KR100887547B1 - Method and apparatus for checking the ratio of damaged data - Google Patents

Abstract

The present invention relates to a method and apparatus for confirming a damage rate of a deleted file by determining the validity of a cluster included in the deleted file.

According to the present invention, a method for identifying a damage rate of a deleted file includes: retrieving a deleted file; Determining the validity of each cluster of deleted files; Calculating a damage rate of the deleted file based on a result of the validity determination; And displaying the calculated damage rate.

File Corruption, Corruption Rate, FAT, NTFS, Repair

Description

METHOD AND APPARATUS FOR CHECKING THE RATIO OF DAMAGED DATA}

1A is a diagram schematically illustrating a configuration of a general file system and a data storage device.

1B is a diagram schematically illustrating a relationship between a block map and a cluster.

2 is a diagram illustrating an exemplary structure of file information of a file system.

3 is a conceptual diagram illustrating a file storage method through a block map in a general file system.

4 is a flowchart illustrating a data damage rate checking method according to an embodiment of the present invention.

5 is a flowchart illustrating a method for validating a cluster according to an embodiment of the present invention.

6 is a block diagram illustrating a configuration of an apparatus for checking a data damage rate according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

600: data corruption rate checking device 610: file system check unit

620: File information search unit 630: Validation unit

640: damage rate calculation unit 650: display unit

The present invention relates to a method for checking a damage rate of a deleted file and a device thereof, and more particularly, to a method for checking the damage rate of a deleted file by determining the validity of a cluster constituting the deleted file. To the device.

A file is a collection or collection of data stored on a storage medium such as a hard disk, a memory card, or a CD-ROM. A file performs various functions such as providing information to a system such as a computer, a PDA, a mobile phone, operating a specific function, or providing information to a user.

The file system provides methods and functions for writing, reading, and using files. Digital devices such as computers have file systems such as FAT (File Allocation Table), NTFS (New Technology File System) and HPFS (High Performance File System). The file system provides features for efficient management of files, enabling fast retrieval, recovery of data, and support of large amounts of data. The file system contributes to improving the performance of the entire system by reducing bottlenecks caused by the storage media having a relatively slow processing speed compared to processors such as the CPU, and smoothing the file.

On the other hand, many digital devices dealing with digital multimedia use a file system compatible with a general personal computer to enable file exchange through a computer. Therefore, many digital devices currently use the same file system as personal computers to store multimedia data.

FIG. 1A is a diagram schematically illustrating a configuration of a general file system 10 and a data storage device.

As described above, the file system 10 may include various systems such as FAT, HPFS, and NTFS, and generally manages files through the block map 100. As shown in FIG. 1A, a hard disk or a memory card is divided into a cluster 200 and a block map 100.

The cluster 200 may be one unit for storing data and may be one unit for storing data in the storage space. It becomes a unit for storing data, such as 512 bytes or 1024 bytes, and larger data is stored in pieces according to the size of the storage unit.

The block map 100 is a collection of information about the cluster 200. The block map 100 configures position information of a block as a linked list so that data can be sequentially read from several clusters 200 constituting one file. This connection is made through the blocks of the block map 100. Hereinafter, in the present specification, a block constituting the block map 100 is called a mapping block.

As shown in FIG. 1A, the block map 100 and the cluster 200 may be stored in the storage device 500. In addition, a file system 10 exists to manage mapping and files between the block map 100 and the cluster 200. File information is stored in the file system 10.

1B is a diagram schematically illustrating a relationship between the block map 100 and the cluster 200. The mapping blocks 101 and 102 constituting the block map 100 show the state of the cluster. That is, it has information indicating whether a file is stored in the cluster or whether the cluster can be stored. In the FAT system, a file allocation table is an example of a block map.

If the information on the mapping blocks constituting the block map 100 is reviewed, the state of the cluster 200 may be known without directly examining the entire cluster 200. The value of the mapping block of the block map 100 indicates the position of the next data or indicates that no data is stored in the corresponding cluster. In addition, if the cluster, for example, the cluster is damaged so that you can not save the file, it may indicate whether the damage. The block map 100 will be described with an address from 1 for convenience, which is only one embodiment of the file system implementation. The block map of address 1 shows information about the cluster of address 1.

2 is a diagram illustrating an exemplary structure of file information of the file system 10.

