KR20110023580A - The method and system for recovering data - Google Patents

Abstract

PURPOSE: A method and a system for restoring a data are provided to restore a formatted file and restore a damaged file or a file without a signature by suing a metadata of a file. CONSTITUTION: A processor distinguishes a first list of a metadata corresponding to a damaged file from a memory(S210). The processor distinguishes a file and a metadata signature corresponding to an input in each sector of the memory and restores a second list of a file corresponding to the file signature(S220). The processor restores information from the metadata and adds information in the first list(S230). The processor scans the first list and the second list corresponding to a parameter and provides a file recovery option based on the scanning(S240).

Description

Method and system for data recovery {THE METHOD AND SYSTEM FOR RECOVERING DATA}

FIELD OF THE INVENTION The present invention relates to computer forensic, and more particularly to methods and systems for recovering data.

Recently, Digital Forensic Techniques recover data when there is a software or hardware failure, or block crime by recovering data from a system that might provide insight into the crime. It is used in various fields such as.

One such technique used for data recovery includes data carving. Data recovery in data carving techniques is performed by using file signatures associated with the file.

The file signature corresponds to a specific file format and depends on the file type. However, file parameters such as names, time stamps, and attributes may not be recovered using the data carving technique.

In metadata based recovery, deleted data recovery, other techniques used for the recovery of metadata are available only if the location of the metadata is known.

Currently, there is no method for recovering the formatted data in the case of accidental and unintentional formatting of data stored in FAT 16 (File Allocation Type 16), a format using FAT 32 (File Allocation Type 32). Moreover, there may be no provision for repairing damaged files or files without signatures.

There is such a problem, a more efficient technique for recovering data is required.

Accordingly, an object of the present invention is to provide a method and system for recovering data.

According to an aspect of the present invention, there is provided a data recovery method, comprising: receiving an input representing performing data recovery; Identifying a first list of metadata corresponding to damaged files from the portion of memory, wherein the portion of the memory corresponds to the damaged file memory; Identifying at least one of a file signature and a metadata signature corresponding to the input in each sector of the memory; Extracting a second list of files corresponding to the file signature; Mapping cluster numbers in the metadata signature to logical sector numbers; Extracting information from the metadata obtained by the metadata signature, wherein the information is added to the first list; Scanning the first list and the second list corresponding to one or more parameters; And providing an option to recover one or more files based on the scanning.

According to another aspect of the present invention, there is provided a data recovery method, comprising: receiving an input for performing data recovery; Identifying, at each sector of the memory, a metadata signature and a file signature corresponding to the input; Mapping a cluster number of the metadata signature to a logical sector number; Restoring file information from metadata obtained based on the mapping and generating a first list to which the file information is added; Restoring content of a file signature based on the file signature and generating a second list to which the content is added; Scanning the first list and the second list; And providing an option to recover one or more files based on the scanning.

Data recovery system according to another embodiment of the present invention for achieving the above object is a machine-readable medium (machine-readable medium); And receiving, in accordance with instructions provided from the machine-readable medium, an Input indicating performance of data recovery, identifying a first list of metadata corresponding to damaged files from a portion of the memory; A portion of the file corresponds to a corrupted file memory, identifying a file signature and a metadata signature corresponding to at least one of the inputs in each sector of the memory, recovering a second list of files corresponding to the file signature, and Mapping a cluster number in a metadata signature to a logical sector number, recovering information from the metadata obtained by the metadata signature to add the information to the first list, and wherein the first corresponding to one or more parameters. Scan a list and the second list, and based on the scanning And a processor that provides the option of recovering one or more files.

In accordance with another aspect of the present invention, an electronic device includes a communication interface for receiving an input indicating performing data recovery; And a processor in electrical communication with the communication interface.

