CN112905546A - Deleted file recovery method, device, equipment and storage medium - Google Patents
Deleted file recovery method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN112905546A CN112905546A CN202110277957.0A CN202110277957A CN112905546A CN 112905546 A CN112905546 A CN 112905546A CN 202110277957 A CN202110277957 A CN 202110277957A CN 112905546 A CN112905546 A CN 112905546A
- Authority
- CN
- China
- Prior art keywords
- file
- cluster
- deleted
- directory entry
- block
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 39
- 238000011084 recovery Methods 0.000 title claims description 20
- 238000004590 computer program Methods 0.000 claims description 2
- 238000010586 diagram Methods 0.000 description 5
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Human Computer Interaction (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention provides a method, a device, equipment and a storage medium for recovering deleted files, wherein the method comprises the steps of scanning a DATA area to obtain a short file directory entry of a file; distinguishing whether the file is a deleted file or not through a short file directory entry; if the file is a deleted file, acquiring the low order of the initial cluster number in the short file directory entry; obtaining a set of the high bits of the initial cluster number according to the low bits of the initial cluster number and the number of cluster blocks contained in the DATA area; combining the set with the initial cluster number low order to obtain a first cluster number list; traversing cluster blocks corresponding to all the first cluster numbers in the first cluster number list, and if the values of all bytes in the cluster blocks are not all zero and the values of the last N bytes of the previous cluster block adjacent to the cluster blocks are all zero, recording the cluster block as a first cluster block; obtaining complete cluster block information of the file through the first cluster block and the file length in the short file directory entry; and restoring the file according to the complete cluster block information. The method of the invention eliminates the influence of the file format on the determination of the first cluster, and can recover the files in any format.
Description
Technical Field
The present invention relates to the field of data recovery technologies, and in particular, to a method, an apparatus, a device, and a storage medium for recovering a deleted file.
Background
The file of the FAT32 file system is composed of file directory entry and file content, the file directory entry stores the information of file name, first cluster of file, file length, etc. and occupies 32 bytes totally, the file content is stored in cluster blocks with cluster blocks as basic units, the file directory entry is associated with the file content through the first cluster block and the corresponding linked list in FAT table, the folder is the same, except that the file folder stores long/short file directory entry, when the file/folder is deleted, the high bit of the starting cluster of the first cluster of the short file directory entry is cleared, the corresponding chain of FAT table is also cleared, therefore the address of the first cluster directly obtained through the short file directory entry is generally incorrect, the first cluster of file can be obtained only after guessing the high bit of the starting cluster, the guessing of the high bit of the starting cluster in the prior art is usually judged by judging whether the file format is matched, the scene of file recovery is limited, and the file recovery requirement cannot be met.
Accordingly, the prior art is yet to be improved and developed.
Disclosure of Invention
The invention mainly aims to solve the technical problems that the file recovery method in the prior art needs to guess the first cluster block through the file format, the applicable scenes of the method are limited, and the file recovery requirement cannot be met.
The invention provides a method for recovering deleted files, which is applied to a FAT32 file system and comprises the following steps:
scanning a DATA area to obtain a short file directory entry of a file;
distinguishing whether the file is a deleted file or not through the short file directory entry;
if the file is a deleted file, acquiring the low order of the initial cluster number recorded in the short file directory entry;
acquiring a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
combining the set with the initial cluster number low order to obtain a first cluster number list;
traversing cluster blocks corresponding to all the first cluster numbers in the first cluster number list, and recording the cluster blocks as first cluster blocks if all the values of all the bytes in the cluster blocks are not all zero and the values of the last N bytes of the previous cluster blocks adjacent to the cluster blocks are all zero;
acquiring complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
and restoring the file according to the complete cluster block information.
In an optional implementation manner of the first aspect of the present invention, the obtaining, by using the first cluster block and the file length recorded in the short file directory entry, complete cluster block information of the file includes:
and searching all subsequent cluster blocks from the cluster number corresponding to the first cluster block to the next time until the total length of the data of the first cluster block and the subsequent cluster blocks is more than or equal to the file length.
In an alternative implementation manner of the first aspect of the present invention, if the cluster block is coded using ASCII, then N is 1.
In an alternative implementation manner of the first aspect of the present invention, if the cluster block uses Unicode coding, then N is 1, 2, or 4.