As shown in FIG. 2, the file information includes the name 310, the attribute 320, the file creation time 330, the recording time 340, the access time 350, the size 360, and the start of the file. It contains the address of the cluster (the address of the first cluster where the file was written, 370).

3 is a conceptual diagram illustrating a method of storing a file through the block map 100 in a general file system. As described above, the block map 100 has information about the cluster 200 which is a storage unit of the data area. The size of each cluster 200 is 512 bytes, 1024 bytes, and so on, depending on the file system.

For example, if you save a file.txt file, file system 10 stores file information about file.txt, which contains the address of the starting cluster that represents the cluster where file.txt is initially written. Included. The inside of the block map 100 forms a link by sequentially connecting mapping blocks representing clusters in which the file is stored.

Referring to FIG. 3, it can be seen that file.txt is first stored in a cluster having an address of 3. Therefore, to read the data in this file, you need to refer to the mapping block at address 3. For convenience of explanation, blockmap (k) means a mapping block of k addresses, and datablock (k) means a cluster of k addresses. blockmap (3) has 0004, which means that the next data constituting this file is stored in address 4, namely datablock (4). Information about the cluster at address 4 is stored in the mapping block at address 4. In blockmap (4), it has a value of 0006, which shows that the next data is stored in cluster 6. In the manner described above, the block map 100 may sequentially read data constituting the file.

In the example of FIG. 3, it can be seen that file.txt is sequentially stored in clusters 3, 4, 6, 7, and 8 through the connection list of the mapping block. The value of blockmap (8) is, for example, 0xffff, which means the end of the file. A value other than 0xffff may be promised to indicate the end of the file. However, to avoid confusion, it should be a value that does not overlap with the address of the mapping block. For example, if there is a mapping block addressed to 0xffff, you will have confusion, so you will have to use a larger value or a different value that does not overlap.

When the user deletes the file.txt, the file is recorded in the file information 300 for the file.txt stored in the file system 10, and the actual content of the cluster 200 in which the file.txt is recorded is recorded. Is not deleted.

On the other hand, as the use of computers increases due to the increase in the use of computers, many data files are stored in computers, and users are performing tasks using the stored data files. However, as the proportion of work linking to a computer increases, cases of enormous damage are caused by accidentally deleting a file stored in a computer or a directory in which work files are stored. In addition, the file data stored in the recording medium may be damaged by physical shock, electrical shock, aging of the recording medium, virus and software crash, and the like.

The following prior arts exist for a method of recovering a damaged file.

Patent registration No. 308873 ("Method for restoring data from damaged directory information with damaged data and a computer-readable recording medium storing the same") is a disk value obtained by detecting sector information and boot sector information in a user drive. A patent is directed to analyzing information and analyzing damaged directory information and data information from data sectors to recover damaged files.

Further, Patent Registration No. 308874 ("Method for restoring fragmented data of a hard disk and a computer-readable recording medium storing the same") is a method of recovering a damaged file by adding a FAT editor function to Patent Registration No. 308873. Is a patent.

Further, Patent Registration No. 335281 ("Hard Disk Recovery Method and Recovery System Damaged by Virus") relates to a method for recovering a damaged file by adding a virus diagnosis and treatment function.

However, even when using the above-described file recovery methods according to the prior art, it is impossible to restore 100% to the original data when the cluster in which the deleted file is recorded is overwritten by another file. As a result, when a large number of clusters were overwritten compared to the total number of clusters, recovery of files was often unavailable.

However, in the prior art, there is no method of confirming in advance whether or not the deleted file is damaged. Therefore, the user had to recover the file unconditionally regardless of whether the deleted file was damaged or not, and there was an inconvenience in confirming that the recovered file was available only after the recovery was completed.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and an object thereof is to provide a method and apparatus for enabling a user to check a damage rate of a deleted file in advance before recovering the deleted file.

Another object of the present invention is to provide a method and an apparatus for allowing a user to first know whether a deleted file is damaged before determining a damage rate of the deleted file.

Another object of the present invention is to provide a method and apparatus for recovering only a desired file from deleted files after a user checks a damage rate of the deleted file.

As a technical means for achieving the above object, according to a first aspect of the present invention, a method for confirming the damage rate of a deleted file, the method comprising: retrieving a deleted file; Determining the validity of each cluster of deleted files; Calculating a damage rate of the deleted file based on a result of the validity determination; And displaying the calculated damage rate.

According to a second aspect of the present invention, there is provided a method for identifying a damage rate of a deleted file, the method comprising: (a) retrieving a deleted file from file information of a file system; (b) determining validity of one cluster of the deleted file and incrementing the number of damaged clusters when it is determined that the one cluster is damaged; (c) performing step (b) for all other clusters of the deleted file; And (d) calculating a damage rate of the deleted file and displaying the result based on the number of the damaged clusters.

According to a third aspect of the present invention, there is provided an apparatus for confirming a damage rate of a deleted file, the apparatus comprising: a file information search unit for searching for a deleted file; A validity checker for determining a validity of the cluster of the deleted file; A damage rate calculator configured to calculate a damage rate of the deleted file based on the validity determination result; And a display unit which displays a damage rate of the deleted file.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "electrically connected" with another element in between. . In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated.

As used herein, the term "deleted file" includes a file intentionally or inadvertently deleted by the user, as well as a file in which the file is marked as deleted in file information of the file system due to other factors such as a virus. In addition, "corruption of a deleted file" means a state in which any of the clusters in which the deleted file is recorded is overwritten by another file.

Hereinafter, a method for checking a data damage rate according to an embodiment of the present invention will be described in detail with reference to FIG. 4. 4 is a flowchart illustrating a data damage rate checking method according to an embodiment of the present invention.

First, the file information 300 of the file system 10 is searched (S410) to determine whether the corresponding file is a deleted file (S420). In the file system 10, file information 300 of each file is recorded. As described above, when the file is deleted, the file information 300 is recorded in the file information 300 so that the file information of the file system 10 It may be determined whether the file is deleted from the file 300.

In the present specification, as a method of searching for deleted files, only a method of analyzing the file information 300 of the file system 10 is illustrated, but the present disclosure is not necessarily limited thereto and may be performed by other known methods.

If it is determined in step S420 that the file is a normal file rather than a deleted file, it is determined whether there is another file that is not searched for (S490).

If it is determined in step S420 that the file has been deleted, the validity of each cluster of the deleted file is checked (S430), and it is determined whether the corresponding cluster is valid (S440). Validation of the cluster may be performed by determining whether each cluster in which the deleted file was recorded is currently being used by another normal file or overwritten. Here, the normal file means a file that has not been deleted, and a method for validating a specific cluster according to the file system 10 will be described later with reference to FIG. 5.

If it is determined in step S440 that the cluster is invalid, it is indicated that the deleted file is damaged (S450), and the number of damaged clusters is incremented (S460). Thereafter, it is determined whether all clusters of the deleted file have been examined (S470). The number of damaged clusters is initially set to 0. If the number of damaged clusters is determined to be invalid, the number of damaged clusters increases by one, so after validating all clusters of deleted files, the number of damaged clusters Is the total number of invalid clusters.

If it is determined in step S440 that the cluster is valid, it is determined whether all clusters of the deleted file have been checked without performing steps S450 and S460 (S470).

If it is determined in step S470 that all clusters of the deleted file have not been checked, the flow returns to step S430 to check the validity of the other cluster of the deleted file. Therefore, all clusters of deleted files will be validated.

If it is determined in step S470 that all clusters of the deleted file have been inspected, the damage rate of the deleted file is calculated based on the number of damaged clusters and the result is displayed (S480). The damage rate may be calculated by dividing the total number of damaged clusters by the total number of clusters of deleted files. For example, if a deleted file is recorded in 10 clusters and 5 clusters among the clusters are counted as damaged clusters, the deleted file may have a 50% damage rate.

The total number of clusters of deleted files may be calculated from the file size 360 of the file information 300 recorded in the file system 10. For example, if the file size 360 of a deleted file is 3,072 bytes and the size of one cluster of the file system 10 is 512 bytes, the total number of clusters of deleted files is 6, 3,072 bytes / 512 bytes. . Alternatively, by using the starting cluster address 370 of the file information 300 recorded in the file system 10, by analyzing the cluster list from the starting cluster, for example, to the last cluster where 0xffff is recorded, the deleted cluster is deleted. Know the total number of clusters in your file.

Thereafter, it is determined whether other files which have not been searched exist (S490). If it is determined in step S490 that there are other files that have not been retrieved, the flow returns to step S410 to retrieve the file information 300 of the other file of the file system 10.

