CN115168105A - Method for recovering thumbnail of Windows deleted picture and related device - Google Patents
Method for recovering thumbnail of Windows deleted picture and related device Download PDFInfo
- Publication number
- CN115168105A CN115168105A CN202210821048.3A CN202210821048A CN115168105A CN 115168105 A CN115168105 A CN 115168105A CN 202210821048 A CN202210821048 A CN 202210821048A CN 115168105 A CN115168105 A CN 115168105A
- Authority
- CN
- China
- Prior art keywords
- hash
- picture
- identifier
- windows
- file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1446—Point-in-time backing up or restoration of persistent data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/172—Caching, prefetching or hoarding of files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/50—Information retrieval; Database structures therefor; File system structures therefor of still image data
- G06F16/51—Indexing; Data structures therefor; Storage structures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/50—Information retrieval; Database structures therefor; File system structures therefor of still image data
- G06F16/53—Querying
- G06F16/532—Query formulation, e.g. graphical querying
Abstract
The invention discloses a method and a device for recovering a thumbnail of a Windows deleted picture, which comprises the following steps: acquiring all thumbnail cache files of Windows; traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table; traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and storing all the generated second hash identifiers to a second hash table; comparing the first hash table with the second hash table, and judging whether the second hash table has a second hash identifier which is the same as the first hash identifier in the first hash table; and if the picture corresponding to the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture. The method has the advantages that: the reliability is high, the long-term deleted pictures can be retrieved, and the retrieved deleted pictures cannot be damaged.
Description
Technical Field
The invention relates to the technical field of data recovery, in particular to a method and a related device for recovering a thumbnail of a Windows deleted picture.
Background
With the development of science and technology, the popularity of electronic devices has increased greatly, and a Windows system is one of the main operating systems of electronic devices, and related products carrying the Windows system are used in large quantities, and when using related products, users may delete pictures carelessly, and a general Windows system carries a recycle bin, and users can directly recover the deleted pictures at the recycle bin, but due to some special reasons, the pictures in the recycle bin are also deleted, and under such a condition, users cannot generally recover the deleted pictures.
At present, there are two main means for restoring Windows deleted pictures. One is to restore and delete the picture by backing up the disk or the computer picture regularly, and the main software is such as the backup of the auume easily, the 360-degree cloud disk, the Baidu cloud disk and the like. And the other method is to scan and analyze the magnetic disk by using the principle that the magnetic disk cannot really delete file data but is marked as deletion, and restore and delete pictures from the magnetic disk, wherein main software of the magnetic disk comprises EaseUS data restoration genius, windows data restoration tools of the university of cattle and the like.
The two recovery modes also have related problems, the first backup software needs to be backed up regularly, and the deleted pictures cannot be retrieved when the backup is deleted or forgotten. The second type of software for scanning and analyzing the disk has the problem that the deleted picture is long or the deleted picture data is covered by other data due to the fact that the disk for deleting the picture is subjected to multiple read-write operations.
Disclosure of Invention
The invention provides a method and a device for restoring a thumbnail of a Windows deleted picture, and aims to solve the problem that the conventional restoring technology needs to be backed up regularly or is easily covered by other data.
In a first aspect, an embodiment of the present invention provides a method for recovering a thumbnail of a Windows deleted picture, including:
acquiring all thumbnail cache files of Windows;
traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table;
traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and storing all the generated second hash identifiers to a second hash table;
comparing the first hash table with the second hash table, and judging whether a second hash identifier identical to the first hash identifier in the first hash table exists in the second hash table;
and if the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture.
In a second aspect, an embodiment of the present invention provides an apparatus for recovering a thumbnail of a Windows deleted picture, including:
the acquisition unit is used for acquiring all thumbnail cache files of Windows;
the first hash table storage unit is used for traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table;
the second hash table storage unit is used for traversing all picture files in the Windows system, generating corresponding second hash identifiers according to the paths of the picture files and storing all the generated second hash identifiers to a second hash table;
the judging unit is used for comparing the first hash table with the second hash table and judging whether a second hash identifier which is the same as the first hash identifier in the first hash table exists in the second hash table;
and the recovery unit is used for marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture if the first hash identifier does not exist.
In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the method for recovering thumbnails of Windows deleted pictures in the foregoing first aspect when executing the computer program.
In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the method for restoring a thumbnail of a Windows delete picture according to the first aspect.