The processor identifies a first list of metadata corresponding to damaged files from a portion of memory, wherein the portion of the memory corresponds to a damaged file memory, and a file corresponding to at least one of the inputs in each sector of the memory. Identify a signature and metadata signature, recover a second list of files corresponding to the file signature, map a cluster number in the metadata signature to a logical sector number, and obtain the metadata obtained by the metadata signature Recover information from the system to add the information to the first list, scan the first list and the second list corresponding to one or more parameters, and provide options to recover one or more files based on the scanning do.

The information may include at least one of a file name, a file size, timestamps, a file type, and an attribute.

The metadata signature can be used to obtain mapping parameters.

The mapping may be performed using a cluster to sector mapping technique.

Identifying the file signature and metadata signature may include generating a file having a default name and file extensions corresponding to the received input.

The metadata signature corresponds to the initial entry of the file directory.

According to the present invention has the effect of recovering the formatted file. In addition, according to the present invention, there is an effect to recover a damaged file or a file without a signature.

In order to fully understand the present invention, the operational advantages of the present invention, and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents described in the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a block diagram illustrating an electronic device 105 according to an embodiment of the present invention. In this case, the electronic device 105 may include, but is not limited to, a computer, a television, a laptop, a mobile device, a portable device, and personal digital assistants (PDAs).

The electronic device 105 includes a bus 110 for communicating information and a processor 115 connected to the bus 110 to process the information.

In addition, the electronic device 105 includes the memory unit (eg, a random access memory (RAM) 120) connected to the bus 110 to store a command performed by the processor 115.

The memory unit 120 may be used to store temporary information required by the processor 115.

In addition, the electronic device 105 may include a read only memory (ROM) 125 connected to the bus 110 to store static information and a command for the processor 115.

A storage unit 130 connected to the bus 110 for storing information and commands may be further provided. The storage unit 130 may be, for example, a magnetic disk, a hard disk, or an optical disk, but is not limited thereto.

The electronic device 105 may be connected to the display 135 via the bus 110. The display 135 may be implemented as a cathode ray tube (CRT) or a liquid crystal display (LCD) to display information, but is not limited thereto. In this case, the electronic device may include a display unit for displaying information.

An input device 140 including various keys is coupled to the bus 110 to communicate information and / or command selections to the processor 115.

In one embodiment, a cursor control 145 may be further provided to control command selection for the processor 115 and cursor movement on the display 135. In this case, the cursor control 145 may be implemented as a mouse, a trackball, a joystick, or cursor direction keys, but is not limited thereto.

For example, the steps of the present disclosure may be performed by the electronic device 105 in response to the processor 115 performing instructions included in the memory unit 120.

The instructions may be read into the memory unit 120 from a machine-readable medium such as the storage unit 130.

In other embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to perform various examples.

The machine-readable medium may be defined as a medium for providing data to the machine to enable the machine to perform a particular function. The machine-readable medium may be a storage medium.

The storage medium may include a nonvolatile medium and a volatile medium, the storage unit 130 may be a nonvolatile medium, and the memory unit 120 may be a volatile medium, but the scope of the present invention is not limited thereto. Does not.

Instructions stored on a storage medium may be recognized by a physical mechanism that reads the instructions into a machine.

The machine-readable media may be floppy disks, flexible disks, hard disks, magnetic tapes, CD-ROMs, optical disks, punchcards, papertape, RAM, PROM, EPROM and FLASH. -EPROM may be included, but is not limited thereto.

In addition, the machine-readable medium may include online links, download links, and installation links that provide instructions for execution by the processor 115.

In addition, the electronic device 105 includes a communication interface 150 connected to the bus 110 to enable data communication. The communication interface 150 may include a universal serial bus (USB), an integrated services digital network (ISDN) card, a modem, a local area network (LAN) card, an infrared port, a Bluetooth port, and a Zigbee port ( Zigbee port) and a wireless port (wireless port), but is not limited thereto.

An input for performing data recovery may be received by the electronic device 105 through the communication interface 150.

As an example, the communication interface 150 may receive the input from another electronic device.

As another example, an external storage unit may be connected to the electronic device 105 via the communication interface 150.