If it is determined in step S490 that no other file not found exists, the data corruption rate checking method is terminated.

Although not shown in the embodiment shown in FIG. 4, according to another embodiment, the data corruption rate checking method of the present invention may further include recovering a deleted file. If damage and damage rates are displayed for all files deleted by the data corruption rate checking method of FIG. 4, the user may selectively select only files to be recovered. That is, according to the present invention, it is possible to determine whether the deleted file is recovered by determining in advance whether the deleted file is damaged or not.

When the recovery is selected, the data of all the clusters in which the deleted file is recorded based on the file information 300 and the mapping block 100 of the deleted file is collected, and the data of the collected clusters are stored in another recording area. You can recover deleted files. Here, the data of the collected clusters are stored in a recording area not used by other files.

Hereinafter, a method of checking the validity of a cluster among data corruption rate checking methods will be described in detail with reference to FIG. 5. 5 is a flowchart illustrating a method for validating a cluster according to an embodiment of the present invention.

First, the type of the file system 10 is determined (S510). The type of the file system 10 may be determined based on the detected sector information and the boot sector value by detecting sector information, reading the boot sector value.

In FIG. 5, the type of the file system 10 is determined in step S510, but this is for convenience of description and is not necessarily performed after the step S420. Rather, step S510 of determining the type of file system 10 is more preferably executed only once before step S410.

If it is determined in step S510 that the FAT file system, the cluster information of the deleted file is compared with the cluster information of the normal file to check the validity of the cluster (S520). That is, the block map 100 is used to check whether the corresponding cluster is being used by the cluster of the normal file. Since the overwriting of the cluster is more likely to be performed by the more recently created file, it is efficient to first compare the cluster information of the deleted file with the cluster information of the more recently written normal file. Thereafter, it is determined in step S440 whether the cluster is valid.

If it is determined in step S510 that the NTFS file system, the $ bitmap file which is a system file of the NTFS file system is analyzed to validate the cluster (S530). By analyzing the $ bitmap file, you can determine whether the cluster is available or already in use. Therefore, if a cluster of deleted files is not identified as an available cluster, but is identified as a cluster that is already in use, the cluster may be regarded as damaged.

After the validity of the cluster is checked in step S520 or S530, step S440 is performed.

Until now, only the method of calculating whether or not the deleted file is damaged and the damage rate by comparing each cluster information of the deleted file with the cluster information of the normal file is checked. However, it is also possible to determine in advance whether only the file is damaged by using the deleted file's attributes, size, or Windows API functions.

First, a method of determining whether a corresponding file is damaged by using an attribute of a deleted file will be described.

In the file information 300 of the file system 10, an attribute 320 of a corresponding file is recorded, and a range that a data value may have is determined according to the attribute of the file. Therefore, it is possible to check whether the deleted file is damaged by first analyzing the attributes of the deleted file and determining whether the data values of the clusters of the deleted file are within a range of data values corresponding to the attributes of the file. have.

For example, if the attribute of the file is a jpg image file, the cluster in which the file is recorded must have a value in the range corresponding to jpg data, and in the case of a txt file, it must have a value in the range corresponding to txt data. . If the attribute of the deleted file is a txt file, if the data value of the clusters constituting the deleted file exceeds the value of the range corresponding to the txt data, the file may be regarded as damaged.

As described above, according to the method using the attribute of the file, even if there is no cluster information of the normal file, it is possible to check whether the deleted file is damaged.

Next, a method of determining whether or not the corresponding file is damaged using the size of the deleted file will be described.

In the file information 300 of the file system 10, the size 360 of the file is recorded. Accordingly, the total number of clusters of deleted files may be calculated from the size 360 of the corresponding file stored in the file information 300 by the above-described method.

The total number is then analyzed starting from the starting cluster address 370 and following the cluster list to the last cluster, for example, the cluster on which 0xffff is recorded.

If the total number of clusters calculated from the file size 360 and the total number of clusters analyzed by tracking the cluster list are different, the file may be classified as damaged.

As described above, according to the method using the file size, even if there is no cluster information of the normal file, it is possible to check whether the deleted file is damaged.

Next, a method of determining whether a corresponding file is damaged by using a Windows API function will be described.

API functions are special methods that are predefined by the computer operating system or other applications to require specific processing from the operating system or other applications. Windows provides a variety of API functions, including API functions that tell you whether a particular file is corrupted or whether a particular cluster is in use. Thus, by using these Windows API functions, it is possible to check whether a deleted file is damaged by another normal file.

