CN114297144A - Method and system for performing quick file exclusion aiming at NTFS (New technology File System) - Google Patents

Abstract

The invention discloses a method and a system for fast removing files aiming at an NTFS file system, wherein the method comprises the following steps: loading a file deletion list; initializing a target volume metafile $ MFT; analyzing the file records in the $ MFT one by one to generate a file record list; deleting the file with the deletion mark or the file record corresponding to the file folder at $ MFT against the record items of the file record list; deleting the Index information of the deleted file or folder in the Index data of the $ ObjId and $ Repearse file, rearranging and storing the Index data; update the $ Bitmap for the $ MFT; the $ Bitmap of the target volume is updated. All files or folders are recorded by establishing a file recording list, and deletion marks are marked on the files or folders to be deleted, so that the deletion efficiency is improved, and the time for backing up a disk is shortened.

Description

Method and system for performing quick file exclusion aiming at NTFS (New technology File System)

Technical Field

The invention belongs to the technical field of disk backup, and particularly relates to a method and a system for quickly removing files in an NTFS (New technology File System).

Background

NTFS is called New Technology File System in English, and Chinese is named as a New Technology File System, which is a File System in Windows NT environment. NTFS is a restricted-level dedicated file system of the Windows NT family (e.g., Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8.1, etc.). NTFS provides long filenames, data protection and recovery, and achieves security through directory and file permissions. NTFS supports large hard disks and stores files on multiple hard disks. NTFS provides built-in security features that control file membership and access. Files on the NTFS partition cannot be accessed directly from the DOS or other operating system.

The general flow of existing file deletion in the NTFS file system is as follows:

1. and finding the Index Record (IR) corresponding to the File in the parent directory to obtain the File Record Number (FRN) of the File.

2. Delete the IR, adjust the Index Record ordering, and save the Index Record.

3. And releasing the File Record occupied by the File (marked as unused) and saving the File Record.

4. And releasing the control occupied by the file, setting a data bit corresponding to the $ Bitmap according to the dataruns of the attribute of the file, and storing the $ Bitmap.

5. Adjust a metafile of recording file information such as $ ObjId. The Item saved by $ ObjId is also saved by B-tree sorting, and the Item is saved after reordering and adjustment when deleted.

When a disk backup is performed, files or folders that do not need to be backed up need to be excluded. The Windows system API needs to go through the general process when deleting files or folders, the general process needs to be executed once when deleting one file or folder, and if more files or folders need to be deleted, a large amount of time and system resources are consumed, so that the whole backup time is increased.

Disclosure of Invention

In view of this, the present invention provides a method and a system for fast removing files for an NTFS file system, where files or folders to be deleted are deleted uniformly before backup, and a deletion process for each file or folder to be deleted is not required, so as to reduce the time for deleting files.

In order to solve the above technical problems, the present invention provides a method for performing fast file exclusion for an NTFS file system, comprising:

loading a file deletion list, and opening and locking a film copy of a target volume to be backed up in a read-write mode;

initializing a target volume metafile $ MFT, acquiring a Data block list $ MFT-DataRuns of $ Data of the $ MFT and acquiring a $ Bitmap of the $ MFT;

analyzing file records in the $ MFT one by one to form a file record list, wherein the number of record items of the file record list is consistent with the number of the file records; recording basic information of a file or a folder in a file record list, wherein the basic information comprises a deletion mark of the file, a file record number of a parent directory of the file, a deletion mark of the folder, a child item deletion mark, a file record number of a parent directory of the file, and a name of the folder;

deleting the file with the deletion mark or the file record corresponding to the file folder at $ MFT against the record items of the file record list; for the record item with the sub item deletion mark, loading the Index data of the folder, deleting the Index item corresponding to the sub item with the deletion mark, rearranging the undeleted sub items and then saving the Index data;

deleting the Index information of the deleted file or folder in the Index data of the $ ObjId and $ Repearse file, rearranging and storing the Index data;

update the $ Bitmap for the $ MFT;

the $ Bitmap of the target volume is updated.