As another example, the processor 115 may include one or more processing units (not shown) for performing one or more functions of the processor 115.

The processing unit (not shown) may be a hardware circuit that performs a specific function.

The one or more functions include receiving an input indicating initiation of data recovery and identifying a first list of metadata corresponding to an affected file from the portion of memory. The portion of memory corresponds to the file memory affected.

As an example, the portion of the memory may correspond to the storage unit 130.

In addition, the one or more functions may include a function of identifying file signatures corresponding to the input or a function of identifying a metadata signature in each sector of the memory unit.

The one or more functions also include the function of recovering a second list of files corresponding to the file signature and the mapping of cluster numbers to logical sector numbers by obtaining mapping parameters from metadata signatures. do.

The one or more functions also include the ability to recover information from the metadata obtained in a sector having a metadata signature. At this time, the information is added to the first list of files.

In addition, the one or more functions include the function of scanning a first list of files and a second list of files corresponding to one or more parameters, and providing an option for storing one or more files based on the scanning.

2 is a flowchart for explaining a method for recovering data according to an embodiment of the present invention. 2, an input indicating the start of data recovery is received (S205). The input may be a type of a file, a file name, or a file size, but is not limited thereto. In one embodiment, the input may indicate or RECOVERY instruction data of all deleted files.

Corresponding to the input, the memory holding the file of the electronic device may be configured to obtain a sector list including contents of files present in the file allocation table of the current file system. scan from the root directory). The file allocation table represents a file currently available in the file system.

From the damaged portion of the memory, a first list of metadata corresponding to the damaged file is identified (S210). The metadata includes content such as file name, file size, timestamps, file type and attributes. Damaged portions of the memory correspond to sectors with metadata of the deleted file, and sectors corresponding to files in the current file system are excluded.

At least one file signature and metadata signature corresponding to the input are identified in each sector of the memory (S215). Identification of the file signature is performed by scanning multiple sectors of the memory, and sectors corresponding to files in the current file system are skipped. The file signature corresponds to a file format and is predefined based on format specifications.

The directories are associated with dot and dot-dot entries and dot-dot entries, each of which refers to a current directory and a parent directory. Metadata signatures of subdirectories and files are usually stored in the directory entry. The metadata signature is identified by scanning multiple sectors. The entry following the dot or dot-dot corresponds to information about metadata. The first few bytes included in the metadata include a mapping parameter of cluster numbers.

The directory also includes metadata corresponding to files in the damaged portion of the memory. The mapping parameter may include a pointer, a reference, and an indicator, but is not limited thereto.

The second list of files corresponding to the file signature is recovered (S220). The file contains the contents of a file signature corresponding to the file. As an example, the second list includes the file start sector number, a default name, and an extension based on the file signature.

Restoration of the second list of files may be performed using a data carving technique.

In the metadata signature, a cluster number is mapped to a logical sector number (S225). The mapping may be performed using a cluster to sector mapping technique. The logical sector number indicates a location of data corresponding to a file of a memory device.

Information is extracted from the metadata obtained by the metadata signature, and the information is added to the first list of files (S230). Examples of the content of the information may include a file name, a file size, a time stamp, a file type, and an attribute, but are not limited thereto.

The first list and the second list of files are scanned corresponding to one or more parameters (S235). The one or more parameters include sector number or file extensions.

The first list or the second list may correspond to a linked list and an array list, but is not limited thereto.

Tables 1 and 2 are tables illustrated to explain the first and second lists, respectively.

Table 1 is a table for explaining a list of first files recovered using a metadata processing technique.

Table 2 is a table for describing the second file list recovered by using the data carving technique.

Based on one or more parameters, matching and validation of metadata is performed on the file of the second list to recover a matching file (ie, a file having the attributes).

Additionally, for files in the first list that do not match the entries in the second list, the files are recovered based on the location and size obtained by using the metadata signature.

