CN1959649A - Method for rebuilding directory structure and recovering data in NTFS volume - Google Patents
Method for rebuilding directory structure and recovering data in NTFS volume Download PDFInfo
- Publication number
- CN1959649A CN1959649A CN 200610122248 CN200610122248A CN1959649A CN 1959649 A CN1959649 A CN 1959649A CN 200610122248 CN200610122248 CN 200610122248 CN 200610122248 A CN200610122248 A CN 200610122248A CN 1959649 A CN1959649 A CN 1959649A
- Authority
- CN
- China
- Prior art keywords
- file
- data
- mft
- information
- document
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
A method for rebuilding up catalogue and for restoring data in NTFS volume includes file scanning course as positioning SMFT data, making ergodic on file of MFT, obtaining father catalogue and rebuilding path of said file, transferring to B or F and entering file restoration course as selecting out a table item by making ergodic on file information table, setting up file on path assigned by user, writing in file data on newly set up file according to file size and file position, judging whether file table is the last table item or not and ending process if it is or otherwise returning back to selecting step.
Description
Technical field
The present invention relates to computer application field, relate in particular to a kind of method of recovering data in the disk.
Background technology
When a NTFS subregion is caused file to lose by reasons such as virus, hacker's destruction, mistake format manipulation, software improper uses, during the subregion inaccessible, can the recovery file data be not enough often, also must be able to reappear the bibliographic structure of these files, and recover the filename of these files before losing, such as in the software a lot of data files being arranged, they have the fixed schedule structure, if these TOC levels and filename are destroyed, even recovered the file in all these software catalogs, this software still can not normally move.
Summary of the invention
The present invention has overcome shortcoming of the prior art, and a kind of method that file data and document directory structure are together recovered is provided.
In order to solve the problems of the technologies described above, be achieved through the following technical solutions:
The method of rebuilding directory structure and restore data in the NTFS volume, it comprises that file scan and file recover two processes, the file scan process comprises the steps:
A, $MFT data field, location;
B, traversal file MFT;
C, from this document MFT, obtain parent directory information, and upwards visit all catalogues on it, rebulid the path of this document simultaneously according to the directory name of all catalogues on it;
D, in the file information table that comprises include file position that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of this document;
E, to judge whether to arrive $MFT last, and not being changes B, and being changes F;
F, ends file scanning process enter file rejuvenation;
File recovers module and comprises the steps:
1. traversal is taken out a list item from the file information table that above-mentioned file scan process is set up;
2. set up file according to file type information in the table in the specified path of user;
3. according to document size information and the memory location of file in disk in the table file of firm foundation is write file data;
4. judge that whether the file table is the last list item in the above-mentioned file information table, if enter step 5, otherwise returns step 1;
5. finish.
The inventive method does not rely on original file system, directly the sector of disk is scanned, in conjunction with the special sign that some particular file types had, judge the particular location of this document in disk, type information according to this positional information and file rebulids file again, and this method can be used as other effectively replenishing according to the file system recovery data method.
Description of drawings
Fig. 1 is a file scanning process process flow diagram in the inventive method;
Fig. 2 is a file rejuvenation process flow diagram in the inventive method.
Embodiment
Introduce the process and the principle of work of the inventive method below with reference to Fig. 1 and Fig. 2.
The method of rebuilding directory structure and restore data mainly comprises two processes, file scan process and file rejuvenation in a kind of NTFS volume.The file scan process mainly is traversal disk De $MFT (MFT), by the various attribute informations among the scanning MFT, obtain the information such as data attribute, file path, file size, various times of file of all files, and these information are recorded in the newly-built file information table; File rejuvenation mainly is to utilize above-mentioned file information table, rebulids file, recovery file.
