure BDA0002871952750000091
S604: according to the data extracted in step S603, the data is parsed using the field type and type code mapping relationship of table 5 below.
Table 5: mapping relation between field type and type code
Serial number Name of type Type coding Length of Whether it is longer
1 char/charACTER 1 - Is that
2 VARchar/VARchar2/BFILE 2 - Is that
3 NUMERIC/DECIMAL/NUMBER/DEC 9 34 Whether or not
4 BIT 3 10 Whether or not
5 INTEGER/INT 7 10 Whether or not
6 BIGINT 8 14 Whether or not
7 TINYINT/BYTE 5 10 Whether or not
8 SMALLINT 6 10 Whether or not
9 BINARY 17 - Is that
10 VARBINARY 18 - Is that
11 FLOAT/DOUBLE/DOUBLE PRECIS 11 14 Whether or not
12 REAL 10 10 Whether or not
13 DATE 14 18 Whether or not
14 TIME 15 18 Whether or not
15 TIMESTAMP/DATETIME 16 18 Whether or not
16 TIME WITH TIME ZONE 22 18 Whether or not
17 DATETIME WITH TIME ZONE 23 18 Whether or not
18 TEXT/LONGVARchar/CLOB 19 - Is that
19 IMAGE/LONGVARBINARY/BLOB 12 - Is that
20 INTERVAL YEAR 20(0) 18 Whether or not
21 INTERVAL YEAR TO MONTH 20(1) 18 Whether or not
22 INTERVAL MONTH 20(2) 18 Whether or not
23 INTERVAL DAY 21(3) 30 Whether or not
24 INTERVAL DAY TO HOUR 21(4) 30 Whether or not
25 INTERVAL DAY TO MINUTE 21(5) 30 Whether or not
26 INTERVAL DAY TO SECOND 21(6) 30 Whether or not
27 INTERVAL HOUR 21(7) 30 Whether or not
28 INTERVAL HOUR TO MINUTE 21(8) 30 Whether or not
29 INTERVAL HOUR TO SECOND 21(9) 30 Whether or not
30 INTERVAL MINUTE 21(10) 30 Whether or not
31 INTERVAL MINUTE TO SECOND 21(11) 30 Whether or not
32 INTERVAL SECOND 21(12) 30 Whether or not
S700: and judging whether the scanning of the DM8 database file or the DM8 database image file is finished, if so, ending the flow, otherwise, executing the step S100.
According to the method provided by the invention, the log file of the DM8 database can be recovered, and the effective operation information of the user can be extracted, so that effective evidences are provided for judging the user behavior and identifying the data result.
It is to be understood that the invention is not limited to the examples described above, but that modifications and variations are possible to those skilled in the art in light of the above teachings, and that all such modifications and variations are intended to be included within the scope of the invention as defined in the appended claims.

Claims (5)

1. A method for recovering a DM8 database log file, comprising the steps of:
s000: loading a DM8 database file or a DM8 database mirror image file, and reading the data of a first sector, wherein the byte length of the sector is 0x 200;
s100: searching the identification of the log record head of the next DM8 database, if so, executing S200, otherwise, ending the process;
s200: taking the identified address as a starting address, shifting 44 bytes forward and reading the content of 1 byte as a record type, judging whether the record type is local, if so, executing a step S300, otherwise, executing a step S100;
s300: using the identified address as a starting address, shifting forward by 38 bytes and reading the content of continuous 2 bytes as an operation code, and judging whether the operation code is any one of an inserting operation, a deleting operation and an updating operation, if so, executing a step S400, otherwise, executing a step S100;
s400: using the identified address as a starting address, shifting 42 bytes forward and reading the content of continuous 4 bytes as the byte length of the current log record;
s500: using the identified address as a starting address, shifting forward by 44 bytes and reading the content of the current log record with the byte length of +2 bytes as the record data of the current log;
s600: according to the operation code, performing data extraction on the insertion operation by adopting an insertion log record format; for deletion operation, data extraction is carried out by adopting a deletion log record format; for the updating operation, data extraction is carried out by adopting an updating log record format;
s700: and judging whether the scanning of the DM8 database file or the DM8 database image file is finished, if so, ending the flow, otherwise, executing the step S100.
2. The method of claim 1, wherein the step S100 comprises the steps of:
s101: initial addressing of the current sector: taking the first byte address of the current sector as an initial address;
s102: reading the content of the continuous 4 bytes and comparing the content with the identification of the log recording head, if the content is equal to the identification of the log recording head, executing the step S200, otherwise executing the step S103, wherein the identification of the log recording head is flag, and the value of the flag is 0x0133EF 57;
s103: the current address is the current address +1,
s104: judging whether the current sector is searched, if so, executing a step S105, otherwise, executing a step S102;
s105: judging whether the DM8 database file or the DM8 database mirror image file is searched, if so, ending the process, otherwise, executing the step S106;
s106: the next sector is addressed and step S101 is performed.
3. The method of claim 1, wherein the step S200 comprises the steps of: according to the data structure of the local log record header of the following table 1, with the address 0x2C of the identification of the log record header as the starting address, shifting forward by 44 bytes and reading the content of 1 byte as the record type, judging whether the record type is local, if so, executing step S300, otherwise, executing step S100, wherein, for the log record with the type of local, the byte is 0x0 f.
Table 1: data structure of local log recording head
Offset Size Contents 00H 1 Log record format, with a type of local log record, having a value of 0x0f 01H 1 Log versionFixed value of 0x04 02H 4 The total byte length of this log record, including the field itself 06H 2 Operation code of Logical record, 0 represents insertion operation, 1 represents deletion operation, and 2 represents update operation 08H 8 Current transaction id 10H 4 Record set id 14H 12 Transaction start time 20H 4 Record the segment id to which it belongs 24H 4 Record the affiliated table id 28H 4 Record affiliated user id 2CH 4 flag, fixed to 0x0133EF57 30H 4 Padding bit, default 0
4. The method as claimed in claim 1, wherein in step S500, the byte length of the current log record does not include the log record format and log version as shown in Table 1.
5. The method of claim 1, wherein the step S600 comprises the steps of:
s601, if the operation code is 0, performing an inserting operation, wherein the current record is in an inserting log record format and records data inserted by a user, and extracting the inserted data according to a data structure of an inserting log record shown in the following table 2:
table 2: data structure for inserting log records
Figure FDA0002871952740000031
S602: if the operation code is 1, the operation is a delete operation, the current record is in a delete log record format and records data deleted by the user, and the deleted data is extracted according to the data structure of delete log record shown in the following table 3:
table 3: data structure for deleting log records
Figure FDA0002871952740000032
S603: if the operation code is 2, the operation is an updating operation, the current record is in an updating log record format and records the data updated by the user, and the updated data is extracted according to the data structure of the updating log record shown in the following table 4;
table 4: data structure for updating log records
Figure FDA0002871952740000041
S604: according to the data extracted in step S603, the data is parsed using the field type and type code mapping relationship of table 5 below.
Table 5: mapping relation between field type and type code
Figure FDA0002871952740000042
Figure FDA0002871952740000051
CN202011603260.XA 2020-12-30 2020-12-30 Method for recovering DM8 database log file Pending CN112650725A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011603260.XA CN112650725A (en) 2020-12-30 2020-12-30 Method for recovering DM8 database log file