As described above, according to the method using the Windows API function, it is possible to check whether the deleted file is damaged even if there is no cluster information of the normal file.

According to the data corruption rate checking method according to an embodiment of the present invention described above, the user can check the damage rate of the deleted file before recovering the deleted file, and delete the file before determining the damage rate of the deleted file. You can find out whether the deleted file is damaged or not. After checking the damage rate of the deleted file, you can recover only the desired file.

Hereinafter, the data damage rate checking apparatus 600 according to an embodiment of the present invention will be described in detail with reference to FIG. 6. 6 is a block diagram illustrating a configuration of an apparatus for checking a data damage rate according to an embodiment of the present invention.

First, the term '~', that is, 'module' used in this embodiment means a hardware component such as software, FPGA or ASIC, and performs specific functions. However, modules are not meant to be limited to software or hardware. The module may be configured to be in an addressable storage medium and may be configured to play one or more processors. Thus, as an example, a module may include components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, procedures, subroutines. , Segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functionality provided within the components and modules may be combined into a smaller number of components and modules or further separated into additional components and modules. In addition, the components and modules may be implemented to play one or more CPUs in a device or secure multimedia card.

As shown in FIG. 6, the data damage rate checking apparatus 600 includes a file system checker 610, a file information searcher 620, a validity checker 630, a damage rate calculator 640, and a display 650. ).

The file system checker 610 analyzes the file system 10 to determine the type of the file system 10. As described above, the type of the file system 10 may be determined based on the sector information and the value of the boot sector.

The file information retrieval unit 620 retrieves, for example, a file deleted from the file information 300 of the file system 10. Each file information 300 is recorded in the file system 10. When the file is deleted as described above, the file information 300 displays its contents in the file information 300. You can retrieve deleted files from.

The validity checker 630 determines validity of all clusters of the deleted file, and counts the number of damaged clusters. When the validity checker 630 first checks the damaged cluster, the display 650 may preferentially display that the deleted file is damaged.

The validity checker 630 may include a FAT validity checker 631 and an NTFS validity checker 632.

The FAT validity checking unit 631 determines the validity of each cluster of the deleted file by comparing the cluster information of the deleted file with the cluster information of the normal file. The FAT validity check unit 631 preferably first compares the cluster information of the deleted file with the cluster information of the more recently recorded normal file. For example, the FAT validator 631 may be configured to analyze the date on which the normal files are recorded and compare the cluster information of the deleted file with the cluster information of the normal file from the latest to the past, that is, in the reverse date order. have.

In addition, the FAT validator 632 determines whether the deleted file is damaged by using one or more of the deleted file's properties, sizes, and Windows API functions, and determines whether the deleted file is damaged before calculating the damage rate. It may be displayed on the display unit 650.

The NTFS validity checking unit 632 determines the validity of all clusters of the deleted file by analyzing the $ bitmap file, which is a system file of the NTFS file system.

The damage rate calculator 640 calculates a damage rate of the deleted file based on the number of damaged clusters. The damage rate of deleted files is calculated by dividing the total number of damaged clusters by the total number of clusters of deleted files. For example, if a deleted file is recorded in 10 clusters and 3 clusters among the clusters are counted as damaged clusters, the deleted file has a damage rate of 30%. The damage rate of the deleted file is calculated for all deleted files in the file system 10, and the damage rate of all deleted files may be displayed on the display unit 650.

The display unit 650 displays whether the deleted file is damaged or the damage rate so that a user can select whether to recover the deleted file.

According to the data corruption rate checking apparatus according to an embodiment of the present invention described above, the user can check the damage rate of the deleted file before recovering the deleted file, and delete the file before determining the damage rate of the deleted file. You can find out whether the deleted file is damaged or not. After checking the damage rate of the deleted file, you can recover only the desired file.

The invention may also be embodied in the form of a recording medium containing instructions executable by a computer, such as a program module executed by the computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, computer readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transmission mechanism, and includes any information delivery media.

Those skilled in the art will appreciate that the present invention may be embodied in other specific forms without changing the technical spirit or essential features of the present invention. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is indicated by the scope of the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and the equivalent concept are included in the scope of the present invention. Should be interpreted.