As an improvement, the parsing file records in the $ MFT piece by piece, forming a file record list, and filling basic information of a file or a folder in the file record list includes:

referring to the file record header of the used file record in the $ MFT and generating a file record list whose number of record items coincides with the number of used file records;

analyzing all 0X30 attributes in the used file records to obtain the names of files or folders and the names of the parent directories, recording the file record numbers of the parent directories of the files into corresponding record items, and recording the names of the folders and the file record numbers of the parent directories of the files into corresponding record items;

the name of the file or the file and the name of the parent directory of the file or the file form a full path of the file or the folder, and whether the file or the folder needs to be deleted or not is judged by comparing the full path with a file deletion list; and setting a deletion mark in the record item corresponding to the file record list for the file or the folder to be deleted, and setting a child item deletion mark in the parent directory record item corresponding to the file or the folder to be deleted.

As an improvement, whether the file record is used is judged using the $ Bitmap in the $ MFT.

Preferably, if a file or folder occupies two or more file records, the basic information is filled in the record item corresponding to the reference file record number in the file record list.

As an improvement, if the file has a plurality of 0X30 attributes, a full path is assembled for each file name in 0X30, a file deletion list is compared, and an exclusion list is established for the 0X30 attribute needing to be deleted.

As an improvement, when all 0X30 attributes in the used file records are analyzed, if the file record of the parent directory of the file or folder pointed to in the 0X30 attribute of the file or folder is not analyzed, the file record corresponding to the parent directory is jumped to for analysis.

As an improvement, when a file or a folder with a deletion flag is deleted, if all 0X30 attributes of the file or the folder need to be deleted, all file records related to the file or the folder are deleted, and file records and storage space occupied by the corresponding file records are released; if a file or folder only has a partial 0X30 attribute that needs to be deleted, then the 0X30 attribute that the file or folder needs to be deleted is deleted.

As an improvement, the undeleted children are rearranged according to the btree algorithm.

The invention also provides a system for fast file exclusion aiming at the NTFS file system, which comprises the following steps:

a file record list creation module for creating a file record list by parsing file records in the $ MFT and recording basic information of a file or a folder in the file record list; the basic information comprises a file deletion mark, a file record number of a parent directory of the file, a file folder deletion mark, a child item deletion mark, a file record number of a parent directory of the file, and a name of the file folder;

the deleting module is used for traversing the file record list, deleting the file or the folder with the deleting mark, and modifying the volume bitmap to release the occupied space of the file or the folder;

and the Index data management module is used for adjusting the Index of the file record with the sub item deletion mark, deleting the Index information related to all the sub items with the deletion marks, and rearranging the Index data.

As an improvement, the method further comprises the following steps:

and $ Bitmap update module for updating $ MFT and $ Bitmap of the target volume.

The invention has the advantages that: the method for rapidly removing the files aiming at the NTFS file system and the system with the structure have the steps, record all the files or folders by establishing the file record list, and mark the deletion marks on the files or folders to be deleted, so that unified deletion operation is carried out, a deletion process does not need to be carried out for each file or folder to be deleted independently, the deletion efficiency is improved, and the time for backing up a disk is shortened.

Drawings

FIG. 1 is a flow chart of the present invention.

Fig. 2 is a schematic diagram of the structure of the present invention.

Detailed Description

In order that those skilled in the art will better understand the technical solutions of the present invention, the present invention will be further described in detail with reference to the following embodiments.

When a disk is backed up, files or folders which do not need to be backed up are firstly excluded so as to save disk space and backup time. So-called "exclusion" refers to the deletion of files and folders that do not require backup from the copy of the volume.

In the NTFS File system, any data in the disk volume exists in the form of "files" or "folders" and is stored in a document called $ MFT (Master File Table). Whereas a $ MFT consists of an array of File records (File Record). The size of the file record is generally fixed, typically 1 KB. A file or folder may occupy multiple file records.

Each file record contains various attributes of the file. The attributes placed within the file record are called resident attributes, such as the 0X30 attribute. If too much file content can be placed outside the file record (nonresident attribute), additional clusters are allocated for storage, and the used clusters form dataRuns information stored in the file record.

