CN106407038A - Fragmented file data recovery method - Google Patents
Fragmented file data recovery method Download PDFInfo
- Publication number
- CN106407038A CN106407038A CN201510443869.8A CN201510443869A CN106407038A CN 106407038 A CN106407038 A CN 106407038A CN 201510443869 A CN201510443869 A CN 201510443869A CN 106407038 A CN106407038 A CN 106407038A
- Authority
- CN
- China
- Prior art keywords
- file
- executing
- data
- feature
- file header
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a fragmented file data recovery method. The fragmented file data recovery method comprises the following steps of S1 carrying out analysis to obtain partition information; S2 finding a file system idle area; S3 selecting the type of a file needing to be recovered; S4 searching the file header characteristic; S5 judging whether the file header characteristic is found out or not; executing S6 when the file header characteristic is found out; executing S7 when the file header characteristic is not found out; S6 recombining the file in dependence on the file header characteristic, and executing S8 after the recombination is successful; S7 carrying out file recombination in dependence on a pre-stored file storage mode, and executing S8 after the recombination is successful; and S8 extracting the file which is recombined successfully. Beneficial effects of the fragmented file data recovery method are that the file header can be found out according to the file header characteristic, and the data content of the file can be found out according to the file header, under the condition that the file header is lost, fragments in the file system can be found out according to the file format or code known in advance, the fragmented file is checked, whether the data is correct is judged, ordered recombination is carried out to the fragment data, the aim of recovering an incomplete fragmented file is reached, and the data recovery success rate is high.
Description
Technical field
The present invention relates to field of information security technology, particularly to a kind of data reconstruction method of fragment file.
Background technology
The 21 century developing rapidly in informationization, computer technology is maked rapid progress, with daily life
Closely bound up, storage device data lose tend to individual, or even business unit bring endless worry with
Trouble, in being related to computer data storage work, such as in enterprise work, business data loss causes
Loss is immeasurable, and little Ze Shi company cannot carry out the work, enterprises' loss then may be led to greatly heavy and
Close down, particularly in informatization enterprise, the electronic bits of data of company is exactly their lifeblood, if recovering this
A little data can save enterprise, allows the loss of enterprise to be preferably minimized；As in police field, these data are perhaps
It is exactly the electronic evidence of case, if reviewer can obtain the data in more multicomputer, then just more
Added with the detection early beneficial to case it is also possible to provide more reliable evidence to court；This to evidence obtaining,
Particularly data recovery work is put forward higher requirement.
At present, market there are encase, winhex, R-stdio using data evidence obtaining business software the most popular
Exist in regular file record Deng, these softwares, and file continuously can recover；Once running into file
Record not or file storage location discontinuously just cannot recover data or key in these files
Information；By researching and analysing, these data are still present in storage medium, and simply file is not continuous
It is stored in medium, existing restoration methods can only be according to looking for File header information to carry out RAW side to file
Formula is recovered, this be only able to find file header and the content with file header Coutinuous store, and file remaining is big
Most contents cannot be found, also as most of file type is that have the codec format of oneself, only literary composition
The data of part head cannot normally by existing content revealing, therefore RAW mode recover for discontinuous or
Data is imperfect can not to reach very good effect.But in actual data recovery or evidence obtaining, often
Exactly need to recover file or the key message of discontinuous storage.
Electronic information file is all based on certain standard or certain format design, each type of file
There are oneself exclusive form or decoding restrictive condition, we can be cleverly using this in data recovery
A little information, to realize the recovery of discrete date, farthest lift the probability recovering complete file.Make
The data recovering is can normally to be represented content therein by normal decoder, reaches evidence obtaining or data is extensive
Multiple purpose.
Content of the invention
The present invention is directed to the defect of prior art, there is provided a kind of data reconstruction method of fragment file, can have
Imitate solves the problems, such as above-mentioned prior art.
A kind of data reconstruction method of fragment file, comprises the following steps：
S1：Open MBR disk partition table, parse MBR disk partition table, partition table obtains partition information；
S2：File partition table can be found according to the partition information in S1, obtain the ginseng of file system
Number, resolution file system can mark clear area；Record sector byte in each file partition table
Number, subregion basic allocation unit size parameter；
S3：Select the file type needing to recover；
S4：Retrieve the File header information of the file requiring in S3 to recover according to the clear area determining in S2；
S5：Judge whether to scan file header feature；If finding, executing S6, if not finding, executing S7；
S6：Document storage mode obtained according to file header feature, carries out according to specific document storage mode
File is recombinated, and executes S8 after restructuring success；
S7：Document storage mode file according to prestoring carries out file restructuring, executes S8 after restructuring success；
S8：Extract successful file of recombinating.