The embodiment of the invention provides a method for recovering a thumbnail of a Windows deleted picture, which comprises the following steps: acquiring all thumbnail cache files of Windows; traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table; traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and storing all the generated second hash identifiers to a second hash table; comparing the first hash table with the second hash table, and judging whether the second hash table has a second hash identifier which is the same as the first hash identifier in the first hash table; and if the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture. The method utilizes a mechanism of Windows for storing the thumbnail, and the mechanism can not cause other data to cover and delete picture data by reading and writing the disk for many times, so that the method has higher reliability than scanning the disk, can retrieve a long-term deleted picture, and cannot damage the retrieved deleted picture. The embodiment of the invention also provides a device for recovering the thumbnail of the Windows deleted picture, a computer readable storage medium and computer equipment, which have the beneficial effects and are not repeated herein.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a schematic flowchart of a thumbnail method for restoring a Windows deleted picture according to an embodiment of the present invention;
FIG. 2 is a schematic sub-flow diagram of a method for restoring a thumbnail of a Windows deleted picture according to an embodiment of the present invention;
FIG. 3 is another schematic sub-flow diagram of a thumbnail method for restoring a Windows deleted picture according to an embodiment of the present invention;
fig. 4 is a schematic block diagram of an apparatus for restoring a thumbnail of a Windows deleted picture according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should be further understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
Referring to fig. 1, the embodiment provides a method for recovering a thumbnail of a Windows deleted picture, including:
s101: acquiring all thumbnail cache files of Windows;
s102: traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table;
s103: traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and storing all the generated second hash identifiers to a second hash table;
s104: comparing the first hash table with the second hash table, and judging whether the second hash table has a second hash identifier which is the same as the first hash identifier in the first hash table;
s105: and if the picture corresponding to the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture.
The thumbnail cache file of Windows is generally stored under the Explorer directory, so that the path can be followed: % USERProfile% \ Appdata \ Local \ Microsoft \ Windows \ Explorer to acquire the thumbnail cache file, wherein, the thumbnail cache file may be a thumbnail db file, which is typically used to store thumbnails in a Windows system.
In one embodiment, referring to fig. 2, the step S102 includes:
s201: traversing and opening all thumbnail cache files of Windows;
s202: reading a hash character string in the thumbnail cache file;
s203: reading the picture data in the thumbnail cache file;
s204: storing the read picture data into a corresponding format file according to the head characteristics of each picture;
s205: and taking the hash character string as a first hash identifier of the corresponding picture, and storing all the first hash identifiers in a first hash table.
The method for acquiring and judging the Windows version adopted in the embodiment comprises the steps of firstly opening all thumbnail cache files of Windows in a traversing manner, then skipping 4 bytes, reading small-end integer value version of 4 bytes, and judging the Windows version according to comparison of the read small-end integer value version and a 16-system numerical value corresponding to each version of Windows.
And if the version is equal to Windows _ Vista, windows _7 or Windows _8, directly reading the 4-byte small-end integer value first _ cache _ entry, and if the version is equal to Windows _8v2, windows _8v3, windows _8 _1or Windows _10, skipping 4 bytes and reading the 4-byte small-end integer value first _ cache _ entry.
Reading the first _ cache _ entry, then jumping to the offset position of the first _ cache _ entry, reading a 4-byte character string magic _ identifier, then judging whether the character string magic _ identifier is equal to CMMM, if the character string magic _ identifier is equal to CMMM, directly reading a 4-byte small-end integer value cache _ entry _ size behind the CMMM, if the character string magic _ identifier is not equal to CMMM, firstly searching the offset position of the CMMM byte by byte, and then reading a 4-byte small-end integer value cache _ entry _ size behind the CMMM.
And then judging the Windows version, if the Windows version is Windows _ Vista, skipping 16 bytes, reading the small end integer value filename _ length of 4 bytes, then reading the small end integer value padding _ size of 4 bytes, then reading the small end integer value data _ size of 4 bytes, if the Windows version is not Windows _ Vista, skipping 8 bytes, then reading the small end integer value padding _ length of 4 bytes, then reading the small end integer value padding _ size of 4 bytes, and then reading the small end integer value data _ size of 4 bytes.
And then judging the Windows version, if the Windows version is Windows _ Vista or Windows _7, skipping 28 bytes, reading the file string file of the file _ length byte, if the Windows version is not Windows _ Vista or Windows _7, skipping 20 bytes, and reading the hash character string file of the file _ length byte.
Skipping the padding _ size bytes, reading the picture data img _ buf in the data _ size bytes, saving the read picture data img _ buf as a corresponding format file according to the head characteristics of each picture, and storing the hash character string filename as a first hash identifier of the picture into a first hash table H1.