As shown in fig. 1, the present invention provides a method for performing fast file exclusion for an NTFS file system, which includes:

s1, loading a file deletion list, and opening and locking a copy of the target volume to be backed up in a read-write mode;

s2 initializes the target volume metafile $ MFT, obtains the Data block list $ MFT-DataRuns of $ Data of $ MFT, and obtains the $ Bitmap corresponding to $ MFT;

s3 analyzes the file records in the $ MFT one by one to form a file record list; recording basic information of a file or a folder in a file record list, wherein the basic information comprises a deletion mark of the file, a file record number of a parent directory of the file, a deletion mark of the folder, a child item deletion mark, a file record number of a parent directory of the file, and a name of the folder;

s4 deleting the file having the deletion flag or the file record corresponding to the folder at $ MFT against the entry of the file record list; for the record item with the sub item deletion mark, loading the Index data of the folder, deleting the Index item corresponding to the sub item with the deletion mark, rearranging the undeleted sub items and then saving the Index data;

s5 deletes the Index information of deleted files or folders in the Index data of $ ObjId, $ Repearse files, rearranges the Index data and saves;

s6 updates the $ Bitmap for the $ MFT;

s7 updates the $ Bitmap of the target volume.

The above steps are explained in detail below.

In step S1, specifically, the copy of the volume shadow of the target volume to be backed up (hereinafter referred to as the target volume) is opened and locked in a read-write manner. Locking is exclusive to a target volume that needs to be backed up, and prevents other programs from performing read/write operations on the target volume so as to avoid errors.

After a user selects all files or folders to be deleted, a file deletion list is formed and is loaded when the system is started.

Specifically, in step S2, the target volume metafile $ MFT is initialized, the Data block list $ MFT-DataRuns of $ Data of $ MFT is acquired, and $ Bitmap in $ MFT is acquired; data block list $ MFT-DataRuns is a list of locations in disk where metafile $ MFT is stored, for storing nonresident attributes of a file or folder. And the $ Bitmap metafile is used to manage the usage of the clusters on the volume. Its data stream consists of a series of two-level system "bits".

Step S3 specifically includes:

s31 refers to the file record header of the file record that has been used in the $ MFT and generates a file record list whose number of record items coincides with the number of file records.

In the invention, the basic information of the file or folder required to be used comprises a file deletion mark, a file record number of a parent directory of the file, a folder deletion mark, a child item deletion mark, a file record number of a parent directory of the file, and the name of the folder. The file or folder deletion mark is used for indicating whether the file or folder needs to be deleted, the sub-item deletion mark is used for indicating whether sub-items in the folder need to be deleted, and the name of the folder is used for being assembled into a full path together with the name of the file.

Therefore, a file recording list AllFileRecord needs to be established to record the basic information of the file or folder. In this embodiment, the file record list is actually an array, an element of the array represents a file record, and a subscript of the element is a file record number of the file record represented by the element (this is also a reason for not recording a file record number of the element itself, so as to save memory). And one element contains several fields for recording basic information of a file or folder.

One entry of the file record list records the basic attribute of a file or a folder, and one entry comprises the following contents: 1. a delete flag, whose value is tube or false, tube representing that the file or folder needs to be deleted; 2. for the folder, there is a sub item deletion flag, whose value is true or false; 3. file record number of parent directory; 4. if the folder is a file, the name of the file is required to be recorded.

In this embodiment, first, whether a file record is used is determined by using $ Bitmap of $ MFT, $ Bitmap of $ MFT is a binary stream, and meaning is expressed by "0" and "1". If a certain "bit" in the $ Bitmap of the $ MFT is 0, indicating that the file record is unused, the file record is empty and no care is taken. If the "bit" is 1, it indicates that the file record is used, and a certain file or folder in the target volume is described.

For the used file records, it is necessary to parse the file records to obtain basic information of the files or folders contained in the file records. Each file record is composed of a file record head and a plurality of attributes, the file record number of a file or a folder is recorded in the file record head, and the name and the file record number of the parent directory are both recorded in the attributes.

In addition, it has been mentioned above that one file or folder may occupy a plurality of (two or more) file records, and for such a file or folder, the reference file record number thereof is used as the file record number of the file or folder, and the basic information thereof is filled in the record item corresponding to the file record number in the file record list. When a file or folder occupies a plurality of file records, one of the most important file records is called a reference file record, and the record number of the reference file record is called as a reference file record number. In the invention, only the basic information of the file or the folder needs to be filled in the record item corresponding to the record number of the reference file.

S32 analyzing all 0X30 attributes in the used file record to obtain the name of the file or folder and the name of the father directory thereof, recording the father directory file record number of the file into the corresponding record item, and recording the name of the folder and the file record number of the father directory thereof into the corresponding record item;

the method mainly comprises the steps of obtaining the name of a file or a folder and the name of a parent directory of the file or the folder through analysis, obtaining the file record number of the parent directory, and recording the file record number of the parent directory of the file or the folder into a record item.