The file scan process is as shown in Figure 1:
A. Ding Wei $MFT data field; The NTFS volume is different with the FAT volume, in NTFS volume, a Ge $MFT file is arranged, deposited in this document the MFT of All Files (file) in the volume (Master File Table, MFT), and corresponding one by one, promptly each file (file) all has the MFT reference number of self.Multiple attribute information is arranged in the attribute list of MFT, as, 10$STANDARD_INFORMATION (standard information); 20$ATTRIBUTE_LIST (attribute list); 30$FILE_NAME (filename); 40$VOLUME_VERSION (volume version); 50$SECURITY Descriptor (security descriptor); 60$VOLUME_NAME (file label); 70$VOLUME_INFORMATION (volume information); 80$DATA (data); 90$INDEX_ROOT (index root) etc.
B. travel through file MFT; Guarantee the file full recovery in the disk.
C. from this document MFT, obtain parent directory information, and upwards visit all catalogues on it, rebulid the path of this document simultaneously according to the directory name of all catalogues on it; It in this method the MFT reference number that can obtain this document parent directory by 30 attributes among the visit MFT; Can obtain the absolute path of each file (file) by this step, so that guarantee in the follow-up restore data process that the bibliographic structure of file is constant.
D. in the file information table that comprises include file data attribute that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of this document; Above-mentioned various information also is to obtain by each the corresponding attribute among the visit MFT.
E. it is last to judge whether to have arrived $MFT, and not being changes b, is to change f;
F. the ends file scanning process enters file rejuvenation;
File rejuvenation is as shown in Figure 2:
1. traversal is taken out a list item in the file information table that above-mentioned file scan process is set up; The corresponding file (file) of each list item wherein contains the fileinfo of the file data attribute, file path, file size, the various temporal informations of file etc. of this document (file).
2. set up file according to file type information in the table in the specified path of user;
3. according to document size information and the memory location of file in disk in the table file of firm foundation is write file data;
4. judge that whether the file table is the last list item in the above-mentioned file information table, if enter step 5, otherwise returns step 1;
5. finish.
Above step is the unrestricted technical scheme of the present invention in order to explanation only.Any modification or partial replacement that does not break away from spirit and scope of the invention all should be encompassed in the middle of the claim scope of the present invention.
Claims (2)
1, the method for rebuilding directory structure and restore data in the NTFS volume is characterized in that, it comprises that file scan and file recover two processes, and the file scan process comprises the steps:
A. Ding Wei $MFT data field;
B. travel through file MFT;
C. from this document MFT, obtain parent directory information, and upwards visit all catalogues on it, rebulid the path of this document simultaneously according to the directory name of all catalogues on it;
D. in the file information table that comprises include file data attribute that NTFS volume scans, file path, file size, the various temporal informations of file etc., increase the record of this document;
E. it is last to judge whether to have arrived $MFT, and not being changes b, is to change f;
F. the ends file scanning process enters file rejuvenation;
File recovers module and comprises the steps:
I. traversal is taken out a list item from the file information table that above-mentioned file scan process is set up;
II. set up file according to file type information in the table in the specified path of user;
III. according to document size information and the memory location of file in disk in the table file of firm foundation is write file data;
IV. judge that whether the file table is the last list item in the above-mentioned file information table, if enter step V, otherwise returns step I;