In an optional implementation manner of the first aspect of the present invention, the distinguishing, according to the short file directory entry, whether the file is a deleted file includes:
and if the first byte of the short file directory entry is E5, the file is a deleted file.
In an alternative embodiment of the first aspect of the present invention, the file is a continuous storage file.
In an alternative implementation manner of the first aspect of the present invention, the complete cluster block information includes a cluster number of a first cluster block and a cluster number of a subsequent cluster block.
A second aspect of the present invention provides a deleted file recovery apparatus, including:
the scanning module is used for scanning the DATA area to obtain a short file directory entry of a file;
the distinguishing module is used for distinguishing whether the file is a deleted file or not through the short file directory entry;
a first obtaining module, configured to obtain a low-order start cluster number recorded in the short file directory entry if the file is a deleted file; obtaining a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
the list module is used for combining the set with the initial cluster number low order to obtain a first cluster number list;
a traversal module, configured to traverse a cluster block corresponding to each head cluster number in the head cluster number list, and record a cluster block as a head cluster block if all values of all bytes in the cluster block are not all zero and values of the last N bytes of a previous cluster block adjacent to the cluster block are all zero;
a second obtaining module, configured to obtain complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
and the recovery module is used for recovering the file according to the complete cluster block information.
A third aspect of the present invention provides a deleted file recovery apparatus, including: a memory having instructions stored therein and at least one processor, the memory and the at least one processor interconnected by a line;
the at least one processor invokes the instructions in the memory to cause the deleted file restore device to perform any of the above-described deleted file restore methods.
A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method for restoring a deleted file according to any one of the above.
Has the advantages that: the invention provides a method, a device, equipment and a storage medium for recovering deleted files, wherein the method comprises the steps of scanning a DATA area to obtain a short file directory entry of a file; distinguishing whether the file is a deleted file or not through a short file directory entry; if the file is a deleted file, acquiring the low order of the initial cluster number in the short file directory entry; obtaining a set of the high bits of the initial cluster number according to the low bits of the initial cluster number and the number of cluster blocks contained in the DATA area; combining the set with the initial cluster number low order to obtain a first cluster number list; traversing cluster blocks corresponding to all the first cluster numbers in the first cluster number list, and if the values of all bytes in the cluster blocks are not all zero and the values of the last N bytes of the previous cluster block adjacent to the cluster blocks are all zero, recording the cluster block as a first cluster block; acquiring complete cluster block information of the file according to the first cluster block and the file length in the short file directory entry; and restoring the file according to the complete cluster block information. The method for recovering the deleted files eliminates the influence of the file format on the determination of the first cluster, can recover the files in any format, and has wide application scenes.
Drawings
FIG. 1 is a block flow diagram of a method for recovering a deleted file according to the present invention;
FIG. 2 is a diagram illustrating a file storage method according to the present invention;
FIG. 3 is a schematic diagram of an embodiment of a deleted file recovery apparatus according to the present invention;
FIG. 4 is a diagram of an embodiment of a deleted file recovery apparatus according to the present invention.
Detailed Description
The embodiment of the invention provides a method, a device, equipment and a storage medium for recovering a deleted file.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," or "having," and any variations thereof, are intended to cover non-exclusive inclusions, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
The file of the FAT32 file system is composed of a file directory entry and file contents, the file directory entry stores information such as file name, first cluster of the file, file length and the like, and occupies 32 bytes in total, the file contents are stored in cluster blocks by taking the cluster blocks as basic units, the file directory entry is associated with the file contents through the first cluster blocks and corresponding linked lists in the FAT table, and the file folder is similar in structure but stores long/short file directory entries. When the file/folder is deleted, the high-order bits of the start cluster of the first cluster block of the short file directory entry are cleared, and the corresponding FAT table chain is also cleared. Therefore, the first cluster number obtained by the short file directory entry is usually incorrect, and the correct first cluster number of the file can be obtained only by guessing the high order of the initial cluster.
To solve the above technical problem, referring to fig. 1, a first aspect of the present invention provides a method for recovering a deleted file, which is applied to a FAT32 file system, where the method for recovering a deleted file includes:
s100, scanning a DATA area to obtain a short file directory entry of a file;
in the present embodiment, in the FAT32 file system, directory entries can be roughly classified into four types according to structural differences: a volume label directory entry, a ". -" directory entry, and a ". -." directory entry, a short filename directory entry, a long filename directory entry. Wherein, the short filename directory entry is the most important data structure, in which the information about the short filename, attribute, starting cluster number, time value, content size, etc. of the subdirectory or file are stored;
s200, distinguishing whether the file is a deleted file or not through the short file directory entry;
in this embodiment, after a file in the FAT32 file system is deleted, the first byte of the short file directory entry corresponding to the file will become E5, so that it can be determined whether the file is a deleted file by the first byte of the short file directory entry;
s300, if the file is a deleted file, acquiring the low order of the initial cluster number recorded in the short file directory entry;
in this embodiment, after a file in the FAT32 file is deleted, the high order of the start cluster number recorded in the short file directory entry is cleared, so that the short file directory entry file can only know the low order of the start cluster number of the first cluster block of the file, and in order to obtain the first cluster number corresponding to the first cluster block, the high order of the start cluster number needs to be guessed, for example, the first cluster number is compared with the house number, when the file is not deleted, the house number is 1801, the 18 th floor represents the high order of the start cluster number, 01 represents the low order of the start cluster number, and when the file is deleted, 18 is cleared, so that only the low order of the start cluster number can be obtained, and in order to obtain the first cluster number, it is necessary to assume that the high order of the start cluster number is 1-32, and then the file is traversed one layer;
s400, acquiring a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
in this embodiment, when guessing the high bits of the starting cluster number, it is necessary to obtain the range of the high bits of the starting cluster number according to the number of cluster blocks included in the DATA area, and then obtain all possible values of the high bits of the starting cluster number according to the range, and form a set;
s500, combining the set with the initial cluster number low order to obtain a first cluster number list;
in this embodiment, the first cluster number is obtained by adding the high order of the start cluster number to the low order of the start cluster number, and since there are a plurality of high orders of the start cluster number, a plurality of first cluster numbers can be obtained, and then the plurality of first cluster numbers are arranged to obtain a first cluster number list;
s600, traversing cluster blocks corresponding to all the first cluster numbers in the first cluster number list, and recording the cluster blocks as the first cluster blocks if all the values of all the bytes in the cluster blocks are not all zero and the values of the last N bytes of the previous cluster blocks adjacent to the cluster blocks are all zero;
in this embodiment, since files in the FAT32 file system are stored in cluster block units and the file is most likely to not occupy the last cluster block, it is possible to determine whether a cluster block is the starting cluster block of a file by determining whether the end of the previous cluster block adjacent to the cluster block is used (when not used, the byte value is zero);
in one embodiment, before determining whether the values of the last N bytes of the previous cluster block adjacent to the cluster block are all zero, the method further comprises: judging whether the space occupied by the files in the cluster block is not completely zero, so that the file content can be ensured to be stored in the cluster block, and the file content does not exist in the cluster block, so that the judgment of subsequent steps can be omitted, the judgment time is saved, and the judgment efficiency is improved;
s700, obtaining complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
in this embodiment, after knowing the first cluster block of the file, since the file is usually stored continuously and the file length can also be obtained from the short file directory entry, only the file data stored in the subsequent cluster block needs to be searched from the first cluster block to the next, until the file length meets the requirement;
and S800, restoring the file according to the complete cluster block information.
Specifically, in the FAT32 file system, files are stored in the basic unit of cluster blocks, so that the files may not occupy the last cluster block, and the unused byte value is 0 by default, referring to fig. 2, the previous cluster block of the first cluster block of file 2 is the last cluster block of file 1, and bytes with a value of 0 generally exist at the end of the last cluster block of file 1, and the same applies to folders.
In an optional implementation manner of the first aspect of the present invention, the obtaining, by using the first cluster block and the file length recorded in the short file directory entry, complete cluster block information of the file includes:
and searching all subsequent cluster blocks from the cluster number corresponding to the first cluster block to the next time until the total length of the data of the first cluster block and the subsequent cluster blocks is more than or equal to the file length.
In this embodiment, for example, if the cluster number of the first cluster block that has been obtained by the high order of the starting cluster is # 2, then cluster blocks # 3, # 4, and # 5 … N are searched from # 2, if the total length of the files stored in cluster block # 2, cluster block # 3, and cluster block # 4 is greater than the file length recorded in the short file directory entry, the subsequent search for cluster blocks is stopped, and then the deleted file is restored by the data in cluster block # 2, cluster block # 3, and cluster block # 4.