And then judging whether the thumbnail cache file reaches the end, if the thumbnail cache file reaches the end, reading the next thumbnail cache file, if the thumbnail cache file does not reach the end, reading the subsequent content of the thumbnail cache file, repeatedly executing the content until all the thumbnail cache files are completely read, and storing all the first hash identifiers into a first hash table H1.
It should be noted that, what is claimed in the present application is a method for storing a hash string into a first hash table as a first hash identifier of a corresponding picture by reading the hash string, which is only one of the methods exemplified in the present application, and any other method for obtaining the hash string and then storing the hash string into the first hash table as the first hash identifier of the corresponding thumbnail is all the contents claimed in the present application.
The pictures mentioned in the description of step S102 are thumbnails.
In an embodiment, referring to fig. 3, the step S103 includes:
s301: traversing all picture files in the Windows system;
s302: acquiring a unique identifier of a drive letter where a file path of a picture file is located, performing hash operation on binary content and a hexadecimal numerical value of the unique identifier, and storing an operation result as a first intermediate hash identifier;
s303: acquiring a file identifier and a file suffix name of a picture file, acquiring FILETIME of the last writing time of the picture file, and converting FILETIME into DosDateTime;
s304: carrying out hash operation on the first intermediate hash identifier, the file suffix name and the DosDateTime in sequence, and storing an operation result to a second hash identifier;
s305: and saving the second hash identifier to a second hash table.
Before step S301, all files in the Windows system need to be traversed to obtain the picture files in the Windows system, and there are various ways to obtain the picture files, which are not described herein repeatedly, and a common method is to perform filtering according to suffix names of pictures, such as jpg, jpeg, png, and the like.
In one embodiment, the unique identifier in step S302 is a CLSID, and the CLSID is obtained by calling two functions, namely GetVolumeNameForVolumeMountPoint and clsidfromstrongwhich is a unique identifier type defined in the windows.
In one embodiment, the hexadecimal value in step S302 is 0x95E729BA2C37FD21.
The following describes specific operations of the hash operations in steps S302 and S304:
s1, setting an input parameter 1 as data, setting an input parameter 2 as hash, and setting the length of binary content of the data as length;
s2, acquiring a first byte b of the data;
s3, multiplying the hash by 2080, adding a 10-system numerical value corresponding to b, and adding the hash and dividing by 4 to obtain a value tmp;
s4, carrying out XOR operation on the hash and the tmp according to bits, and storing an obtained result into a hash variable;
s5, acquiring the next byte b of the data, and repeating the operations s2-s4 until all bytes of the data are processed;
and s6, outputting the final result hash.
Step S303 is explained below, wherein before acquiring the file identifier of the picture file, a handle of the picture file needs to be acquired, and then a file identifier of the picture file is obtained through operation;
the operation mode is as follows:
an interface function GetFileInformationByHandle provided by a Windows system can be called to obtain the attribute bhfi of the picture file;
the method comprises the steps of taking bhfi. NFileIndexHigh in an attribute bhfi as the high 32 bytes in 64-byte content;
the bhfi. Nfileindexlow in the attribute bhfi is taken as the lower 32 bytes in the 64-byte content;
and using the obtained 64-byte content as a file identifier of the picture file.
The specific contents of obtaining the FILETIME of the last writing time of the picture file and converting the FILETIME into DosDateTime are as follows:
the method comprises the steps of calling an interface function FileTimeToDosDateTime provided by a Windows system to obtain a date configuration table fat _ date and a time configuration table fat _ time of a picture file, using the date configuration table fat _ date as the upper 16 bytes of 32-byte content, using the time configuration table fat _ time as the lower 16 bytes of the 32-byte content, and using the obtained 32-byte content as DosDateTime.
In one embodiment, step S304 includes:
performing hash operation on the first intermediate hash identifier and the file identifier to obtain a second intermediate hash identifier;
performing hash operation on the second intermediate hash identifier and the file suffix name to obtain a third intermediate hash identifier;
and carrying out hash operation on the third intermediate hash identifier and DosDateTime to obtain a fourth intermediate hash identifier.
Wherein, after obtaining the fourth intermediate hash identifier, step S304 further includes: and converting the DosDateTime into a new FILETIME, acquiring a difference value between the new FILETIME and the old FILETIME, if the difference value is not 0, performing hash operation on the difference value and a fourth intermediate hash identifier, storing an operation result to a second hash identifier, storing the second hash identifier to a second hash table, and if the difference value is 0, directly storing the fourth intermediate hash identifier as the second hash identifier to the second hash table.