V. finish.
2, the method for rebuilding directory structure and restore data in the NTFS volume according to claim 1 is characterized in that the file data attribute information in the described steps d obtains by the 80H attribute of traversal this document.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006101222480A CN100429628C (en) | 2006-09-19 | 2006-09-19 | Method for rebuilding directory structure and recovering data in NTFS volume |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006101222480A CN100429628C (en) | 2006-09-19 | 2006-09-19 | Method for rebuilding directory structure and recovering data in NTFS volume |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1959649A true CN1959649A (en) | 2007-05-09 |
| CN100429628C CN100429628C (en) | 2008-10-29 |
Family
ID=38071352
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2006101222480A Active CN100429628C (en) | 2006-09-19 | 2006-09-19 | Method for rebuilding directory structure and recovering data in NTFS volume |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100429628C (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102254048A (en) * | 2011-08-24 | 2011-11-23 | 深圳市万兴软件有限公司 | Data recovering method and system |
| CN102289524A (en) * | 2011-09-26 | 2011-12-21 | 深圳市万兴软件有限公司 | Data recovery method and system |
| CN102289526A (en) * | 2011-09-29 | 2011-12-21 | 深圳市万兴软件有限公司 | HFS+file system data recovery method and device |
| CN102346771A (en) * | 2011-09-22 | 2012-02-08 | 奇智软件（北京）有限公司 | Information expression method and device |
| CN103713971A (en) * | 2014-01-02 | 2014-04-09 | 浪潮(北京)电子信息产业有限公司 | Management device and method for recovering file path structure after disaster |
| CN106055990A (en) * | 2016-05-30 | 2016-10-26 | 厦门市美亚柏科信息股份有限公司 | Thorough data crushing method and device of NTFS (New Technology File System) |
| WO2017071509A1 (en) * | 2015-10-26 | 2017-05-04 | 华为技术有限公司 | File system directory tree repair method and device |
| CN108021472A (en) * | 2017-11-28 | 2018-05-11 | 厦门市美亚柏科信息股份有限公司 | The formatting restoration methods and storage medium of ReFS file system |
| CN109326307A (en) * | 2018-09-07 | 2019-02-12 | 江苏菲利斯通信息科技有限公司 | CD streaming carving method |
| CN110781160A (en) * | 2019-10-15 | 2020-02-11 | 北亚企安科技(北京)有限公司 | Data recovery method based on VMware virtualization file system damage |
| CN111125298A (en) * | 2019-12-23 | 2020-05-08 | 深圳市斯博科技有限公司 | Method, equipment and storage medium for reconstructing NTFS file directory tree |
| CN113312007A (en) * | 2021-06-29 | 2021-08-27 | 成都易我科技开发有限责任公司 | Method and device for counting directory and file sizes in NTFS file system |
-
2006
- 2006-09-19 CN CNB2006101222480A patent/CN100429628C/en active Active
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102254048A (en) * | 2011-08-24 | 2011-11-23 | 深圳市万兴软件有限公司 | Data recovering method and system |
| CN102254048B (en) * | 2011-08-24 | 2012-10-03 | 深圳市万兴软件有限公司 | Data recovering method and system |
| CN102346771A (en) * | 2011-09-22 | 2012-02-08 | 奇智软件（北京）有限公司 | Information expression method and device |
| CN102346771B (en) * | 2011-09-22 | 2013-07-03 | 奇智软件（北京）有限公司 | Information expression method and device |
| CN102289524A (en) * | 2011-09-26 | 2011-12-21 | 深圳市万兴软件有限公司 | Data recovery method and system |
| CN102289526A (en) * | 2011-09-29 | 2011-12-21 | 深圳市万兴软件有限公司 | HFS+file system data recovery method and device |
| CN102289526B (en) * | 2011-09-29 | 2013-07-31 | 深圳万兴信息科技股份有限公司 | HFS+file system data recovery method and device |
| CN103713971A (en) * | 2014-01-02 | 2014-04-09 | 浪潮(北京)电子信息产业有限公司 | Management device and method for recovering file path structure after disaster |
| CN103713971B (en) * | 2014-01-02 | 2016-05-25 | 浪潮(北京)电子信息产业有限公司 | The management devices of recovery file path structure and method after a kind of calamity |
| WO2017071509A1 (en) * | 2015-10-26 | 2017-05-04 | 华为技术有限公司 | File system directory tree repair method and device |
| US10817469B2 (en) | 2015-10-26 | 2020-10-27 | Huawei Technologies Co., Ltd. | Method and apparatus for repairing file system directory tree |
| CN106055990A (en) * | 2016-05-30 | 2016-10-26 | 厦门市美亚柏科信息股份有限公司 | Thorough data crushing method and device of NTFS (New Technology File System) |
| CN106055990B (en) * | 2016-05-30 | 2018-11-27 | 厦门市美亚柏科信息股份有限公司 | A kind of thorough breaking method of data of new technology file system and device |
| CN108021472A (en) * | 2017-11-28 | 2018-05-11 | 厦门市美亚柏科信息股份有限公司 | The formatting restoration methods and storage medium of ReFS file system |