S33, the name of the file or the file and the name of the parent directory form the full path of the file or the folder, and whether the file or the folder needs to be deleted is judged by comparing the full path with the file deletion list; and setting a deletion mark in the record item corresponding to the file record list for the file or the folder to be deleted, and setting a child item deletion mark in the parent directory record item corresponding to the file or the folder to be deleted.

Whether a file or folder is to be deleted is determined by comparing its full path with the file deletion list. Because files or folders with the same name may exist in different paths, the accurate judgment can be carried out only by the full path.

If the file has a plurality of 0X30 attributes, an exclusion list is established for the 0X30 attributes which need to be deleted. In the NTFS file system, a file is allowed to have multiple names (only the file has a hard link and is not supported by a folder), and a user may only want to delete certain file names, so that an exclusion list is created for the 0X30 attribute of the file to be deleted and added to the file record list.

When analyzing all the 0X30 attributes in the used file records, if the file record of the parent directory of the file or folder pointed to by the 0X30 attribute of the file or folder is not analyzed, the file record corresponding to the parent directory is skipped to and analyzed. This is because when the $ MFT is parsed sequentially, the locations of the file records of the parent-child relationship in the $ MFT are in random order. If the child file or folder is arranged in front of the parent directory, a jump to the parent directory is needed to acquire the information of the parent directory first. This is to analyze all the ancestor directories of a file or folder to obtain the full path of the file when analyzing the file or folder, and determine whether the file or folder is set to be deleted by the user by using the full path.

Specifically, in step S4, the file or folder having the deletion flag and some 0X30 attributes of the file or folder are found against the entries of the file record list. The corresponding file record in the $ MFT is then deleted.

When the file or the folder with the deletion mark is deleted, if all 0X30 attributes of the file or the folder need to be deleted, all file records related to the file or the folder are deleted, and the data blocks occupied by the corresponding file records are released; if a file or folder only has a partial 0X30 attribute that needs to be deleted, then the 0X30 attribute that the file or folder needs to be deleted is deleted.

And if the folder has the sub items deleted, loading the Index data of the folder, deleting the Index items of the sub items to be deleted, rearranging the undeleted sub items according to the B-Tree algorithm, and storing the Index data. The purpose of this step is to update Index data after deleting the removed file or folder, so as to avoid Index errors.

Specifically, in step S5, the Index information of the deleted file or folder is deleted from the Index data of the $ ObjId, $ Reparse file, and the Index data is rearranged and stored. The $ ObjId, $ Reparse is also a metafile inherent in the NTFS file system, and after a file or a folder is deleted, the related files need to be processed so that the file system does not report an error.

In step S6, specifically, the $ Bitmap of the $ MFT is updated

In step S7, specifically, the $ Bitmap of the target volume is updated.

The invention also provides a system for fast file exclusion aiming at the NTFS file system, which comprises the following steps:

a file record list creation module for creating a file record list by parsing a file record in the $ MFT, and recording basic information of a file or a folder in the file record list; the basic information comprises a file deletion mark, a file record number of a parent directory of the file, a file folder deletion mark, a child item deletion mark, a file record number of a parent directory of the file, and a name of the file folder;

a deleting module, configured to delete a file or a file folder with a deletion flag in a file record corresponding to $ MFT with reference to a record item in the file record list, and modify the volume bitmap to release the space occupied by the file or the file folder;

and the Index data management module is used for adjusting the Index of the file record with the sub item deletion mark, deleting the Index information related to all the sub items with the deletion marks, and rearranging the Index data.

And $ Bitmap update module for updating $ MFT and $ Bitmap of the target volume.

The file record numbers and the deletion marks of all files or folders are recorded by establishing a file record list, and then the files or folders to be deleted are deleted in a unified way. The deletion process does not need to be carried out for each file or folder to be deleted once, so that system resources are saved, and backup time is shortened.

The above is only a preferred embodiment of the present invention, and it should be noted that the above preferred embodiment should not be considered as limiting the present invention, and the protection scope of the present invention should be subject to the scope defined by the claims. It will be apparent to those skilled in the art that various modifications and adaptations can be made without departing from the spirit and scope of the invention, and these modifications and adaptations should be considered within the scope of the invention.

