KR20020097344A - Restoration Method of data on Hard Disk Drive - Google Patents

Abstract

PURPOSE: A method for recovering data of a computer hard disk is provided to protect data of a computer hard disk and recover corrupted data by executing a contents backup of the hard disk at a non-defect status in operations of a hard disk drive and an operating system before progressing an operation. CONSTITUTION: Changed contents in a hard disk drive are recognized in real time, a backup is processed to only changed contents. When a trouble is generated in the hard disk drive, the data including the changed contents are recovered promptly. Information of a data area through an information analysis of a system portion(MBR, FAT(File Allocation Table)) of a hard disk drive and information of a system portion(MBR, FAT) are backed-up in a specific portion of a hard disk which can not be accessed by a user. When a trouble is generated in the hard disk drive, the backup FAT is read in the hard disk and written in an FAT of the hard disk, and a data area is read. Thus, the data are written for being identified with the original FAT.

Description

Restoration method of data on hard disk drive

The present invention relates to the repair of a damaged hard disk drive (HDD) of a computer system.

A hard disk drive (HDD) in a computer system is characterized by a storage address from zero address to a maximum address. At the bottom of the hard disk drive, there is usually one or more cylinders and a master boot record and the master boot record is a method of booting and Tells the computer system which sector all the files are allocated to. The master boot block record contains a file allocation table (FAT) with information about all files, locations for data, and the location of the hard disk drive, and the hard disk drive of the computer system at the completion of the manufacturing process of the computer system. Factory-downloaded software images (ie, resident software) that are downloaded to a hard disk drive (HDD) and typically reside in the lower address portion of the hard disk drive (HDD), when the computer system is delivered from the factory prior to initial installation by the customer or user. Contains the hard disk drive image as it existed.

When a customer receives a computer system, he or she can first install the operating system according to the requirements of each operating system and then install various third party software, hardware and software drivers for the hardware.

Such hard disk drives may not be compatible with the various versions of software installed by the computer system user, by deleting certain artificial files by the computer user, by inadvertent reformatting by the computer system user, by installing a modem that is incompatible with the plug and play method. System software, application software, or system management data on a hard disk drive for various reasons, such as installing hardware that is not supported by the operating system of a given computer system, assigning interrupts separate from the system bus of the current computer system, and invading various kinds of viruses. Back can be damaged

In the past, when data in the hard disk was damaged, the hard disk utility software in the computer system operating system only checked and inspected the hard disk and showed only the abnormality result, and utility software for recovering some of the damaged data in the hard disk ( There was no utility software to completely recover damaged data, although Norton Disk Utility, etc.), and these hard disk data recovery utility software only recovers deleted files even if some damaged data is recovered. It was not possible to recover from fatal causes such as virus infection.

In addition, in a computer system in a Windows environment, an operating system may be abnormal after performing a specific operation. At this time, a useful means for restoring to a state before the operating system is abnormal is to perform a reboot or reset. It is not provided.

Moreover, it is a virus infection, a kind of software program, which runs in memory and is stored as a file like a normal program, alters or deletes existing file or system configuration, corrupts data, and reformats the hard disk. In the event of problems such as crashing or locking the computer, there are programs (aka antivirus programs) that perform actions such as removing these viruses and recovering damaged data, but the types of viruses described above are increasing day by day. Since the operation of the virus is becoming more sophisticated, antivirus programs to repair damages caused by such viruses are becoming increasingly impossible to deal with, and when the system data is damaged due to virus infection, the computer system itself becomes inoperable. Since fall protection program, as well as a hard disk utility software, even mothayeo not drive becomes impossible to enforce recovery function itself.

Therefore, the object of the present invention is that before the user is working to achieve any purpose using a computer system, the main work is carried out before proceeding with the work that is determined that the data should be preserved or may damage the data. At certain points of integrity, the hard disk drive (HDD) and the operating system are operating at a certain point of time, where data corruption is a concern. By providing an easy way to back up to the point of time when a backup was made in the event of an abnormal operation of the computer system, it protects the system software, application software, and system management data in the computer hard disk from damage, Delete files with The present invention provides a method of restoring damaged data to its original state by an easy method provided by the present invention when a fatal damage is applied to a hard disk due to a disk format, a virus infection, or the like.

Another object of the present invention, the information recorded on the system recording disk of the information recording disk of the hard disk drive, the name of the recorded data file, the recorded location, etc. It provides a full backup means to copy all the contents of the stored file allocation table (FAT), directory area and data area to a specific area of the hard disk which cannot be accessed by the user in advance. If a damaged data or malfunction of the operating system occurs, the data is preserved by performing full backup after booting using the useful booting means provided by the present invention, that is, access is not made during normal use of the user. Data on the hard disk by providing a full restoration means to transfer data to damaged data and restore it. It provides a method for restoring the original.