After the second hash identifier is stored in the second hash table, comparing the first hash table with the second hash table, and judging whether the second hash table has the second hash identifier which is the same as the first hash identifier in the first hash table; and if the picture corresponding to the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture, and if the picture corresponding to the first hash identifier exists, marking the picture corresponding to the first hash identifier as an undeleted picture.
If the format of the deleted picture to be obtained is known, a step of filtering pictures in other formats may be added after step S204 (the read picture data is saved as a corresponding format file according to the header characteristics of each picture), or picture files in other formats may be directly filtered in the process of obtaining picture files in the Windows system.
The pictures mentioned in the description of step S103 are system pictures.
In an embodiment, referring to fig. 4, the present invention further provides an apparatus 400 for restoring a thumbnail of a Windows deleted picture, including:
an obtaining module 401, configured to obtain all thumbnail cache files of Windows;
the first hash table storage module 402 is configured to traverse all thumbnail cache files of Windows, acquire all pictures in the thumbnail cache files, and store first hash identifiers corresponding to all the pictures in a first hash table;
the second hash table storage module 403 is configured to traverse all picture files in the Windows system, generate corresponding second hash identifiers according to paths of the picture files, and store all the generated second hash identifiers in a second hash table;
a determining module 404, configured to compare the first hash table with the second hash table, and determine whether the second hash table has a second hash identifier that is the same as the first hash identifier in the first hash table;
a recovering module 405, configured to mark the picture corresponding to the first hash identifier as a deleted picture and recover the deleted picture if the deleted picture does not exist.
Further, the first hash table storage module 402 includes:
the traversal unit is used for opening all thumbnail cache files of Windows in a traversal mode;
the hash character string reading unit is used for reading the hash character string in the thumbnail cache file;
the picture data reading unit is used for reading the picture data in the thumbnail cache file;
the storage unit is used for storing the read picture data into a corresponding format file according to the head characteristics of each picture;
and the first hash table storage unit is used for taking the hash character string as a first hash identifier of the corresponding picture and storing all the first hash identifiers in a first hash table.
Further, the second hash table storage module 403 includes:
the picture file traversing unit is used for traversing all picture files in the Windows system;
the first intermediate hash identifier acquisition unit is used for acquiring the unique identifier of the drive mark where the file path of the picture file is located, performing hash operation on binary content and a hexadecimal numerical value of the unique identifier, and storing an operation result as a first intermediate hash identifier;
an obtaining unit, configured to obtain a file identifier and a file suffix of the picture file, obtain FILETIME of the last write time of the picture file, and convert the FILETIME into DosDateTime;
the operation unit is used for carrying out hash operation on the first intermediate hash identifier, the file suffix name and the DosDateTime in sequence and storing an operation result to the second hash identifier;
and the second hash table storage unit is used for saving the second hash identifier to the second hash table.
Further, the acquiring unit includes:
the attribute acquisition unit is used for calling an interface function provided by the Windows system to acquire the attribute bhfi of the picture file;
a high byte obtaining unit, configured to take bhfi. Nfileindexhigh in the attribute bhfi as 32 high bytes in the 64-byte content;
a low byte obtaining unit, configured to take bhfi. Nfileindexlow in the attribute bhfi as the low 32 bytes in the 64-byte content;
and a file identifier acquisition unit, configured to use the obtained 64-byte content as a file identifier of the picture file.
Further, the acquiring unit further includes:
and the conversion unit is used for calling an interface function provided by the Windows system to acquire a date configuration table and a time configuration table of the picture file, taking the date configuration table as the upper 16 bytes in the 32-byte content, taking the time configuration table as the lower 16 bytes in the 32-byte content, and taking the obtained 32-byte content as DosDateTime.
Further, the arithmetic unit includes:
the second intermediate hash identifier acquisition unit is used for carrying out hash operation on the first intermediate hash identifier and the file identifier to obtain a second intermediate hash identifier;
a third intermediate hash identifier obtaining unit, configured to perform hash operation on the second intermediate hash identifier and the file suffix name to obtain a third intermediate hash identifier;
and the fourth intermediate hash identifier acquisition unit is used for carrying out hash operation on the third intermediate hash identifier and the DosDateTime to obtain a fourth intermediate hash identifier.
