Electronic data recovery method

A recovery method and electronic data technology, applied in the computer field, can solve problems such as misunderstanding and deletion, and the principle of file deletion is not thorough enough, so as to achieve the effect of improving the possibility

Active Publication Date: 2013-01-16
SHENYANG CONTAIN ELECTRONICS SCI & TECH CO LTD
View PDF1 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, in the experiment, this phenomenon will also occur if the file that has just been deleted is restored immediately, and it will not work to explain it by overwriting
[0005]After research, it is found that the reason is that people do not know the principle of file deletion thoroughly enough, which leads to misunderstanding of some deletion phenomena

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Electronic data recovery method
  • Electronic data recovery method
  • Electronic data recovery method

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0048] 1. The principle of data recovery.

[0049] In the FAT32 file system, the starting cluster number of the file is composed of sixteen bytes, the lower eight bits of data are stored at the relative offset 1AH-1BH, and the upper eight bits are stored at the relative offset 1AH-1BH place. The first cluster number of the original data of the file can be obtained through calculation. by Figure 2-1 , Figure 2-2 For example, the data at relative offset 1AH-1BH is "97 02", and the data at relative offset 1AH-1BH is "03 00". According to the principle that data bytes are stored in order from low to high, then the The starting cluster number of the file is "00 03 02 97", which is 197271 in decimal. By comparing the data at cluster number 197291 with Figure 2-1 The comparison can prove that the data of this cluster is the content of the first cluster of the file, see Figure 2-3 .

[0050] The data recovery method is generally to find the data start cluster numbe...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention belongs to the field of computers, and in particular relates to a method for recovering electronic data, which can be realized according to the following steps: (1) open the target disk, and turn to the root directory area; (2) scan the directory items one by one, and find the directory items starting with E5 ;(3) Offset 0BH is 10H or 20H; at the same time, offset 0BH is 0FH, and continue to find the directory entry whose data at this location is 10H or 20H; (4) Offset 14~15H and offset 1A~1BH It is the cluster number stored in the file, and the reading sequence is 15H14H1BH1AH; (5) Offset 1C~1FH is the file size (B), shift 1FH1EH1DH1CH bytes downward from the found starting position, and select it as the end of the block;( 6) Copy the selected part to the specified location. The invention greatly improves the possibility of data recovery, and provides a guarantee for comprehensively and objectively completing the electronic material evidence appraisal task.

Description

technical field [0001] The invention belongs to the field of computers, in particular to an electronic data recovery method. Background technique [0002] In the 21st century with the rapid development of information technology, computer technology is changing with each passing day and is closely related to people's daily life. The loss of storage device data often brings endless troubles and troubles to individuals and even units. In the field of public security, these data may be the electronic evidence of the case. If inspectors can obtain more data in the computer, it will be more conducive to the early detection of the case, and more reliable evidence can be provided to the court. This puts higher demands on data forensics, especially recovery work. [0003] At present, the most popular data forensics and recovery commercial software in the domestic and foreign markets include FinalData, EnCase, WinHex, EasyRecovery and Forensic Master, etc. Among them, the latter tw...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
Patent Type & Authority Patents(China)
IPC IPC(8): G06F11/14
Inventor 秦玉海胡颖刘奇志
Owner SHENYANG CONTAIN ELECTRONICS SCI & TECH CO LTD
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap