CN114281759B - Method, device and system for remolding NTFS file system - Google Patents
Method, device and system for remolding NTFS file system Download PDFInfo
- Publication number
- CN114281759B CN114281759B CN202111574685.7A CN202111574685A CN114281759B CN 114281759 B CN114281759 B CN 114281759B CN 202111574685 A CN202111574685 A CN 202111574685A CN 114281759 B CN114281759 B CN 114281759B
- Authority
- CN
- China
- Prior art keywords
- file
- ntfs
- partition
- source
- storage position
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 37
- 238000005192 partition Methods 0.000 claims abstract description 354
- 238000012360 testing method Methods 0.000 claims abstract description 40
- 239000000284 extract Substances 0.000 claims description 12
- 238000007634 remodeling Methods 0.000 claims description 11
- 230000005540 biological transmission Effects 0.000 claims description 3
- 230000006835 compression Effects 0.000 claims description 3
- 238000007906 compression Methods 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 6
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000011084 recovery Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000001737 promoting effect Effects 0.000 description 1
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Debugging And Monitoring (AREA)
Abstract
According to the method, the device and the system for remolding the NTFS file system, provided by one or more embodiments of the present disclosure, cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, $bitmap file content and storage position thereof and other information in a source NTFS partition are obtained through header information of the NTFS in the source NTFS partition of a user side, and information such as the information is packaged and transmitted, and a target partition simulating the user side is reconstructed on the test side based on the information, so that when a tester scans with data recovery software, the found file information is consistent with the storage position of the file and the source partition, and the required information size is far smaller than the partition size, thereby facilitating the personnel to analyze and recover the problems of the software in the user environment.
Description
Technical Field
One or more embodiments of the present disclosure relate to the field of data recovery technology, and in particular, to a method, apparatus, and system for remodeling an NTFS file system.
Background
In the data recovery industry, the user's scenario is often different from the normal test scenario, which is typically a clean environment that is constructed for some known deletion scenarios. And the scenes of users are various, and the complexity of the scenes is far beyond the testing environment.
When a user scene goes wrong, the problem of the user is difficult to solve, and 2 schemes are generally adopted in the prior art: one is to directly let the user mail the hard disk, the tester uses the disk environment of the user to test, the scheme is not willing to mail the hard disk in many times, and there is also a risk that various hard disks are damaged in the mailing process; the other is that the user sends the whole hard disk to test by a tester, in this scheme, after the hard disk is used, the file is very large and the sending is difficult.
Disclosure of Invention
In view of this, it is an object of one or more embodiments of the present disclosure to provide a method, apparatus and system for remodeling an NTFS file system, so as to solve the technical problems in the prior art.
In view of the above, one or more embodiments of the present specification provide a method of remodelling an NTFS file system, comprising:
The method comprises the steps that a user side obtains cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, and stores the cluster size, $MFT file content and storage position thereof as a binary file, and the binary file is compressed into a compressed file in a lossless mode; transmitting the compressed file to a testing end;
The testing end receives the compressed file, decompresses the compressed file, and extracts the cluster size, the $ MFT file content and the storage position thereof, the $ Logfile file content and the storage position thereof, and the $ Bitmap file content and the storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
As a second aspect of the present invention, there is provided a method for remodeling an NTFS file system, applied to a client, including:
Acquiring cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, storing the cluster size, $MFT file content and storage position thereof as a binary file, and lossless compressing the binary file into a compressed file;
Transmitting the compressed file to a testing end, so that the testing end can decompress the compressed file, and extract the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
As an optional implementation manner, the obtaining, based on the header information of the NTFS in the source NTFS partition, the cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in the source NTFS partition includes:
in a source NTFS partition, locating a start cluster number and a cluster size of the $MFT file according to the volume header information of the NTFS;
calculating file content and storage position of the $MFT file based on the initial cluster number and cluster size of the $MFT file;
Based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file, the file content of $ Logfile and the storage position thereof and the file content of $bitmap and the storage position thereof are obtained.
As a third aspect of the present invention, a method for remodeling an NTFS file system, applied to a test end, includes:
Receiving a compressed file, wherein the compressed file is obtained by a user side based on the volume header information of NTFS in a source NTFS partition, and the cluster size, $MFT file content and storage position, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the source NTFS partition are stored as binary files, and the binary files are compressed into the compressed file in a lossless manner;
Decompressing the compressed file, and extracting the cluster size, the content of the $ MFT file and the storage position thereof, the content of the $ Logfile file and the storage position thereof, and the content of the $ Bitmap file and the storage position thereof in the NTFS partition;
Setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition;
Writing in a target partition in a binary mode, enabling the initial cluster number of a $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of a $MFT file of a source NTFS partition, covering a $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing a $ Logfile file and a $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster;
A remodeled NTFS file system is obtained.