In another optional implementation manner of the first aspect of the present invention, if the values of the last N bytes of the previous cluster block adjacent to the cluster block are not all zero, it is continuously determined whether the values of all bytes in the interval from the next byte of the last byte of the file in the first cluster block to the sector end of the first cluster block are all zero.
In this embodiment, after it is determined that all of the N byte values at the end of the previous cluster block of the cluster block are zero, it may be further determined whether the cluster block is a first cluster block by determining whether the N byte values at the end of the cluster block are zero, that is, the cluster block is proved to be the first cluster block if it is determined that the cluster block is not in the reassigned use state.
In an alternative implementation manner of the first aspect of the present invention, if the cluster block uses Unicode coding, then N is 1, 2, or 4; if the cluster block uses ASCII encoding, then N is 1. In this embodiment, when different file encoding rules are adopted in the FAT32 file system, the value of N will be different, so as to meet the determination requirement of the first cluster block under different file encoding rules, and make the determination of the first cluster block more accurate.
In an optional implementation manner of the first aspect of the present invention, the distinguishing, according to the short file directory entry, whether the file is a deleted file includes:
and if the first byte of the short file directory entry is E5, the file is a deleted file.
In the present embodiment, when a file/folder is deleted, the FAT table of the file is cleared and the directory entry first byte becomes E5, so it is possible to determine whether the file is a deleted file by determining whether the first byte of the short file directory entry is E5.
In an alternative embodiment of the first aspect of the present invention, the file is a continuous storage file. In this embodiment, the deleted file of the present invention is mainly applicable to a deletion scenario when the file is a continuously stored file, and in this scenario, the probability of recovering the deleted file is higher.
In an alternative implementation manner of the first aspect of the present invention, the complete cluster block information includes a cluster number of a first cluster block and a cluster number of a subsequent cluster block. In this embodiment, after the cluster numbers of the first cluster block and the subsequent cluster block that may be included in the deleted file are known, the DATA enclosure in the corresponding cluster block is read from the DATA area to recover the corresponding file.
Referring to fig. 3, a second aspect of the present invention provides a deleted file recovery apparatus, including:
the scanning module 10 is configured to scan the DATA area to obtain a short file directory entry of a file;
a distinguishing module 20, configured to distinguish whether the file is a deleted file according to the short file directory entry;
a first obtaining module 30, configured to obtain a low-order start cluster number recorded in the short file directory entry if the file is a deleted file; obtaining a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
a list module 40, configured to combine the set with the initial cluster number to obtain a first cluster number list;
a traversal module 50, configured to traverse a cluster block corresponding to each head cluster number in the head cluster number list, and record a cluster block as a head cluster block if all the values of all the bytes in the cluster block are not all zero and the values of the last N bytes of a previous cluster block adjacent to the cluster block are all zero;
a second obtaining module 60, configured to obtain complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
and a restoring module 70, configured to restore the file according to the complete cluster block information.
In an optional implementation manner of the second aspect of the present invention, the second obtaining module is further configured to search all subsequent cluster blocks from a cluster number corresponding to the first cluster block to the next, until a total length of data of the first cluster block and the subsequent cluster blocks is greater than or equal to the file length.
In an optional implementation manner of the second aspect of the present invention, if all values of the last N bytes of the previous cluster block adjacent to the cluster block are not all zero, it is continuously determined whether all values of the bytes in the interval from the next byte of the last byte of the file in the first cluster block to the sector end of the first cluster block are zero.
In an alternative embodiment of the second aspect of the present invention, if the cluster block uses Unicode coding, then N is 2; if the cluster block uses ASCII encoding, then N is 1.
In an optional implementation manner of the second aspect of the present invention, the distinguishing module is further configured to determine that the file is a deleted file if the first byte of the short file directory entry is E5.
In an alternative embodiment of the second aspect of the present invention, the file is a contiguous storage file.
In an alternative implementation manner of the second aspect of the present invention, the complete cluster block information includes a cluster number of a first cluster block and a cluster number of a subsequent cluster block.
Fig. 4 is a schematic structural diagram of a deleted file recovery apparatus according to an embodiment of the present invention, where the deleted file recovery apparatus may generate a relatively large difference due to different configurations or performances, and may include one or more processors 80 (CPUs) (e.g., one or more processors) and a memory 90, and one or more storage media 100 (e.g., one or more mass storage devices) for storing applications or data. The memory and storage medium may be, among other things, transient or persistent storage. The program stored on the storage medium may include one or more modules (not shown), each of which may include a series of instruction operations in a recovery device for deleted files. Still further, the processor may be configured to communicate with the storage medium to execute a series of instruction operations in the storage medium on the deleted file recovery device.