Further, the arithmetic unit further includes:
and the judging unit is used for converting the DosDateTime into a new FILETIME, acquiring a difference value between the new FILETIME and the old FILETIME, if the difference value is not 0, performing hash operation on the difference value and a fourth intermediate hash identifier, storing an operation result to the second hash identifier, storing the second hash identifier to the second hash table, and if the difference value is 0, directly storing the fourth intermediate hash identifier as the second hash identifier to the second hash table.
It is clear to those skilled in the art that, for convenience and simplicity of description, the specific working processes of the above devices and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
The present invention also provides a computer-readable storage medium, on which a computer program is stored, which, when executed, may implement the method provided by the above-described embodiments. The storage medium may include: various media capable of storing program codes, such as a usb disk, a portable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
The invention also provides a computer device, which may include a memory and a processor, wherein the memory stores a computer program, and the processor may implement the method provided by the above embodiment when calling the computer program in the memory. Of course, the computer device may also include various network interfaces, power supplies, and the like.
The embodiments are described in a progressive mode in the specification, the emphasis of each embodiment is on the difference from the other embodiments, and the same and similar parts among the embodiments can be referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description. It should be noted that, for those skilled in the art, it is possible to make various improvements and modifications to the present invention without departing from the principle of the present invention, and those improvements and modifications also fall within the scope of the claims of the present invention.
It is further noted that, in the present specification, relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
Claims (10)
1. A method for restoring thumbnails of Windows deleted pictures is characterized by comprising the following steps:
acquiring all thumbnail cache files of Windows;
traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table;
traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and storing all the generated second hash identifiers to a second hash table;
comparing the first hash table with the second hash table, and judging whether a second hash identifier identical to the first hash identifier in the first hash table exists in the second hash table;
and if the first hash identifier does not exist, marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture.
2. The method for recovering thumbnails of Windows deleted pictures according to claim 1, wherein traversing all the thumbnail cache files of Windows, acquiring all the pictures in the thumbnail cache files, and saving the first hash identifiers corresponding to all the pictures in the first hash table, includes:
traversing and opening all thumbnail cache files of Windows;
reading a hash character string in the thumbnail cache file;
reading the picture data in the thumbnail cache file;
storing the read picture data into a corresponding format file according to the head characteristics of each picture;
and taking the hash character string as a first hash identifier of the corresponding picture, and storing all the first hash identifiers in a first hash table.
3. The method for recovering thumbnails of Windows deleted pictures according to claim 1, wherein traversing all picture files in the Windows system, generating corresponding second hash identifiers according to file paths of the picture files, and saving all the generated second hash identifiers to the second hash table includes:
traversing all picture files in the Windows system;
acquiring a unique identifier of a drive letter where a file path of the picture file is located, performing hash operation on binary content and a hexadecimal numerical value of the unique identifier, and storing an operation result as a first intermediate hash identifier;
acquiring a file identifier and a file suffix of the picture file, acquiring FILETIME of the last writing time of the picture file, and converting FILETIME into DosDateTime;
carrying out hash operation on the first intermediate hash identifier, the file suffix name and the DosDateTime in sequence, and storing an operation result to a second hash identifier;
and saving the second hash identifier to a second hash table.
4. The method for restoring the thumbnail of the Windows deleted picture as claimed in claim 3, wherein the obtaining the file identifier of the picture file comprises:
calling an interface function provided by a Windows system to acquire an attribute bhfi of the picture file;
the bhfi.nfileindexhigh in the attribute bhfi is taken as the high 32 bytes in the 64-byte content;
the bhfi. Nfileindexlow in the attribute bhfi is taken as the lower 32 bytes in the 64-byte content;
and taking the obtained 64-byte content as a file identifier of the picture file.
5. The method for recovering thumbnails of Windows deleted pictures according to claim 3, wherein the obtaining FILETIME of the last writing time of the picture file, and the converting FILETIME into DosDateTime includes:
and calling an interface function provided by a Windows system to obtain a date configuration table and a time configuration table of the picture file, taking the date configuration table as the upper 16 bytes in the 32-byte content, taking the time configuration table as the lower 16 bytes in the 32-byte content, and taking the obtained 32-byte content as DosDateTime.
6. The method for recovering the thumbnail of the Windows deleted picture according to claim 3, wherein the performing the hash operation on the first intermediate hash identifier, the file suffix name, and the DosDateTime in sequence, and saving the operation result to the second hash identifier and the second hash identifier to the second hash table includes:
performing hash operation on the first intermediate hash identifier and the file identifier to obtain a second intermediate hash identifier;
performing hash operation on the second intermediate hash identifier and the file suffix name to obtain a third intermediate hash identifier;
and carrying out hash operation on the third intermediate hash identifier and DosDateTime to obtain a fourth intermediate hash identifier.