As a fourth aspect of the present invention, a system for remodelling an NTFS file system, comprises:
the method comprises the steps that a user side obtains cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, stores the cluster size, $MFT file content and storage position thereof as binary files, and lossless compresses the binary files into compressed files; transmitting the compressed file to a test end;
The testing end receives the compressed file, decompresses the compressed file, and extracts the cluster size, the $ MFT file content and the storage position thereof, the $ Logfile file content and the storage position thereof, and the $ Bitmap file content and the storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
As a fifth aspect of the present invention, an apparatus for remodeling an NTFS file system, applied to a client, includes:
The acquisition and compression module is used for acquiring cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on the volume header information of the NTFS in the source NTFS partition, storing the binary file as a binary file, and lossless compressing the binary file into a compressed file;
The transmission module is used for transmitting the compressed file to the test end so that the test end can decompress the compressed file and extract the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
As an alternative embodiment, the acquiring and compressing module includes:
The positioning unit is used for positioning the initial cluster number and the cluster size of the $MFT file in the source NTFS partition according to the volume header information of the NTFS;
A first calculation unit, configured to calculate file contents and storage locations of the $mft file based on a start cluster number and a cluster size of the $mft file;
and the second calculation unit is used for obtaining $ Logfile file content and a storage position thereof and $bitmap file content and a storage position thereof based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file.
As a sixth aspect of the present invention, an apparatus for remodeling an NTFS file system, applied to a testing end, includes:
The receiving module is used for receiving a compressed file, the compressed file is obtained by a user side based on the header information of the NTFS in the source NTFS partition, and the cluster size, the content and the storage position of the $ MFT file, the content and the storage position of the $ Logfile file, the content and the storage position of the $ Bitmap file in the source NTFS partition are stored as binary files, and the binary files are compressed into the compressed file in a lossless mode;
the reading module is used for decompressing the compressed file and extracting the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof and $bitmap file content and storage position thereof in the NTFS partition;
The setting module is used for setting a target partition, the capacity of the target partition is not smaller than that of the source NTFS partition, the target partition is formatted into an NTFS file system, and the cluster size of the target partition is set to be the same as the cluster size in the source NTFS partition;
The writing module is used for writing in a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster;
And the obtaining module is used for obtaining the remodeled NTFS file system.
As can be seen from the foregoing, in the method, the device and the system for remodeling the NTFS file system provided in one or more embodiments of the present disclosure, cluster size, $mft file content and storage location thereof, $ Logfile file content and storage location thereof, and information such as $bitmap file content and storage location thereof in a source NTFS partition of a user side are obtained by using header information of the NTFS in the source NTFS partition, and are packaged and transmitted, and a target partition simulating the user side is reconstructed at a test side based on the above information, so that when a tester scans with data recovery software, the found file information and the storage location of the file are consistent with the source partition, and the required information size is far smaller than the partition size, thereby facilitating the personnel to analyze the problem existing in the user environment of the recovery software.
Drawings
For a clearer description of one or more embodiments of the present description or of the solutions of the prior art, the drawings that are necessary for the description of the embodiments or of the prior art will be briefly described, it being apparent that the drawings in the description below are only one or more embodiments of the present description, from which other drawings can be obtained, without inventive effort, for a person skilled in the art.
FIG. 1 is a logical schematic diagram of a method of remodelling an NTFS file system in accordance with one or more embodiments of the present description;
FIG. 2 is a logical schematic diagram of a method for remodeling an NTFS file system at a client in accordance with one or more embodiments of the present disclosure;
FIG. 3 is a logical schematic diagram of a method of remodelling NTFS files at a testing end of one or more embodiments of the present description;
FIG. 4 is a logical schematic diagram of a system for remodelling NTFS files systems in accordance with one or more embodiments of the present description;
FIG. 5 is a logical schematic diagram of an apparatus for reshaping NTFS files at a client in accordance with one or more embodiments of the present disclosure;
FIG. 6 is a logical schematic diagram of an apparatus for reshaping NTFS file systems at a testing end in accordance with one or more embodiments of the present description.
Detailed Description
For the purposes of promoting an understanding of the principles and advantages of the disclosure, reference will now be made in detail to the following specific examples.