The deleted file restore device may also include one or more power supplies 110, one or more wired or wireless network interfaces 120, one or more input-output interfaces 130, and/or one or more operating systems, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will appreciate that the deleted file restore device configuration shown in FIG. 4 does not constitute a limitation of a deleted file restore device, and may include more or fewer components than shown, or some components in combination, or a different arrangement of components.
The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium, or a volatile computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the instructions are executed on a computer, the instructions cause the computer to execute the steps of the method for restoring a non-contiguous storage file.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses, and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (10)
1. A method for recovering deleted files is applied to a FAT32 file system, and is characterized in that the method for recovering deleted files comprises the following steps:
scanning a DATA area to obtain a short file directory entry of a file;
distinguishing whether the file is a deleted file or not through the short file directory entry;
if the file is a deleted file, acquiring the low order of the initial cluster number recorded in the short file directory entry;
acquiring a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
combining the set with the initial cluster number low order to obtain a first cluster number list;
traversing cluster blocks corresponding to all the first cluster numbers in the first cluster number list, and recording the cluster blocks as first cluster blocks if all the values of all the bytes in the cluster blocks are not all zero and the values of the last N bytes of the previous cluster blocks adjacent to the cluster blocks are all zero;
acquiring complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
and restoring the file according to the complete cluster block information.
2. The method according to claim 1, wherein the obtaining of the complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry comprises:
and searching all subsequent cluster blocks from the cluster number corresponding to the first cluster block to the next time until the total length of the data of the first cluster block and the subsequent cluster blocks is more than or equal to the file length.
3. The method of claim 1, wherein if the cluster block is encoded using ASCII, N is 1.
4. The method for recovering a deleted file according to claim 1, wherein if the cluster block uses Unicode coding, N is 1, 2, or 4.
5. The method for recovering a deleted file according to claim 1, wherein the distinguishing whether the file is a deleted file according to the short file directory entry includes:
and if the first byte of the short file directory entry is E5, the file is a deleted file.
6. The method for restoring a deleted file as set forth in claim 1, wherein said file is a contiguously stored file.
7. The method of claim 1, wherein the complete cluster block information includes a cluster number of a first cluster block and a cluster number of a subsequent cluster block.
8. A deleted file restoration apparatus, comprising:
the scanning module is used for scanning the DATA area to obtain a short file directory entry of a file;
the distinguishing module is used for distinguishing whether the file is a deleted file or not through the short file directory entry;
a first obtaining module, configured to obtain a low-order start cluster number recorded in the short file directory entry if the file is a deleted file; obtaining a set of initial cluster number high bits according to the initial cluster number low bits and the number of cluster blocks contained in the DATA area;
the list module is used for combining the set with the initial cluster number low order to obtain a first cluster number list;
a traversal module, configured to traverse a cluster block corresponding to each head cluster number in the head cluster number list, and record a cluster block as a head cluster block if all values of all bytes in the cluster block are not all zero and values of the last N bytes of a previous cluster block adjacent to the cluster block are all zero;
a second obtaining module, configured to obtain complete cluster block information of the file according to the first cluster block and the file length recorded in the short file directory entry;
and the recovery module is used for recovering the file according to the complete cluster block information.