According to the above-described configuration of the present invention, the user can check the damage rate of the deleted file in advance before recovering the deleted file.

It is also possible to indicate only whether the deleted file is damaged before analyzing the damage rate of the deleted file.

In addition, it is possible to recover only a desired file from among deleted files after the user checks the damage rate or whether the deleted file is damaged.

Claims (20)

delete delete delete delete As a method to check the damage rate of deleted files, Retrieving the deleted file; Determining whether each cluster in which the deleted file was recorded is currently being used by another normal file to determine validity of each cluster; Calculating a damage rate of the deleted file based on a result of the validity determination; And Displaying the calculated damage rate Including, Detecting sector information and a boot sector value, and determining whether the file system is a FAT file system or an NTFS file system based on the detected sector information and the boot sector value; Include more, If the file system is a FAT file system, And the validity determining step includes comparing cluster information of the deleted file with cluster information of a normal file. The method of claim 5, wherein And comparing the cluster information of the deleted file with the cluster information of the normal file is performed first with respect to the cluster information of the recently written normal file. As a method to check the damage rate of deleted files, Retrieving the deleted file; Determining whether each cluster in which the deleted file was recorded is currently being used by another normal file to determine validity of each cluster; Calculating a damage rate of the deleted file based on a result of the validity determination; And Displaying the calculated damage rate Detecting a value of the sector information and a boot sector, and determining whether the file system is a FAT file system or an NTFS file system based on the detected sector information and the value of the boot sector. Include more, If the file system is an NTFS file system, And said validity determining step is performed by analyzing a $ bitmap file. As a method to check the damage rate of deleted files, Retrieving the deleted file; Determining whether each cluster in which the deleted file was recorded is currently being used by another normal file to determine validity of each cluster; Calculating a damage rate of the deleted file based on a result of the validity determination; And Displaying the calculated damage rate Detecting a value of the sector information and a boot sector, and determining whether the file system is a FAT file system or an NTFS file system based on the detected sector information and the value of the boot sector. Further comprising but if the file system is a FAT file system, Wherein the validity determination step is performed using one or more of an attribute, a size, and a Windows API function of the deleted file. delete As a method to check the damage rate of deleted files, (a) retrieving a deleted file from file information of the file system; (b) checking whether one cluster in which the deleted file was recorded is currently being used by another normal file to determine validity of the one cluster, and if it is determined that the one cluster is damaged Incrementing the number of damaged clusters; (c) performing step (b) for all other clusters of the deleted file; And (d) calculating a damage rate of the deleted file based on the number of the damaged clusters and displaying the result Data corruption rate checking method comprising a. The method of claim 10, (e) performing steps (a) to (d) on all deleted files stored in the file system; Data corruption rate checking method further comprising.  The method of claim 10, And a damage rate of the deleted file is calculated by dividing the total number of damaged clusters by the total number of clusters of the deleted files. A computer-readable recording medium having recorded thereon a program for performing on a computer the data damage rate checking method according to any one of claims 5 to 8 and 10 to 12. delete delete A device for checking the damage rate of deleted files, A file information search unit for searching for deleted files; A validity checker which determines whether or not each cluster in which the deleted file is recorded is currently used by another normal file to determine validity of each cluster; A damage rate calculator configured to calculate a damage rate of the deleted file based on the validity determination result; And A display unit displaying a damage rate of the deleted file And a file system checker for detecting a sector information and a boot sector value, and determining whether the file system is a FAT file system or an NTFS file system based on the detected sector information and the boot sector value. , If the file system is a FAT file system, And the validity checking unit determines the validity by comparing cluster information of the deleted file with cluster information of a normal file. The method of claim 16, If the file system is a FAT file system And the validity checking unit preferentially compares cluster information of the deleted file with cluster information of a recently recorded normal file. A device for checking the damage rate of deleted files, A file information search unit for searching for deleted files; A validity checker which determines whether or not each cluster in which the deleted file is recorded is currently used by another normal file to determine validity of each cluster; A damage rate calculator configured to calculate a damage rate of the deleted file based on the validity determination result; And A display unit displaying a damage rate of the deleted file And a file system checker for detecting a sector information and a boot sector value, and determining whether the file system is a FAT file system or an NTFS file system based on the detected sector information and the boot sector value. , If the file system is an NTFS file system, And the validity checker determines the validity of the cluster of deleted files by analyzing the & bitmap file. delete delete

Images