It is still another object of the present invention to change the program start position of the boot sector of a computer system to the MICROMOS KERNEL CODE usefully provided by the present invention, and the MICROMOS KERNEL is a kernel of an operating system. Loaded in the KERNEL section and monitoring the input / output (I / O) in the BIOS and the I / O VECTOR, the I / O calls the BIOS function. I / O FUNCTION that needs to be monitored, such as file I / O, is passed to the code usefully provided by the present invention, and a separate process is performed to perform a BIOS function. FUNCTION) (FIG. 1) to monitor the input / output (I / O) at the location of the MICROMOS KERNEL (FILE DELETE), if the file deletion (FILE DELETE) occurs, the file separately according to the present invention Remove from the list of managed files and restore To the data area of the actual provides a means to preserve. When a file access such as a directory search is attempted to a file deleted through the above means, it is intercepted at a location of a micromos kernel (MICROMOS KERNEL) usefully provided by the present invention, and virtually compared with a list managed separately by the present invention. If it is determined that the erased file (the file protected by the present invention for backup protection), the present invention provides a method for returning the result as deleted without searching for the actual HDD. Quick restores only the contents of the hard drive changed in real time through a series of means such as QUICK BACKUP and QUICK RESTORE to recover the hard disk in a short time (within 1 second) upon malfunction or user's request. To provide a way to do this.

Still another object of the present invention is to determine if a file DELETE request is received through the MICROMOS KERNEL provided by the present invention. Delete the list, modify the FAT area to protect the data area, and overwrite by another file by connecting the start position of the FAT corresponding to the data area of the file to the end of the FAT list of the file protected by the present invention. It is to limit the way to prevent (OVER WRITE).

Another object of the present invention is that the capacity of the backup data is as much as the capacity of the file since the change in the backup file, i. The present invention provides a method of performing a backup of the HDD with a minimum storage capacity by providing a means of making the HDD space unavailable due to the backup.

Still another object of the present invention is to provide a quick backup (within 1 second) through quick backup provided by the present invention, such as speedy storage and retrieval of files during word operations. 2 PASS method that ensures fast recovery and safety by increasing the user's convenience by achieving a high performance and fully recovering the fatal hard drive damage such as FAT damage through full backup In providing.

Another object of the present invention is to provide a method in which one administrator can back up and restore all PCs from a manager PC in a networked state such as in a PC room or a school. . That is, the client registers its information with the server as it starts, and the administrator server checks whether the clients are connected at predetermined time intervals, and waits for operation in the local menu as a useful means provided by the present invention, which is executed by the client. Check if there is any menu contents manipulated in communication with the client, and the client performs each operation when receiving the menu operation instruction of QUICK BACKUP and FULL BACKUP from the management server on the local or network while waiting. The management server monitors whether the client is connected at predetermined time intervals, applies the changes, and the separate thread waits for the menu operation for the client and sends the menu operation to the client when the menu operation is entered. QUICK BACKUP the clients all at once. Full backup (QUICK restoration) is provided to provide an advanced method compared to the way to go directly to each PC to manage.

It is still another object of the present invention to perform a backup at a specific point of time in a computer system environment, so that the process of re-installing an application program to restore the computer operating system and to establish a specific point in time computer system environment can be omitted. To provide a way to. In other words, the school provides a way to support the use of the next students by backing up after installing the necessary applications for the class and recovering the data or operating system damaged by the students during the class in a short time after class. .

1 is a conceptual diagram of a kernel (KERNEL) hierarchy according to an embodiment of the present invention

2 is a conceptual diagram illustrating a backup and restore method of a hard disk drive (HDD) according to an exemplary embodiment of the present invention.

3 is a flowchart illustrating a method of storing and restoring information of a hard disk drive (HDD) according to an exemplary embodiment of the present invention.

FIG. 3A is a flowchart illustrating a method of loading and operating a micromoss kernel (MICROMOS KERNEL) in FIG. 3.

FIG. 3B is a flow chart for the QUICK BACKUP method of FIG.

FIG. 3C is a flowchart of the FULL BACKUP method of FIG. 3.

FIG. 3D is a flowchart of the quick restore method of FIG. 3.

Figure 3e is a flow chart for a file (FILE) management method according to an embodiment of the present invention

FIG. 3F is a flowchart of a full restoration method of FIG. 3.