Claims (10)

1. A method for fast file exclusion for NTFS file systems, comprising:

loading a file deletion list, and opening and locking a film copy of a target volume to be backed up in a read-write mode;

initializing a target volume metafile $ MFT, acquiring a Data block list $ MFT-DataRuns of $ Data of the $ MFT and acquiring a $ Bitmap of the $ MFT;

analyzing the file records in the $ MFT one by one to generate a file record list; recording basic information of a file or a folder in a file record list, wherein the basic information comprises a deletion mark of the file, a file record number of a parent directory of the file, a deletion mark of the folder, a child item deletion mark, a file record number of a parent directory of the file, and a name of the folder;

deleting the file with the deletion mark or the file record corresponding to the file folder at $ MFT against the record items of the file record list; for the record item with the sub item deletion mark, loading the Index data of the folder, deleting the Index item corresponding to the sub item with the deletion mark, rearranging the undeleted sub items and then saving the Index data;

deleting the Index information of the deleted file or folder in the Index data of the $ ObjId and $ Repearse file, rearranging and storing the Index data;

update the $ Bitmap for the $ MFT;

the $ Bitmap of the target volume is updated.

2. The method of claim 1, wherein parsing the file records in $ MFT one by one to form a file record list, and filling the basic information of a file or folder in the file record list comprises:

referring to the file record header of the used file record in the $ MFT and generating a file record list whose number of record items coincides with the number of used file records;

analyzing all 0X30 attributes in the used file records to obtain the names of files or folders and the names of the parent directories, recording the file record numbers of the parent directories of the files into corresponding record items, and recording the names of the folders and the file record numbers of the parent directories of the files into corresponding record items;

the name of the file or the file and the name of the parent directory of the file or the file form a full path of the file or the folder, and whether the file or the folder needs to be deleted or not is judged by comparing the full path with a file deletion list; and setting a deletion mark in the record item corresponding to the file record list for the file or the folder to be deleted, and setting a child item deletion mark in the parent directory record item corresponding to the file or the folder to be deleted.

3. The method of claim 2, wherein the method for fast file exclusion for NTFS file system comprises: whether the file record is used is judged using $ Bitmap of $ MFT.

4. The method of claim 2, wherein the method for fast file exclusion for NTFS file system comprises: if the file or the folder occupies two or more file records, the basic information is filled in the record item corresponding to the reference file record number in the file record list.

5. The method of claim 2, wherein the method for fast file exclusion for NTFS file system comprises: if the file has a plurality of 0X30 attributes, a full path is assembled for each file name in 0X30, a file deletion list is compared, and an exclusion list is established for the 0X30 attribute needing to be deleted.

6. The method of claim 2, wherein the method for fast file exclusion for NTFS file system comprises: when analyzing all 0X30 attributes in the used file records, if the file record of the parent directory of the file or folder pointed to by the 0X30 attribute of the file or folder is not analyzed, jumping to the file record corresponding to the parent directory for analysis.

7. The method of claim 1 for fast file exclusion for NTFS file system, wherein: when the file or the folder with the deletion mark is deleted, if all 0X30 attributes of the file or the folder need to be deleted, all file records related to the file or the folder are deleted, and file records and storage space occupied by the corresponding file records are released; if a file or folder only has a partial 0X30 attribute that needs to be deleted, then the 0X30 attribute that the file or folder needs to be deleted is deleted.

8. The method of claim 1 for fast file exclusion for NTFS file system, wherein: the undeleted children are rearranged according to the B-Tree algorithm.

9. A system for fast file exclusion for NTFS file systems, comprising:

a file record list creation module for creating a file record list by parsing a file record in the $ MFT, and recording basic information of a file or a folder in the file record list; the basic information comprises a file deletion mark, a file record number of a parent directory of the file, a file folder deletion mark, a child item deletion mark, a file record number of a parent directory of the file, and a name of the file folder;

a deleting module, configured to delete a file or a file folder with a deletion flag in a file record corresponding to $ MFT with reference to a record item in the file record list, and modify the volume bitmap to release the space occupied by the file or the file folder;

and the Index data management module is used for adjusting the Index of the file record with the sub item deletion mark, deleting the Index information related to all the sub items with the deletion marks, and rearranging the Index data.

10. The system according to claim 9, further comprising:

and $ Bitmap update module for updating $ MFT and $ Bitmap of the target volume.

Images