Preferably, described S6's comprises the following steps that：
S601：According to the File header information retrieving, determine coded system or the file storage lattice of this kind of file
The type of formula, determines file size or tail of file feature；
S602：Create recombination region；
S603：File header information block is stored in recombination region；
S604：Order according to file memory format enters a unit to recombination region with minimum memory unit
File header information block after；
S605：Judge single storage cell that S604 enters whether according to the coding of file or storage format
For correct file data；If then executing S606, if not executing S604 after then deleting this memory cell；
S606：Judge whether that restructuring completes；Here the file size that can be obtained by S601 or end-of-file are special
Levy to judge, if restructuring completes, terminating, if not completing, executing S604.
Preferably, the detailed step of described S7 is as follows：
S701：Create the recombination region for file of recombinating；
S702：According to this class file prestoring coded format or storage feature in clear area with minimum
Memory cell retrieves data content, finds the memory cell data that feature meets and then executes S703；
S703：The data that feature is met is put into recombination region and is arranged in order；
S704：Judge single storage cell that S703 enters whether according to the coding of file or storage format
For correct file data；If then executing S705, if not executing S702 after then deleting this memory cell；
S705：Judge whether to scan to completing；Here basis scans file system afterbody and judges,
If completing, terminating, if not completing, executing S702.
Compared with prior art it is an advantage of the current invention that：File header basis can be found according to file header feature
File header looks for the data content playing file；Also can be according to the file being known a priori by the case that file header is lost
Form or coding find fragment in file system, fragment file can be carried out with check and correction and judge whether correctly to count
According to being recombinated in order to crumb data, reached the purpose recovering imperfect fragment file, data recovery is become
Power is high.
Brief description
Fig. 1 is the main flow chart of inventive embodiments；
Fig. 2 is the detail flowchart of inventive embodiments S6；
Fig. 3 is the detail flowchart of inventive embodiments S7.
Specific embodiment
For making the objects, technical solutions and advantages of the present invention become more apparent, develop simultaneously reality referring to the drawings
Apply example, the present invention is described in further details.
As shown in figure 1, a kind of data reconstruction method of fragment file, comprise the following steps：
S1：Open MBR disk partition table, parse MBR disk partition table, partition table obtains partition information；
S2：File partition table can be found according to the partition information in S1, obtain the ginseng of file system
Number, resolution file system can mark clear area (untapped memory space)；Each file system
Record sector byte number, subregion basic allocation unit size parameter in partition table；
S3：Select the file type needing to recover；
S4：Retrieve the File header information of the file requiring in S3 to recover according to the clear area determining in S2；
Clear area essence is exactly the space after file is deleted according to the release of minimum memory unit, therefore clear area
In be exactly all regional ensembles deleted and lose files, therefore be to find specific literary composition in clear area
Part head feature, and to copy data to target area with current file system minimum memory unit (be exactly that new file is treated
Splicing regions)；
S5：Judge whether to scan file header feature；If finding execution S6, if not finding execution S7；
S6：Document storage mode obtained according to file header feature, carries out according to specific document storage mode
File is recombinated, and executes S8 after restructuring success；
S7：Document storage mode file according to prestoring carries out file restructuring, executes S8 after restructuring success；
S8：Extract successful file of recombinating.
As shown in Fig. 2 described S6's comprises the following steps that：
S601：According to the File header information retrieving, determine coded system or the file storage lattice of this kind of file
The type of formula, also file size or tail of file feature；Every kind of file has the type of coding of oneself feature
Or storage format, will carry out decoding data using to oneself distinctive coding when opening file；
S602：Create recombination region, the clear area of file system is sequentially placed into according to minimum memory unit
In recombination region；
S603：File header information block is stored in recombination region；
S604：Order according to file memory format enters a unit to recombination region with minimum memory unit
File information block after；
S605：Judge single storage cell that S604 enters whether according to the coding of file or storage format
For correct file data；If then executing S606, if not executing S604 after then deleting this memory cell；
Here file data verification can be carried out according to the coded system of file, record check results；Because different
File be to have different certain methods of calibration when decoding according to unit, in addition file decoding when
There is obvious storage tag format feature, can whether correct by above method validation data cell；
S606：Judge whether that restructuring completes；Here the file size that can be obtained by S601 or end-of-file are special
Levy to judge, if restructuring completes, terminating, if not completing, executing S604.
As shown in figure 3, the detailed step of described S7 is as follows：
S701：Create the recombination region for file of recombinating；
S702：According to this class file prestoring coded format or storage feature in clear area with minimum
Memory cell retrieves data content, finds the memory cell data that feature meets and then executes S703；
S703：The data that feature is met is put into recombination region and is arranged in order；
S704：Judge single storage cell that S703 enters whether according to the coding of file or storage format
For correct file data；If then executing S705, if not executing S702 after then deleting this memory cell；
S705：Judge whether to scan to completing；Here basis scans file system afterbody and judges,
If completing, terminating, if not completing, executing S702.
Embodiment one：
Can be recovered in accordance with the following methods for QuickTime movie format video：
Parsing MBR disk partition table, obtains system partitioning information；
Clear area be can determine that according to system partitioning information；
Select the file type needing to recover, we select QuickTime here；
Retrieval QuickTime formatted file head, at " 512=4 ", file header is characterized as file header position：
“0X6674797069736F6D”；
Then File header information can be found according to file header if there are file header, have near file header
0X6D6F6F76(moov)、0X66726565(free)、0X7374737A(stse)、0X73747473
(stts), the spy such as 0X746B6864 (tkhd), 0X7374636F (stco), 0X73747373 (stss)
Levy, these are all attributed to file header, by these features, we can determine that QuickTime file header is believed
Breath and the storage mode of file；Without directly starting feature by data enters line retrieval.
Data starts feature：" 0X6D646174 ", in data data storage be according to frame storage and
There is the pointer (and describing the size of present frame and the beginning pointing to next node) pointing to next frame before every frame；
Can determine that next memory cell is current next node according to this structure, for example：Currently
Last pointer of little storage cell is " 0X000ACCDD ", and next clear area least unit is spliced
If jumping to next frame according to pointer " 0X000ACCDD ", just in next frame again after current data
" 0X000EFFGG ", this Frame be exactly splicing herein, if not continuing to next
Individual frame splicing is verified later；
Determine that belonging to the information of node just can be placed in recombination region, the like can find all numbers
According to.
Present invention specifically aims at jpg, compound document, compressed package, audio-video document, database file have
Preferably recover thinking.
Those of ordinary skill in the art will be appreciated that, embodiment described here is to aid in reader's reason
Solution the present invention implementation it should be understood that protection scope of the present invention be not limited to such especially old
State and embodiment.Those of ordinary skill in the art can make according to these technology disclosed by the invention enlightenment
Various without departing from the present invention essence other various concrete deformation and combine, these deformation and combination still this
In the protection domain of invention.
Claims (3)
1. a kind of data reconstruction method of fragment file, comprises the following steps：
S1：Open MBR disk partition table, parse MBR disk partition table, partition table obtains partition information；
S2：File partition table can be found according to the partition information in S1, obtain the ginseng of file system
Number, resolution file system can mark clear area；Record sector byte in each file partition table
Number, subregion basic allocation unit size parameter；
S3：Select the file type needing to recover；
S4：Retrieve the file header feature of the file requiring in S3 to recover according to the clear area determining in S2；
S5：Judge whether to scan file header feature；If finding, executing S6, if not finding, executing S7；
S6：Document storage mode obtained according to file header feature, carries out according to specific document storage mode
File is recombinated, and executes S8 after restructuring success；
S7：Document storage mode file according to prestoring carries out file restructuring, executes S8 after restructuring success；
S8：Extract successful file of recombinating.
2. a kind of data reconstruction method of fragment file according to claim 1 is it is characterised in that described S6
Comprise the following steps that：
S601：According to the file header feature retrieving, determine coded system or the file storage lattice of this kind of file
The type of formula, determines file size or tail of file feature；
S602：Create recombination region；
S603：File header information block is stored in recombination region；
S604：Order according to file memory format enters a unit to recombination region with minimum memory unit
File header information block after；
S605：Judge single storage cell that S604 enters whether according to the coding of file or storage format
For correct file data；If then executing S606, if not executing S604 after then deleting this memory cell；
S606：Judge whether that restructuring completes；Here the file size that can be obtained by S601 or end-of-file are special
Levy to judge, if restructuring completes, terminating, if not completing, executing S604.
3. a kind of data reconstruction method of fragment file according to claim 1 is it is characterised in that described S7
Detailed step as follows：
S701：Create the recombination region for file of recombinating；
S702：According to this class file prestoring coded format or storage feature in clear area with minimum
Memory cell retrieves data content, finds the memory cell data that feature meets and then executes S703；
S703：The data that feature is met is put into recombination region and is arranged in order；
S704：Judge single storage cell that S703 enters whether according to the coding of file or storage format
For correct file data；If then executing S705, if not executing S702 after then deleting this memory cell；
S705：Judge whether to scan to completing；Here basis scans file system afterbody and judges,
If completing, terminating, if not completing, executing S702.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510443869.8A CN106407038A (en) | 2015-07-27 | 2015-07-27 | Fragmented file data recovery method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510443869.8A CN106407038A (en) | 2015-07-27 | 2015-07-27 | Fragmented file data recovery method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106407038A true CN106407038A (en) | 2017-02-15 |
Family
ID=58008833
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510443869.8A Pending CN106407038A (en) | 2015-07-27 | 2015-07-27 | Fragmented file data recovery method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106407038A (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107220146A (en) * | 2017-05-24 | 2017-09-29 | 万兴科技股份有限公司 | A kind of file scan restoration methods and device |
| CN107977429A (en) * | 2017-11-30 | 2018-05-01 | 成都德尚视云科技有限公司 | Multimedia file extracting method |
| CN109697197A (en) * | 2018-12-25 | 2019-04-30 | 四川效率源信息安全技术股份有限公司 | A method of carving multiple Access database file |
| CN110851301A (en) * | 2019-10-22 | 2020-02-28 | 厦门市美亚柏科信息股份有限公司 | Recovery method and system for MP4 file |
| CN111400103A (en) * | 2020-03-23 | 2020-07-10 | 北亚企安科技(北京)有限公司 | Data recovery method for infotrend storage |
| CN111414277A (en) * | 2020-03-06 | 2020-07-14 | 网易（杭州）网络有限公司 | Data recovery method, device, electronic equipment and medium |
| CN113254263A (en) * | 2020-02-13 | 2021-08-13 | 青岛海信移动通信技术股份有限公司 | Electronic terminal and file recovery method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102298546A (en) * | 2011-09-07 | 2011-12-28 | 深圳市万兴软件有限公司 | Method and computer for restoring deleted joint picture group (JPG) file from disk |
| CN102937924A (en) * | 2012-10-30 | 2013-02-20 | 厦门市美亚柏科信息股份有限公司 | File allocation table (FAT) data recovery method based on file characteristic and file system |
| CN103645974A (en) * | 2013-12-31 | 2014-03-19 | 厦门市美亚柏科信息股份有限公司 | Method and device for recovering portable document format (PDF) file |
| CN104462433A (en) * | 2014-12-17 | 2015-03-25 | 四川效率源信息安全技术有限责任公司 | Method for recovering data of FAT32 partition |
-
2015
- 2015-07-27 CN CN201510443869.8A patent/CN106407038A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102298546A (en) * | 2011-09-07 | 2011-12-28 | 深圳市万兴软件有限公司 | Method and computer for restoring deleted joint picture group (JPG) file from disk |
| CN102937924A (en) * | 2012-10-30 | 2013-02-20 | 厦门市美亚柏科信息股份有限公司 | File allocation table (FAT) data recovery method based on file characteristic and file system |
| CN103645974A (en) * | 2013-12-31 | 2014-03-19 | 厦门市美亚柏科信息股份有限公司 | Method and device for recovering portable document format (PDF) file |
| CN104462433A (en) * | 2014-12-17 | 2015-03-25 | 四川效率源信息安全技术有限责任公司 | Method for recovering data of FAT32 partition |
Non-Patent Citations (1)
| Title |
|---|
| 杨德明: "FAT32下有效数据快速恢复方法", 《计算机应用》 * |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107220146A (en) * | 2017-05-24 | 2017-09-29 | 万兴科技股份有限公司 | A kind of file scan restoration methods and device |
| CN107220146B (en) * | 2017-05-24 | 2020-09-11 | 万兴科技股份有限公司 | File scanning recovery method and device |
| CN107977429A (en) * | 2017-11-30 | 2018-05-01 | 成都德尚视云科技有限公司 | Multimedia file extracting method |
| CN107977429B (en) * | 2017-11-30 | 2021-06-04 | 成都德尚视云科技有限公司 | Multimedia file extraction method |
| CN109697197A (en) * | 2018-12-25 | 2019-04-30 | 四川效率源信息安全技术股份有限公司 | A method of carving multiple Access database file |
| CN109697197B (en) * | 2018-12-25 | 2023-05-02 | 四川效率源信息安全技术股份有限公司 | Method for engraving and restoring Access database file |
| CN110851301A (en) * | 2019-10-22 | 2020-02-28 | 厦门市美亚柏科信息股份有限公司 | Recovery method and system for MP4 file |
| CN110851301B (en) * | 2019-10-22 | 2022-08-19 | 厦门市美亚柏科信息股份有限公司 | Recovery method and system for MP4 file |
| CN113254263A (en) * | 2020-02-13 | 2021-08-13 | 青岛海信移动通信技术股份有限公司 | Electronic terminal and file recovery method |
| CN111414277A (en) * | 2020-03-06 | 2020-07-14 | 网易（杭州）网络有限公司 | Data recovery method, device, electronic equipment and medium |
| CN111414277B (en) * | 2020-03-06 | 2023-10-20 | 网易（杭州）网络有限公司 | Data recovery method and device, electronic equipment and medium |
| CN111400103A (en) * | 2020-03-23 | 2020-07-10 | 北亚企安科技(北京)有限公司 | Data recovery method for infotrend storage |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106407038A (en) | Fragmented file data recovery method | |
| Pal et al. | Detecting file fragmentation point using sequential hypothesis testing | |
| US9305055B2 (en) | Method and apparatus for analysing data packets | |
| EP3323053B1 (en) | Document capture using client-based delta encoding with server | |
| WO2020151323A1 (en) | Data slicing-based data storage method, device, and medium | |
| US9348832B2 (en) | Method and device for reassembling a data file | |
| CN112286963B (en) | Block chain terminal data credible query system and implementation method thereof | |
| CN103916483A (en) | Self-adaptation data storage and reconstruction method for coding redundancy storage system | |
| US10733454B2 (en) | Transformation of video streams | |
| CN105447168A (en) | Method for restoring and recombining fragmented files in MP4 format | |
| KR100946694B1 (en) | System and Method for managing and detecting duplicate moving picture files based on video contents | |
| CN107679152A (en) | Data processing method based on multi-layer information joint index | |
| CN112380383A (en) | Efficient fault-tolerant indexing method for real-time video stream data | |
| US8635588B2 (en) | System and method for reconciling software source code | |
| CN104778252A (en) | Index storage method and index storage device | |
| CN106658034A (en) | File storage and reading method and device | |
| Pahade et al. | A survey on multimedia file carving | |
| Ravi et al. | A method for carving fragmented document and image files | |
| Hilgert et al. | Syntactical carving of PNGs and automated generation of reproducible datasets | |
| US9436551B2 (en) | Method for codec-based recovery of a video using a cluster search | |
| KR100500196B1 (en) | Apparatus and method for encoding/decoding multimedia meta-data in error-resilient manner | |
| Alghafli et al. | Identification and recovery of video fragments for forensics file carving | |
| Casey et al. | Design tradeoffs for developing fragmented video carving tools | |
| WO2020139563A1 (en) | Information processing method, hidden information parsing and embedding method, apparatus, and device | |
| CN110851301A (en) | Recovery method and system for MP4 file |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: No. 183 Songshan Road, Neijiang, Sichuan, Sichuan Applicant after: SICHUAN XLY INFORMATION SAFETY TECHNOLOGY CO., LTD. Address before: No. 183 Songshan Road, Neijiang, Sichuan, Sichuan Applicant before: Sichuan SalvationData Information Safety Technology Co., Ltd. |
|
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170215 |