| CN109326307A (en) * | 2018-09-07 | 2019-02-12 | 江苏菲利斯通信息科技有限公司 | CD streaming carving method |
| CN109326307B (en) * | 2018-09-07 | 2020-12-11 | 江苏菲利斯通信息科技有限公司 | Optical disk stream recording method |
| CN110781160A (en) * | 2019-10-15 | 2020-02-11 | 北亚企安科技(北京)有限公司 | Data recovery method based on VMware virtualization file system damage |
| CN110781160B (en) * | 2019-10-15 | 2021-07-27 | 北亚企安科技(北京)有限公司 | Data recovery method based on VMware virtualization file system damage |
| CN111125298A (en) * | 2019-12-23 | 2020-05-08 | 深圳市斯博科技有限公司 | Method, equipment and storage medium for reconstructing NTFS file directory tree |
| CN113312007A (en) * | 2021-06-29 | 2021-08-27 | 成都易我科技开发有限责任公司 | Method and device for counting directory and file sizes in NTFS file system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN100429628C (en) | 2008-10-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1959649A (en) | Method for rebuilding directory structure and recovering data in NTFS volume | |
| US7934064B1 (en) | System and method for consolidation of backups | |
| CN100446000C (en) | Method for re-setting up catalogue structure and restoring data in FAI volume | |
| US9223797B2 (en) | Reparse point replication | |
| CN110799948A (en) | System and method for restoring a data set of a database for a point in time | |
| CN1848087A (en) | Using usb memory device to recover operating system | |
| CN1567262A (en) | On-line data backup method based on data volume snapshot | |
| CN101051285A (en) | File matching method in computer network data backup | |
| CN1976283A (en) | System and method of combining metadata of file in backup storage device | |
| CN1655146A (en) | Method and apparatus for file system snapshot persistence | |
| CN1477522A (en) | Method and system for management of image and document | |
| CN101061467A (en) | Storing data replicas remotely | |
| CN1682193A (en) | Storage services and systems | |
| CN102541691A (en) | Log check point recovery method applied to memory data base OLTP (online transaction processing) | |
| CN108255638A (en) | A kind of snapshot rollback method and device | |
| CN1523523A (en) | System and method of distributing replication commands | |
| CN100478911C (en) | Protection method in the time of aberrant management thread | |
| CN101051283A (en) | Hard disc data backup system and method | |
| CN1904845A (en) | Method for recovering files deleted from FAT32 document system | |
| CN1275160C (en) | Databank back-up method | |
| CN1967494A (en) | Method, system and computer program product for recovery of formatting in repair of bad sectors in disk drives | |
| CN113448946B (en) | Data migration method and device and electronic equipment | |
| CN1991777A (en) | Data prepackage system and method for mirror document | |
| CN1205577C (en) | Database table recovery system | |
| CN105930223A (en) | Method for reducing size of check point file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C56 | Change in the name or address of the patentee | ||
| CP01 | Change in the name or title of a patent holder |
Address after: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee after: Zhuhai Kingsoft Software Co.,Ltd. Address before: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee before: Zhuhai Kingsoft Software Co.,Ltd. |
|
| ASS | Succession or assignment of patent right |
Owner name: KINGSOFT CORPORATION LIMITED Free format text: FORMER OWNER: ZHUHAI KINGSOFT SOFTWARE CO., LTD. Effective date: 20140903 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 519015 ZHUHAI, GUANGDONG PROVINCE TO: 100085 HAIDIAN, BEIJING |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20140903 Address after: Kingsoft No. 33 building, 100085 Beijing city Haidian District Xiaoying Road Patentee after: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. Address before: Jinshan computer Building No. 8 Jingshan Hill Road, Lane 519015 Zhuhai Jida Lianshan Guangdong city of Zhuhai Province Patentee before: Zhuhai Kingsoft Software Co.,Ltd. |
|
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20070509 Assignee: Zhuhai Kingsoft Software Co.,Ltd. Assignor: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. Contract record no.: 2014990000778 Denomination of invention: Method for rebuilding directory structure and recovering data in NTFS volume Granted publication date: 20081029 License type: Common License Record date: 20140926 |
|
| LICC | Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model |