In order to achieve the above objective, the embodiments of the present invention provide a method, an apparatus and a system for remodeling an NTFS file system, where the method and the apparatus may be applied to a terminal of the NTFS file system, for example, a desktop, a notebook, a server, a cloud server, a server cluster, etc., and are not limited in particular. The following first describes in detail a method for remodeling an NTFS file system provided in an embodiment of the present invention.
To achieve the above object, an embodiment of the present invention provides a method for remodelling an NTFS file system, as shown in fig. 1, including
S100, a user side obtains cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, stores the cluster size, $MFT file content and storage position thereof as a binary file, and lossless compresses the binary file into a compressed file; transmitting the compressed file to a testing end;
S200, a test end receives the compressed file, decompresses the compressed file, and extracts the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
In the embodiment of the invention, the cluster size, $MFT file content and storage position, $ Logfile file content and storage position thereof, $bitmap file content and storage position thereof and other information in the source NTFS partition of the user side are acquired through the volume header information of the NTFS in the source NTFS partition of the user side and are packaged and transmitted, and a target partition simulating the user side is reconstructed on the test side based on the information, so that when a tester scans by using data recovery software, the found file information is consistent with the storage position of the file and the source partition, and the required information size is far smaller than the partition size, thereby facilitating the personnel to analyze the problem of the recovery software in the user environment.
Referring to fig. 2, the present embodiment provides a method for remodelling NTFS file system, applied to a client, including
S110, acquiring cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, storing the cluster size, $MFT file content and storage position thereof as binary files, and lossless compressing the binary files into compressed files;
Optionally, S110 includes:
S111, in a source NTFS partition, positioning a start cluster number and a cluster size of the $MFT file according to the volume header information of the NTFS;
wherein the cluster size refers to the number of bytes per cluster.
S112, calculating file contents and storage positions of the $MFT file based on the initial cluster number and cluster size of the $MFT file;
The initial offset of the $MFT file is calculated by the initial cluster number and the cluster size. In the $mft file, the first file record is information of the $mft file itself, in which the file size of $mft, stored information, and the like are recorded.
S113, obtaining $ Logfile file content and a storage position thereof and $bitmap file content and a storage position thereof based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file.
In the $ MFT file, the 3 rd file record (offset 0x 800) is the file information of the $ Logfile file, thus obtaining the $ Logfile file content and its storage location. The 7 th file record (offset 0xC 00) is file information of the $bitmap file, thereby obtaining $bitmap file content and its storage location.
S120, transmitting the compressed file to a testing end, so that the testing end can decompress the compressed file, and extracting the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
Referring to fig. 3, the present embodiment provides a method for remodelling an NTFS file system, which is applied to a testing end, and includes:
S210, receiving a compressed file, wherein the compressed file is obtained by a user side based on the header information of NTFS in a source NTFS partition, and the cluster size, the content and the storage position of a $ MFT file, the content and the storage position of a $ Logfile file, and the content and the storage position of a $ Bitmap file in the source NTFS partition are stored as binary files, and the binary files are compressed into the compressed file in a lossless manner;
s220, decompressing the compressed file, and extracting the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the NTFS partition;
S230, setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as that of the source NTFS partition;
S240, writing in a target partition in a binary mode, enabling the initial cluster number of a $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of a $MFT file of a source NTFS partition, covering a $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing a $ Logfile file and a $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster;
s250, obtaining a remodeled NTFS file system.
Corresponding to the method for remolding the NTFS file system, the embodiment of the present invention further provides a system for remolding the NTFS file system, as shown in fig. 4, including:
the client 10 obtains the cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in the source NTFS partition based on the header information of the NTFS in the source NTFS partition, and stores the obtained binary file as a binary file, and lossless compresses the binary file into a compressed file; transmitting the compressed file to a test end;
The test end 20 receives the compressed file, decompresses the compressed file, and extracts the cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
In the embodiment of the invention, the cluster size, $MFT file content and storage position, $ Logfile file content and storage position thereof, $bitmap file content and storage position thereof and other information in the source NTFS partition of the user side are acquired through the volume header information of the NTFS in the source NTFS partition of the user side and are packaged and transmitted, and a target partition simulating the user side is reconstructed on the test side based on the information, so that when a tester scans by using data recovery software, the found file information is consistent with the storage position of the file and the source partition, and the required information size is far smaller than the partition size, thereby facilitating the personnel to analyze the problem of the recovery software in the user environment.