Computer systems include various peripheral devices. Processors, motherboards, display cards, network cards, modems, sound cards, etc., require different software and configuration settings, depending on the manufacturer. In order to install these peripheral devices, a large amount of time should be additionally installed depending on the state of each computer system after the operating system is installed. After installing the operating system, you should install the application program according to the user's work. In this way, when the installation is completed, the user frequently changes the setting contents or conflicts with each other, preventing the operating system from operating normally. As the duration of use increases, the user's settings are further increased and errors are more likely to occur. In addition, recovering a computer system to a user environment at a specific point in time requires more difficulty and time. The present invention facilitates the protection and restoration of the hard disk of a computer, and the hard disks generated by various causes in PC rooms, schools, and academies. It is an object of the present invention to provide an improved method for quickly and safely recovering data damage and its control means. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2, the present invention supports a full backup method and a QUICK backup. When the computer is turned on (POWER ON), the program start location of the boot sector of the computer system is changed to the MICROMOS KERNEL CODE, which is usefully provided by the present invention, and the MICROMOS KERNEL is a kernel of the operating system. It is loaded at the bottom of the KERNEL and starts monitoring I / O from the BIOS and the I / O VECTOR.

Selecting FULL BACKUP now backs up all current data and settings to a specific space on the same hard disk. That is, all areas in which data exists, sector 1, FAT, directory area, and data area are recorded in the rear sector part of the HDD which is the unused space of the HDD. This transfers the device configuration status, registry configuration status, and application installation status. The backed up data area lists the backup areas in the I / O processing section to protect them from being overwritten. If the data is severely damaged and cannot be restored by QUICK RESTORE alone, or if you want to return to the moment of FULL BACKUP by user's need, use BOOTING DISK to recover the backed up data after booting.

This recovery method overwrites all the contents of the HDD with the data at the time of backup to ensure that any failure is completely recovered. Backups are required after performing critical tasks during use. The user attempts a full backup if the PC system is considered complete. At this time, the previous full backup data is deleted. In this way, there is a distinction between quick backup, which is a method of changing FAT by copying files, and full backup, which copies HDD data at the time of full backup to a separate space. As a result, FULL backups achieve good stability, but they are time-consuming and consume more data storage than QUICK backups. QUICK BACKUP, on the other hand, requires less work time and requires less storage space, but is not as effective as full backup in terms of data stability.

If you select QUICK BACKUP, the contents of the FAT are backed up in a certain section of the same hard disk and the current hard disk file is listed. Monitor file I / O of hard disk after backup. When an input / output (I / O request) comes in to delete the backed up contents, delete the file from the list and protect the actual file data (FILE DATA). When an attempt is made to access a deleted file, it returns the changed list of data and protects the actual data area.

If a restore is required, it is restored within a short time by reading the backed up FAT at the time when the backup is instructed and overwriting the actual hard disk FAT. This restoration restores the operating system configuration, application configuration, device configuration, and data storage at the time of backup.

If you want to back up with the new changes, perform a QUICK BACKUP. This will erase your previous backups and protect your new ones. All the functions of the present invention can be remotely operated on the network (NETWORK). In the case of a PC room or a school lab, the administrator manages hundreds of ordinary PCs in a batch from the management PC.

Referring to FIG. 3, in a preferred embodiment of the present invention, when a power is supplied to a computer system, a micromoss kernel (MICROMOS KERNEL) provided with an execution position indicated by sector 1 of a hard disk is provided by the present invention. Instruct and accordingly the micromosk kernel (MICROMOS KERNEL) is loaded first (FIG. 3a) and starts input / output (I / O) monitoring. After that, the process proceeds in the same way as the general operating system loading order. The hierarchy of the loaded operating system and the operating system usefully provided by the present invention is consistent with that shown in FIG.

From this point on, the present invention usefully monitors input / output (I / O) until the end of the computer system and controls all input / output (I / O) contents by the code usefully provided by the present invention. It is possible to achieve file security.

After the loading of the operating system is completed, the I / O is continuously monitored through the means usefully presented by the present invention even when the PC is in use, and when the operating system malfunctions or data loss is expected or the integrity of the operating system is verified, Selecting the QUICK BACKUP menu on LOCAL and NETWORK reads the FAT of the hard disk by means usefully suggested by the present invention residing in the kernel. (FIG. 3B) Save the read contents to a specific space on the same hard drive. Set all current data areas to protected area.

If full backup is selected in Figure 3, the kernel (KERNEL) monitors input / output (I / O) and the local (LOCAL) is expected when the operating system malfunctions or loses data, or the integrity of the operating system is verified. If you select FULL BACKUP menu on NETWORK or NETWORK, kernel 1 reads from sector 1 of hard disk and writes to specific space of hard disk. 3c) FAT and all data areas are read in the same way and written to the free space on the same hard disk. Protect the backed up data area by setting protection. This is different from QUICK BSCKUP, which prevents the data from being changed at the backup time, whereas this full backup actually copies and stores all the data on the hard disk.

If QUICK RESTORE is selected If you select QUICK RESTORE menu on LOCAL or NETWORK while monitoring the I / O from Kernel, Reads the FAT information backed up in the same hard disk and writes to the FAT of the same hard disk (Figure 3d).

After the file input / output (FILE I / O) detection (Fig. 2e) the kernel (KERNEL) monitors the I / O. When a FILE I / O API (Application Programmable Interface) function is called in a general application program, I / O VECTOR is reached through a DLL (Dynamic Linking Library) and a driver.

The MICROMOS KERNEL CODE, which is usefully provided by the present invention as a program start position of a boot sector of a computer system, analyzes I / O content in an I / O VECTOR. do. Selects file I / O and deletes the file from the list if there is a request to delete the file under backup protection during the file delete request. This makes the file appear to have been deleted to normal applications. The data is protected by protecting the FAT of the file so that data of different contents is not overwritten in the data area. If it is not a file in the protected area, the BIOS ROUTINE or DMA (Direct Memory Access) processing routine (ROUTINE) can be connected to handle file deletion or overwrite of the data area. Through this series of steps, after initial QUICK BACKUP, the backup data on the HDD is nothing but the backed up FAT.

The more data is deleted after the backup is executed, the greater the backup data size of the deleted file. This saves HDD capacity as compared to storing entire data in a separate space.

Restoring a backup is completed by overwriting the FAT backed up to the FAT of the original hard disk. This means restoring within a maximum of one second. For example, after finishing the class in the PC room or school, it is possible to restore all PCs from the administrator PC to the state before the class within 1 second using the network.

In the case of full restoration (FIG. 3F), booting is done using a booting diskette (BOOTING DISKETTE) usefully presented by the present invention at boot time.

In accordance with the instruction of sector 1 SECTOR, the micromog kernel MICROMOS KERNEL, which is usefully provided by the present invention, is loaded and restoration of the full backed up data is started. First, the backed up FAT is read from the same hard disk and written to the FAT of the same hard disk. The data area is read, and data is written to match the original order, that is, FAT. In this way, the device configuration status, resource allocation status, operating system configuration status, and application installation status are restored. This means that any damage will be restored to the initial FULL BACKUP state. FULL BACKUP cannot be restored by QUICK restoration, which may occur if the hard disk is damaged after the installation of various applications or new device changes, not the initial factory backup. When corruption occurs, a full restoration can be achieved using the FULL backup, which is usefully provided by the present invention.

According to the present invention, there is provided a means for monitoring the changed contents in the hard disk drive in real time to back up only the changed contents and recovering the data in which the changed contents are stored in its own hard disk drive in the event of a hard disk drive problem.

Backing up the information in the data area and the information in the system part (MBR, FAT) by analyzing the information of the system part (MBR, FAT) of the hard disk drive to a specific part of the hard disk which is inaccessible to the user. System backed up to its own hard disk drive when the occurrence occurs, the execution position indicated on sector 1 of the HDD indicates the MICROMOS KERNEL which is usefully presented by the present invention, and accordingly, the MICROMOS KERNEL is loaded first to monitor I / O. By means of starting the system and then proceeding in the same order as the general operating system loading order, the present invention provides a means for easily restoring the OS and other hardware settings only by booting through means which are usefully presented.

Formatting and installation of Windows, various hardware device settings, and other utilities can be easily and quickly restored without errors, protecting your data and improving the reliability of your hard disk drive. have.

Claims (6)