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011603260.XA CN112650725A (en) 2020-12-30 2020-12-30 Method for recovering DM8 database log file

Publications (1)

Publication Number Publication Date
CN112650725A true CN112650725A (en) 2021-04-13

Family

ID=75364294

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011603260.XA Pending CN112650725A (en) 2020-12-30 2020-12-30 Method for recovering DM8 database log file

Country Status (1)

Country Link
CN (1) CN112650725A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020007363A1 (en) * 2000-05-25 2002-01-17 Lev Vaitzblit System and method for transaction-selective rollback reconstruction of database objects
CN101122924A (en) * 2007-09-30 2008-02-13 华为技术有限公司 Logic log generation method, database backup/ restoration method and system
CN107122424A (en) * 2017-04-07 2017-09-01 南京南瑞集团公司 A kind of relational database daily record abstracting method
CN109753382A (en) * 2018-12-10 2019-05-14 厦门市美亚柏科信息股份有限公司 A kind of restoration methods and system of database deletion record
CN112052120A (en) * 2020-08-27 2020-12-08 厦门市美亚柏科信息股份有限公司 Database deleted data recovery method and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020007363A1 (en) * 2000-05-25 2002-01-17 Lev Vaitzblit System and method for transaction-selective rollback reconstruction of database objects
CN101122924A (en) * 2007-09-30 2008-02-13 华为技术有限公司 Logic log generation method, database backup/ restoration method and system
CN107122424A (en) * 2017-04-07 2017-09-01 南京南瑞集团公司 A kind of relational database daily record abstracting method
CN109753382A (en) * 2018-12-10 2019-05-14 厦门市美亚柏科信息股份有限公司 A kind of restoration methods and system of database deletion record
CN112052120A (en) * 2020-08-27 2020-12-08 厦门市美亚柏科信息股份有限公司 Database deleted data recovery method and device

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
孙偏偏: "InnoDB数据库数据恢复技术研究", 《信息科技》 *
胡进: "达梦嵌入式数据库恢复机制研究", 《信息科技》 *

Similar Documents

Publication Publication Date Title
CN110879813B (en) Binary log analysis-based MySQL database increment synchronization implementation method
Sanderson et al. Automatic data organization, storage, and analysis of camera trap pictures
Pereira Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records
US20050171965A1 (en) Contents reuse management apparatus and contents reuse support apparatus
JP4806168B2 (en) Identification method and system for identifying changes to be made to a table
CN109753382B (en) Recovery method and system for database deleted records
US6901418B2 (en) Data archive recovery
US20150278023A1 (en) Apparatus and method for recovering data in oracle database
US5895473A (en) System for extracting text from CAD files
CN112395851A (en) Text comparison method and device, computer equipment and readable storage medium
CN110297781B (en) Method for recovering deleted data in APFS (advanced File System) based on copy-on-write
CN112650725A (en) Method for recovering DM8 database log file
CN103942122B (en) A kind of identification AVI types block method
CN115495280A (en) SQLite fuzzy matching-based general deleted data positioning method and device
CN111475464A (en) Method for automatically discovering and mining fingerprints of Web component
Azeem The Data Carving-The Art of Retrieving Deleted Data as Evidence
JP2007179347A (en) Program verification support system
CN113076221B (en) Data recovery method for MongoDB-MMAPv1 engine
CN114546886A (en) Space recovery method of value log system
CN112364374B (en) File copying, moving, compressing and decompressing operation identification method on Linux platform
JP3790614B2 (en) Device configuration information change history management device, method and recording medium recording method
CN102662981A (en) Windows recycle bin delete record forensics method based on feature scan
US8630984B1 (en) System and method for data extraction from email files
CN112286719B (en) Data recovery method for solid state disk after TRIM deletion data is started
CN114691428A (en) Mobile phone data recovery method based on log and file structure

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20210413