Corresponding to the method for remolding the NTFS file system, the embodiment of the present invention further provides a device for remolding the NTFS file system, which is applied to a client, and please refer to fig. 5, including:
The acquiring and compressing module 11 is configured to acquire a cluster size, $mft file content and a storage location thereof, $ Logfile file content and a storage location thereof, and $bitmap file content and a storage location thereof in a source NTFS partition based on header information of NTFS in the source NTFS partition, store the binary file as a binary file, and lossless compress the binary file as a compressed file;
wherein, the acquisition and compression module includes:
The positioning unit is used for positioning the initial cluster number and the cluster size of the $MFT file in the source NTFS partition according to the volume header information of the NTFS;
A first calculation unit, configured to calculate file contents and storage locations of the $mft file based on a start cluster number and a cluster size of the $mft file;
and the second calculation unit is used for obtaining $ Logfile file content and a storage position thereof and $bitmap file content and a storage position thereof based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file.
The transmission module 12 is configured to transmit the compressed file to a testing end, so that the testing end can decompress the compressed file, and extract the cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
Corresponding to the method for remolding the NTFS file system, the embodiment of the present invention further provides a device for remolding the NTFS file system, which is applied to a testing end, and please refer to fig. 6, including:
A receiving module 21, configured to receive a compressed file, where the compressed file obtains, by a user side, a cluster size, $mft file content and a storage location thereof, $ Logfile file content and a storage location thereof, and $bitmap file content and a storage location thereof in a source NTFS partition based on header information of an NTFS in the source NTFS partition, and stores the compressed file as a binary file, and lossless compresses the binary file into the compressed file;
A reading module 22, configured to decompress the compressed file, and extract a cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in the NTFS partition;
A setting module 23, configured to set a target partition, where a capacity of the target partition is not less than that of the source NTFS partition, format the target partition into an NTFS file system, and set a cluster size of the target partition to be the same as a cluster size in the source NTFS partition;
A writing module 24, configured to write in a binary manner to a target partition, make a start cluster number of a $mft file of header information of an NTFS in the target partition coincide with a start cluster number of a $mft file of a source NTFS partition, cover a $mft file of the target partition with a file content of the $mft file of the source NTFS partition, write a $ Logfile file and a $bitmap file of the source NTFS partition into the target partition according to a storage location in the source NTFS partition, acquire a distribution of free clusters in the target partition from the $bitmap file, and write a current cluster number in a head of each free cluster;
the obtaining module 25 obtains a remodeled NTFS file system.
For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, the functions of each module may be implemented in one or more pieces of software and/or hardware when implementing one or more embodiments of the present description.
The device of the foregoing embodiment is configured to implement the corresponding method in the foregoing embodiment, and has the beneficial effects of the corresponding method embodiment, which is not described herein.
It is noted that unless otherwise defined, technical or scientific terms used in one or more embodiments of the present disclosure should be taken in a general sense as understood by one of ordinary skill in the art to which the present disclosure pertains. The use of the terms "first," "second," and the like in one or more embodiments of the present description does not denote any order, quantity, or importance, but rather the terms "first," "second," and the like are used to distinguish one element from another. The word "comprising" or "comprises", and the like, means that elements or items preceding the word are included in the element or item listed after the word and equivalents thereof, but does not exclude other elements or items. The terms "connected" or "connected," and the like, are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.
It should be noted that the methods of one or more embodiments of the present description may be performed by a single device, such as a computer or server. The method of the embodiment can also be applied to a distributed scene, and is completed by mutually matching a plurality of devices. In the case of such a distributed scenario, one of the devices may perform only one or more steps of the methods of one or more embodiments of the present description, the devices interacting with each other to accomplish the methods.
The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
The present disclosure is intended to embrace all such alternatives, modifications and variances which fall within the broad scope of the appended claims. Any omissions, modifications, equivalents, improvements, and the like, which are within the spirit and principles of the one or more embodiments of the disclosure, are therefore intended to be included within the scope of the disclosure.