9. A deleted file restoration device, comprising: a memory having instructions stored therein and at least one processor, the memory and the at least one processor interconnected by a line;
the at least one processor invoking the instructions in the memory to cause the deleted file recovery apparatus to perform the deleted file recovery method of any of claims 1-7.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, implements a method for restoring a deleted file according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110277957.0A CN112905546A (en) | 2021-03-15 | 2021-03-15 | Deleted file recovery method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110277957.0A CN112905546A (en) | 2021-03-15 | 2021-03-15 | Deleted file recovery method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112905546A true CN112905546A (en) | 2021-06-04 |
Family
ID=76105710
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110277957.0A Pending CN112905546A (en) | 2021-03-15 | 2021-03-15 | Deleted file recovery method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112905546A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113468123A (en) * | 2021-06-30 | 2021-10-01 | 深圳软牛科技有限公司 | Folder de-duplication recovery method, device, equipment and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040111582A1 (en) * | 2002-10-17 | 2004-06-10 | Takuji Maeda | File-update apparatus |
| CN1904845A (en) * | 2006-08-01 | 2007-01-31 | 珠海金山软件股份有限公司 | Method for recovering files deleted from FAT32 document system |
| CN101140548A (en) * | 2007-10-23 | 2008-03-12 | 北京握奇数据系统有限公司 | Method for operating data file by card operating system and smart card thereof |
| CN104331348A (en) * | 2014-11-27 | 2015-02-04 | 四川效率源信息安全技术有限责任公司 | Method for recovering file by reducing initial cluster number of FAT32 directory entry |
| CN109582501A (en) * | 2018-11-28 | 2019-04-05 | 万兴科技股份有限公司 | File access pattern method, apparatus, computer equipment and storage medium |
| WO2020103493A1 (en) * | 2018-11-22 | 2020-05-28 | 厦门市美亚柏科信息股份有限公司 | Method and system for recovering deleted file based on fat32 file system |
-
2021
- 2021-03-15 CN CN202110277957.0A patent/CN112905546A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040111582A1 (en) * | 2002-10-17 | 2004-06-10 | Takuji Maeda | File-update apparatus |
| CN1904845A (en) * | 2006-08-01 | 2007-01-31 | 珠海金山软件股份有限公司 | Method for recovering files deleted from FAT32 document system |
| CN101140548A (en) * | 2007-10-23 | 2008-03-12 | 北京握奇数据系统有限公司 | Method for operating data file by card operating system and smart card thereof |
| CN104331348A (en) * | 2014-11-27 | 2015-02-04 | 四川效率源信息安全技术有限责任公司 | Method for recovering file by reducing initial cluster number of FAT32 directory entry |
| WO2020103493A1 (en) * | 2018-11-22 | 2020-05-28 | 厦门市美亚柏科信息股份有限公司 | Method and system for recovering deleted file based on fat32 file system |
| CN109582501A (en) * | 2018-11-28 | 2019-04-05 | 万兴科技股份有限公司 | File access pattern method, apparatus, computer equipment and storage medium |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113468123A (en) * | 2021-06-30 | 2021-10-01 | 深圳软牛科技有限公司 | Folder de-duplication recovery method, device, equipment and storage medium |
| CN113468123B (en) * | 2021-06-30 | 2024-02-20 | 深圳软牛科技有限公司 | File duplicate removal recovery method, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7934064B1 (en) | System and method for consolidation of backups | |
| KR100856245B1 (en) | File system device and method for saving and seeking file thereof | |
| US10303363B2 (en) | System and method for data storage using log-structured merge trees | |
| EP2363815B1 (en) | System for permanent file deletion | |
| US8818950B2 (en) | Method and apparatus for localized protected imaging of a file system | |
| US7577808B1 (en) | Efficient backup data retrieval | |
| US10747678B2 (en) | Storage tier with compressed forward map | |
| JP2005302038A (en) | Method and system for renaming consecutive key in b-tree | |
| CN110569147B (en) | Deleted file recovery method based on index, terminal device and storage medium | |
| CN111045857A (en) | Method for data backup and recovery, electronic device and computer readable storage medium | |
| CN112115002B (en) | Method and device for recovering file from damaged or untrusted mechanical hard disk | |
| CN105027071A (en) | Managing operations on stored data units | |
| US20040143609A1 (en) | System and method for data extraction in a non-native environment | |
| CN105009068A (en) | Managing operations on stored data units | |
| CN110297781B (en) | Method for recovering deleted data in APFS (advanced File System) based on copy-on-write | |
| CN111104377A (en) | File management method, electronic device and computer-readable storage medium | |
| US20110153677A1 (en) | Apparatus and method for managing index information of high-dimensional data | |
| EP1845461A1 (en) | Fast file attribute search | |
| CN112905546A (en) | Deleted file recovery method, device, equipment and storage medium | |
| US20140244699A1 (en) | Apparatus and Methods for Selective Location and Duplication of Relevant Data | |
| CN108021472B (en) | Format recovery method of ReFS file system and storage medium | |
| CN112835858A (en) | Method, device and equipment for recovering non-continuously stored files and storage medium | |
| CN112380174B (en) | XFS file system analysis method containing deleted files, terminal device and storage medium | |
| CN106897315B (en) | KV item validity acquisition method and device | |
| CN114579525B (en) | Data traceless deletion method and system for EXT4 file system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210604 |