It monitors the changed contents in the hard disk drive in real time and backs up only the changed contents, and recovers the data stored on the hard disk drive in case of a hard disk drive problem. Backing up the information in the data area and the information in the system part (MBR, FAT) by analyzing the information of the system part (MBR, FAT) of the hard disk drive to a specific part of the hard disk which is inaccessible to the user. When a backup occurs, it reads backed up FAT from the same hard disk, writes to FAT of the same hard disk, reads data area, and writes data to match the original FAT. Hard disk recovery method characterized in that POWER ON the computer system directs the kernel (KERNEL) stored as a file type to one or more external storage devices provided by the execution location indicated in sector 1 of the hard disk and loads it first. Initiating (I / O) monitoring; QUICK backup on local and network where the integrity of operating system is verified in case of malfunction of operating system and expected loss of data while continuously monitoring I / O after completion of general operating system loading. Reading the FAT of the hard disk through the kernel (KERNEL) when the BACKUP) menu is selected; Storing the read contents in a specific space of the same hard drive and setting all current data areas as protected areas; During kernel operating system monitoring of input / output (I / O) When operating system malfunctions, data loss is expected, full backup on local (LOCAL) or network (NETWORK) when operating system integrity is verified Reading the first sector (SECTOR) of the hard disk from the kernel (KERNEL) when the FULL BACKUP menu is selected; Writing the read contents to a specific space of the hard disk; Reading out the FAT and all data areas and writing them to an empty space of the same hard disk; Setting a backed-up data area as a protected area to perform full backup; If you select QUICK RESTORE menu on local or network while monitoring the input / output in Kernel, the Kernel information backed up in the same hard disk Reading and writing the data to the FAT of the same hard disk and performing a quick restoration (QUICK restoration); When powering on the computer system, the execution location indicated in sector 1 of the hard disk is directed to the kernel (KERNEL) stored as a file type in one or more external storage devices provided separately, and then loaded first (MICROMOS KERNEL LOADING). ); Read the backed up FAT from the same hard disk, write to the FAT of the same hard disk, and then read the data area to write the data to match the original FAT. Hard disk recovery method characterized by sequentially executing the steps of restoring the resource allocation state, operating system setting state, application installation state to the original The method of claim 2, wherein when powering on the computer system (POWER ON), the execution position indicated in sector 1 of the hard disk indicates a kernel (KERNEL) stored as a file type in one or more external storage devices provided separately. In the method of monitoring file I / O by loading first, selecting file I / O and requesting file deletion during backup protection during file delete request Deleting the contents from the file list in the directory if there is any content; Modifying the FAT area to protect the data area; Connecting the start position of the FAT corresponding to the data area of the file to the end of the FAT list to separately manage so that data of different contents is not overwritten in the data area; If it is not a file in a protected area, it is possible to connect a BIOS ROUTINE or DMA (Direct Memory Access) processing routine (ROUTINE) to handle file deletion or overwrite of the data area. File management method for hard disk recovery Among the information recorded on the information recording disk of the hard disk drive, information recorded for system booting, name of recorded data file, recorded location, etc. is stored in the file allocation table (FAT), directory area, and data area. Sequentially copying all the contents to a specific area of the hard disk inaccessible to the user in advance; Protecting the backed up data area from being overwritten by listing the backup areas in an input / output (I / O) processor; If the operating data is damaged or the operating system malfunctions, the kernel (KERNEL) stored as a file type is instructed in one or more external storage devices provided by the execution location indicated in sector 1 of the hard disk. Loading; Among the information recorded on the information recording disk of the hard disk drive that has been backed up, information recorded for system booting, name of recorded data file, recorded location, etc. are stored. Full recovery method of a damaged hard disk comprising the steps of sequentially restoring all the contents of the area to the damaged data The execution location indicated in sector 1 of the hard disk directs the kernel (KERNEL) stored as a file type to one or more external storage devices provided separately, and first loads it into the kernel part of the operating system, and then enters the BIOS and inputs. Monitoring the input / output (I / O) in the / output vector (I / O VECTOR); General I / O calls BIOS FUNCTION, and I / O FUNCTION that needs to be monitored like file I / O is passed to separate code. After processing separately, it consists of a structure that connects with BIOS FUNCTION and monitors input / output (I / O) at a separate kernel location and separates the file when FILE DELETE occurs. Deleting from the list of managed files and preserving the actual data area for restoration; When a file access is attempted to a deleted file, it is intercepted at a separate kernel location and compared to a file list managed separately, and when the file is virtually deleted (file protected by backup) according to the present invention, the actual HDD is not searched. RETURN the result as erased; Fast recovery method of hard disk, characterized in that to back up only the contents of the hard drive changed in real time at a high speed (BACKUP) and to instantly restore the data stored in the event of a malfunction or user request In a computer system environment connected by a network, the client starts and registers its information with the server, and the administrator server checks whether clients are connected at predetermined time intervals; Allowing the client to perform respective operations when receiving a menu operation instruction of QUICK BACKUP and FULL BACKUP from a management server on a local or network while waiting; The management server monitors whether the client is connected at a predetermined time interval, applies the changes, waits for menu operations for the client separately, and sends the menu operations to the client when the menu operations are input. QUICK BACKUP all connected clients at once. Hard disk quick recovery method characterized by full backup (QUICK restore)