Claims (8)
1. A method of remodelling an NTFS file system, comprising:
The method comprises the steps that a user side obtains cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, and stores the cluster size, $MFT file content and storage position thereof as a binary file, and the binary file is compressed into a compressed file in a lossless mode; transmitting the compressed file to a testing end;
the testing end receives the compressed file, decompresses the compressed file, and extracts the cluster size, the $ MFT file content and the storage position thereof, the $ Logfile file content and the storage position thereof, and the $ Bitmap file content and the storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $MFT file of the target partition by the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
2. A method for remodelling an NTFS file system, applied to a client, comprising:
Acquiring cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, storing the cluster size, $MFT file content and storage position thereof as a binary file, and lossless compressing the binary file into a compressed file;
Transmitting the compressed file to a testing end, so that the testing end can decompress the compressed file, and extract the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
3. The method of remodeling NTFS file system according to claim 2, wherein the obtaining cluster size, $mft file content and its storage location, $ Logfile file content and its storage location, and $bitmap file content and its storage location in a source NTFS partition based on header information of NTFS in the source NTFS partition comprises:
in a source NTFS partition, locating a start cluster number and a cluster size of the $MFT file according to the volume header information of the NTFS;
calculating file content and storage position of the $MFT file based on the initial cluster number and cluster size of the $MFT file;
Based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file, the file content of $ Logfile and the storage position thereof and the file content of $bitmap and the storage position thereof are obtained.
4. A method for remodelling an NTFS file system, applied to a test end, comprising:
Receiving a compressed file, wherein the compressed file is obtained by a user side based on the volume header information of NTFS in a source NTFS partition, and the cluster size, $MFT file content and storage position, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in the source NTFS partition are stored as binary files, and the binary files are compressed into the compressed file in a lossless manner;
Decompressing the compressed file, and extracting the cluster size, the content of the $ MFT file and the storage position thereof, the content of the $ Logfile file and the storage position thereof, and the content of the $ Bitmap file and the storage position thereof in the NTFS partition;
Setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition;
Writing in a target partition in a binary mode, enabling the initial cluster number of a $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of a $MFT file of a source NTFS partition, covering a $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing a $ Logfile file and a $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster;
A remodeled NTFS file system is obtained.
5. A system for remodelling an NTFS file system, comprising:
the method comprises the steps that a user side obtains cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on volume header information of NTFS in the source NTFS partition, stores the cluster size, $MFT file content and storage position thereof as binary files, and lossless compresses the binary files into compressed files; transmitting the compressed file to a test end;
The testing end receives the compressed file, decompresses the compressed file, and extracts the cluster size, the $ MFT file content and the storage position thereof, the $ Logfile file content and the storage position thereof, and the $ Bitmap file content and the storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
6. An apparatus for remodelling NTFS file system, applied to a client, comprising
The acquisition and compression module is used for acquiring cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof, and $bitmap file content and storage position thereof in a source NTFS partition based on the volume header information of the NTFS in the source NTFS partition, storing the binary file as a binary file, and lossless compressing the binary file into a compressed file;
The transmission module is used for transmitting the compressed file to the test end so that the test end can decompress the compressed file and extract the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof and $bitmap file content and storage position thereof in the NTFS partition; setting a target partition, wherein the capacity of the target partition is not smaller than that of the source NTFS partition, formatting the target partition into an NTFS file system, and setting the cluster size of the target partition to be the same as the cluster size in the source NTFS partition; and writing a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster to obtain a remodeled NTFS file system.
7. The apparatus for remodelling an NTFS file system of claim 6, wherein the acquire and compress module comprises:
The positioning unit is used for positioning the initial cluster number and the cluster size of the $MFT file in the source NTFS partition according to the volume header information of the NTFS;
A first calculation unit, configured to calculate file contents and storage locations of the $mft file based on a start cluster number and a cluster size of the $mft file;
and the second calculation unit is used for obtaining $ Logfile file content and a storage position thereof and $bitmap file content and a storage position thereof based on the storage information of $ Logfile and $bitmap in the file content of the $MFT file.