7. The method for recovering thumbnails of Windows deleted pictures according to claim 6, wherein the performing the hash operation on the first intermediate hash identifier, the file suffix name, and the DosDateTime in sequence, and saving the operation result to the second hash identifier, and the saving the second hash identifier to the second hash table further includes:
and converting the DosDateTime into a new FILETIME, acquiring a difference value between the new FILETIME and the old FILETIME, if the difference value is not 0, performing hash operation on the difference value and a fourth intermediate hash identifier, storing an operation result to a second hash identifier, storing the second hash identifier to a second hash table, and if the difference value is 0, directly storing the fourth intermediate hash identifier as the second hash identifier to the second hash table.
8. An apparatus for restoring thumbnails of Windows deleted pictures, comprising:
the acquisition unit is used for acquiring all thumbnail cache files of Windows;
the first hash table storage unit is used for traversing all thumbnail cache files of Windows, acquiring all pictures in the thumbnail cache files, and storing first hash identifiers corresponding to all the pictures in a first hash table;
the second hash table storage unit is used for traversing all picture files in the Windows system, generating corresponding second hash identifiers according to the paths of the picture files, and storing all the generated second hash identifiers to a second hash table;
the judging unit is used for comparing the first hash table with the second hash table and judging whether a second hash identifier identical to the first hash identifier in the first hash table exists in the second hash table;
and the recovery unit is used for marking the picture corresponding to the first hash identifier as a deleted picture and recovering the deleted picture if the first hash identifier does not exist.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor when executing the computer program implements the method for restoring thumbnails of Windows deletion pictures according to any of claims 1 to 7.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, causes the processor to execute the method of restoring thumbnails of Windows deletion pictures according to any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210821048.3A CN115168105A (en) | 2022-07-12 | 2022-07-12 | Method for recovering thumbnail of Windows deleted picture and related device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210821048.3A CN115168105A (en) | 2022-07-12 | 2022-07-12 | Method for recovering thumbnail of Windows deleted picture and related device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115168105A true CN115168105A (en) | 2022-10-11 |
Family
ID=83493598
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210821048.3A Pending CN115168105A (en) | 2022-07-12 | 2022-07-12 | Method for recovering thumbnail of Windows deleted picture and related device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115168105A (en) |
-
2022
- 2022-07-12 CN CN202210821048.3A patent/CN115168105A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100524285C (en) | Bill processing device and method | |
| KR101130366B1 (en) | Method, medium, and system for recovering data using a timeline-based computing environment | |
| US8812563B2 (en) | System for permanent file deletion | |
| US20160259805A1 (en) | Method for graphical representation of a content collection | |
| CN110569147B (en) | Deleted file recovery method based on index, terminal device and storage medium | |
| Mikus et al. | An analysis of disc carving techniques | |
| CN109753382B (en) | Recovery method and system for database deleted records | |
| US20040143609A1 (en) | System and method for data extraction in a non-native environment | |
| CN110059214B (en) | Image resource processing method and device | |
| CN112115002A (en) | Method and device for recovering file from damaged or non-trusted mechanical hard disk | |
| CN106874399B (en) | Networking backup system and backup method | |
| US11042507B2 (en) | System and method of deletion of files and counteracting their restoration | |
| US20140244699A1 (en) | Apparatus and Methods for Selective Location and Duplication of Relevant Data | |
| CN107220146B (en) | File scanning recovery method and device | |
| CN112463734A (en) | File retrieval method, system and related device | |
| JPWO2020015613A5 (en) | ||
| CN115168105A (en) | Method for recovering thumbnail of Windows deleted picture and related device | |
| KR101111400B1 (en) | Apparatus and method for recovering the data of embeded system | |
| CN112835858A (en) | Method, device and equipment for recovering non-continuously stored files and storage medium | |
| CN114281769A (en) | Method and device for managing files on disk, computer equipment and storage medium | |
| KR101539617B1 (en) | File wiping method according to file type structure in mobile system, and apparatus thereof | |
| JP2003337822A (en) | Compression retrieval archive processing method, compression retrieval archive processing program and recording medium with its program recorded | |
| JP2925042B2 (en) | Information link generation method | |
| JP2005258592A (en) | Format conversion device and file search device | |
| KR20110023580A (en) | The method and system for recovering data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |