Rar file carving recovery method based on contents

Abstract

The invention relates to a Rar file carving recovery method based on contents. The existing methods have the defect of poor file recovery effect. The method provided by the invention comprises the following steps: firstly, positioning a disk partition needing to be subjected to file carving recovery operation according to the information input by a user and obtaining the necessary information of the disk partition by using a system application programming interface (API) function; secondly, searching for the headers, data blocks and end of the Rar file on the disk partition and recording the initial positions of the three types of data blocks in the disk partition; thirdly, pretreating the set of the generated headers, data blocks and end; and finally, carrying out carving recovery on the Rar file. The method has the following beneficial effects: the operation speed is high, the accuracy is high, and each part forming the Rar file can be accurately searched out in short time.

Description

technical field [0001] The invention belongs to the technical field of information security and computer application, and relates to a method for engraving and restoring a Rar file, in particular to a method for engraving and restoring a Rar file when the disk has been deleted and the meta information of the relevant file system has been destroyed. Background technique [0002] With the advent of the information age, the number of computers and digital devices used is increasing year by year. At the same time, high-tech crimes and judicial disputes are becoming more and more prominent, and electronic evidence existing in computers and digital devices has gradually become one of the new litigation evidences. The evidence collection work of a large number of computer crime cases needs to extract the data stored in the computer, and the criminal The "traces" left by the perpetrators in the computer are provided to the court as effective litigation evidence in order to bring the...

AI Technical Summary

Problems solved by technology

Based on Header-Footer engraving technology, when dealing with the problem of Rar file engraving, it can only solve the situation of continuous storage and complete data on the disk. Since Rar files are usually large in size, they are usually stored in fragments on the disk. If adding and modifying operations are frequent, the possibility of continuous storage is even smaller. When a Rar file is deleted, due to the increase in disk usage time, shortage of disk space and other factors, the probability of the space occupied by its file data being allocated to a new file is extremely high. Large, that is, its file data is highly likely to be overwritten by rewriting

In the face of Rar file fragmentation and data loss carving problems, the traditional Header-Footer Carving cannot get good results. Some carving tools currently used in academic research such as: Foremost, PhotoRec, etc. are tested on actual disks Due to the adoption of similar engraving technology, although the false positive rate is lower than that of commercial software, but because it can only restore files stored continuously, it still cannot get satisfactory results

Images