An option for recovering one or more files based on the scanning is provided (S240). The option includes recovering the selection file based on user selection, file type and file size.

Table 3 is a view for explaining a list of files recovered after S240.

Table 3 is a table for explaining a list of recovered files based on the data recovery method shown in FIG.

3 is a diagram illustrating an example of an electronic device 105 according to an embodiment of the present disclosure. The electronic device 105 includes an application interface 305 for receiving an input for recovering data.

In one embodiment of the present invention, an application running on the application interface 305 receives an input for restoring data. In addition, the application interface 305 may guide or transmit the input to one or more components in the electronic device 105 to recover data.

The electronic device 105 also includes a data carving unit 310 for recovering a file due to a file signature. Furthermore, the electronic device 105 includes a metadata recovery unit 315 for recovering a file based on metadata.

The electronic device 105 includes an operating system interface 320 for accessing one or more memory devices. Furthermore, the electronic device 105 includes a hard disk drive 325 for storing data corresponding to a file.

In addition, an external memory 330 may be connected to the electronic device 105. Recovery may also be performed on the external memory 330. The external memory 330 may correspond to a universal serial bus (USB), an external hard drive and a data card, but is not limited thereto.

The operating system interface 320 may include a file system interface 335 for accessing the hard disk drive 325 and a card reader interface for accessing the external memory 330. 340).

The data carving unit 310 includes a file format manager 345 for determining a file signature associated with an input recovery request. The data carving unit 310 also holds file formats 350 that hold all file signatures corresponding to all supported file formats, the content having the contents of each sector during the scanning process. A pattern matcher 355 for performing file signature and metadata signature matching and a registry manager 360 for maintaining a list of supported file formats.

The metadata recovery unit 315 includes a directory hierarchy scanner 365 for identifying the metadata signature associated with each file directory corresponding to the deleted file.

The metadata recovery unit 315 also includes a list builder 370 for generating a list based on metadata and metadata signatures.

The metadata recovery unit 315 also includes a File Extractor 375 for extracting and restoring the file by referring to parameters in the given metadata of the file.

In addition, the metadata recovery unit 315 includes a metadata extractor 380 for extracting metadata associated with the deleted file from the identified sector in order to obtain the metadata signature in the data carving process. .

4A-4I are screenshots illustrated to illustrate a data recovery technique in accordance with one embodiment of the present invention. 4A and 4B, in the case of a removable disk having a partition 'N:', the partition 'N:' includes a folder 'test' and the folder 'test' is four Include the file.

Referring to FIG. 4C, a user formats a partition 'N:' including a 'test' folder by selecting a formatting option. As a result of formatting, the files of the Removable Disk 'N:' are deleted as shown in FIG. 4D.

4E illustrates an application that provides an option to recover deleted files. The application can also provide an option to permanently delete a file from memory. The permanently deleted file cannot be recovered for future use. If the user decides to recover the deleted file, the user can select at least one partition containing the file to be recovered as described in FIG. 4F. In FIG. 4F partitions 'I:' and 'N:' are shown.

In Fig. 4f, the user selects the partition 'N:' to recover deleted files. As soon as the partition 'N:' is selected for data recovery, an option for data recovery mode is provided. As shown in FIG. 4G, the option consists of Deleted Files, All Files including Corrupted Files, File Type, and the user selects one of the options for the file. Can be recovered.

4H is a diagram illustrating a file to be recovered based on the user selecting a Deleted Files option. At this time, the four files deleted by the format step shown in Figure 4c can be identified in the partition 'N:'. The four files can be recovered by selecting the Copy option shown in FIG. 4I.

In the above, the preferred embodiment of the present invention has been illustrated and described, but the present invention is not limited to the specific embodiments described above, and the technical spirit of the present invention and the following by those skilled in the art to which the present invention pertains. Various modifications and variations will be possible within the scope of equivalents of the claims to be described therein, and such variations will fall within the protection scope of the present invention.

1 is a block diagram of an electronic device according to an embodiment of the present invention.

2 is a flowchart illustrating a method for recovering data according to an embodiment of the present invention.

3 is a functional block diagram of an electronic device according to another embodiment of the present invention.

4A-4I are screenshots illustrated to illustrate a data recovery technique in accordance with one embodiment of the present invention.

Claims (19)

Receiving an input indicating performing data recovery; Identifying a first list of metadata corresponding to damaged files from the portion of memory, wherein the portion of the memory corresponds to the damaged file memory; Identifying at least one of a file signature and a metadata signature corresponding to the input in each sector of the memory; Extracting a second list of files corresponding to the file signature; Mapping cluster numbers in the metadata signature to logical sector numbers; Extracting information from the metadata obtained by the metadata signature, wherein the information is added to the first list; Scanning the first list and the second list corresponding to one or more parameters; And Providing an option to recover one or more files based on the scanning. The method of claim 1, wherein the information is A data recovery method comprising at least one of a file name, file size, timestamps, file type and attributes. The method of claim 1, wherein the metadata signature is Data recovery method used to get mapping parameters. The method of claim 1, wherein the mapping A method of data recovery performed using the cluster to sector mapping technique. The method of claim 1, wherein identifying the file signature and metadata signature comprises: Creating a file having a default name and file extensions corresponding to the received input. The method of claim 1, wherein the metadata signature is Data recovery method corresponding to the initial entry of the file directory. The method of claim 1 wherein the method is Providing an option to recover the one or more files based on the metadata signature. The method of claim 1, wherein providing the option comprises: Recovering the one or more files. A recording medium having recorded thereon a computer readable program for performing the data recovery method of claim 1. Machine-readable medium; And In accordance with instructions provided from the machine-readable medium, Receive an Input that indicates performing data recovery, Identify a first list of metadata corresponding to damaged files from a portion of memory, wherein the portion of the memory corresponds to the damaged file memory, Identify a file signature and a metadata signature corresponding to at least one of the inputs in each sector of the memory, Recover a second list of files corresponding to the file signature, Map a cluster number in the metadata signature to a logical sector number, Recover information from the metadata obtained by the metadata signature to add the information to the first list, Scanning the first list and the second list corresponding to one or more parameters, And a processor that provides an option to recover one or more files based on the scanning. The method of claim 10, wherein the information is A data recovery system comprising at least one of file name, file size, timestamps, file type and attributes. The method of claim 10, wherein the metadata signature is Data recovery system used to obtain mapping parameters. The method of claim 10, wherein the mapping is Data recovery system performed using the cluster to sector mapping technique. The method of claim 10, wherein the processor is And a file having a default name and file extensions corresponding to the received input. The method of claim 10, wherein the metadata signature is Data recovery system corresponding to the initial entry of the file directory. The method of claim 10, wherein the processor is Providing an option to recover the one or more files based on the metadata signature. A communication interface for receiving input indicating performance of data recovery; And A processor in electrical communication with the communication interface, The processor is Identify a first list of metadata corresponding to damaged files from a portion of memory, wherein the portion of the memory corresponds to the damaged file memory, Identify a file signature and a metadata signature corresponding to at least one of the inputs in each sector of the memory, Recover a second list of files corresponding to the file signature, Map a cluster number in the metadata signature to a logical sector number, Recover information from the metadata obtained by the metadata signature to add the information to the first list, Scanning the first list and the second list corresponding to one or more parameters, Providing an option to recover one or more files based on the scanning. The method of claim 17, And the processor provides an option to recover the one or more files based on the metadata signature. Receiving an input for performing data recovery; Identifying, at each sector of the memory, a metadata signature and a file signature corresponding to the input; Mapping a cluster number of the metadata signature to a logical sector number; Restoring file information from metadata obtained based on the mapping and generating a first list to which the file information is added; Restoring content of a file signature based on the file signature and generating a second list to which the content is added; Scanning the first list and the second list; And Providing an option to recover one or more files based on the scanning.

Images