8. An apparatus for remodelling an NTFS file system, for use at a testing end, comprising:
The receiving module is used for receiving a compressed file, the compressed file is obtained by a user side based on the header information of the NTFS in the source NTFS partition, and the cluster size, the content and the storage position of the $ MFT file, the content and the storage position of the $ Logfile file, the content and the storage position of the $ Bitmap file in the source NTFS partition are stored as binary files, and the binary files are compressed into the compressed file in a lossless mode;
the reading module is used for decompressing the compressed file and extracting the cluster size, $MFT file content and storage position thereof, $ Logfile file content and storage position thereof and $bitmap file content and storage position thereof in the NTFS partition;
The setting module is used for setting a target partition, the capacity of the target partition is not smaller than that of the source NTFS partition, the target partition is formatted into an NTFS file system, and the cluster size of the target partition is set to be the same as the cluster size in the source NTFS partition;
The writing module is used for writing in a target partition in a binary mode, enabling the initial cluster number of the $MFT file of the volume header information of the NTFS in the target partition to be consistent with the initial cluster number of the $MFT file of the source NTFS partition, covering the $mft file of the target partition with the file content of the $MFT file of the source NTFS partition, writing the $ Logfile file and the $bitmap file of the source NTFS partition into the target partition according to the storage position in the source NTFS partition, acquiring the distribution of idle clusters in the target partition from the $bitmap file, and writing the current cluster number in the head of each idle cluster;
And the obtaining module is used for obtaining the remodeled NTFS file system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111574685.7A CN114281759B (en) | 2021-12-21 | 2021-12-21 | Method, device and system for remolding NTFS file system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111574685.7A CN114281759B (en) | 2021-12-21 | 2021-12-21 | Method, device and system for remolding NTFS file system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114281759A CN114281759A (en) | 2022-04-05 |
| CN114281759B true CN114281759B (en) | 2024-05-14 |
Family
ID=80873779
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111574685.7A Active CN114281759B (en) | 2021-12-21 | 2021-12-21 | Method, device and system for remolding NTFS file system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114281759B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101593184B1 (en) * | 2014-09-16 | 2016-02-15 | 한국전자통신연구원 | Method and apparatus for recovering partition based on file system metadata |
| CN110347643A (en) * | 2019-07-22 | 2019-10-18 | 成都易我科技开发有限责任公司 | NTFS volume cloning process and device between a kind of disk |
| CN111581163A (en) * | 2020-05-12 | 2020-08-25 | 山东省计算中心（国家超级计算济南中心） | Data traceless deletion method and system based on NTFS (New technology File System) |
-
2021
- 2021-12-21 CN CN202111574685.7A patent/CN114281759B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101593184B1 (en) * | 2014-09-16 | 2016-02-15 | 한국전자통신연구원 | Method and apparatus for recovering partition based on file system metadata |
| CN110347643A (en) * | 2019-07-22 | 2019-10-18 | 成都易我科技开发有限责任公司 | NTFS volume cloning process and device between a kind of disk |
| CN111581163A (en) * | 2020-05-12 | 2020-08-25 | 山东省计算中心（国家超级计算济南中心） | Data traceless deletion method and system based on NTFS (New technology File System) |
Non-Patent Citations (1)
| Title |
|---|
| 重建NTFS的DBR及分区表的研究与实现;陈培德;吴建平;王丽清;;实验科学与技术;20161231(第06期);第：56-59页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114281759A (en) | 2022-04-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106936441B (en) | Data compression method and device | |
| US10915247B2 (en) | Efficient data management through compressed data interfaces | |
| CN107229420B (en) | Data storage method, reading method, deleting method and data operating system | |
| US8751462B2 (en) | Delta compression after identity deduplication | |
| US20090234870A1 (en) | Ordering compression and deduplication of data | |
| TWI554893B (en) | Method and system for transmitting data | |
| US9471412B2 (en) | Encoding diagnostic data in an error message for a computer program | |
| CN111949621B (en) | File compression storage method and terminal based on scene switching | |
| CN107850983B (en) | Computer system, storage device and data management method | |
| US20160034201A1 (en) | Managing de-duplication using estimated benefits | |
| US20050114408A1 (en) | Data management systems, data management system storage devices, articles of manufacture, and data management methods | |
| CN108092667B (en) | Method and device for compressing time series data and inquiring time series data | |
| WO2023000674A1 (en) | Method and apparatus for data compression, backup and recovery of cloud hard disk, device and storage medium | |
| US11989161B2 (en) | Generating readable, compressed event trace logs from raw event trace logs | |
| CN106874399B (en) | Networking backup system and backup method | |
| CN112632568B (en) | Temperature data storage and acquisition method, system, electronic equipment and storage medium | |
| US20180307437A1 (en) | Backup control method and backup control device | |
| CN114281759B (en) | Method, device and system for remolding NTFS file system | |
| Hadi | Reviewing and evaluating existing file carving techniques for JPEG files | |
| CN114020522A (en) | Data backup method and device, electronic equipment and system | |
| US11461269B2 (en) | Metadata separated container format | |
| WO2021082926A1 (en) | Data compression method and apparatus | |
| WO2024103752A1 (en) | File transmission method, apparatus and system, electronic device, and storage medium | |
| CN102360381B (en) | Device and method for performing lossless compression on embedded program | |
| CN110019056B (en) | Container metadata separation for cloud layer |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |