Method for recovering file by reducing initial cluster number of FAT32 directory entry

Abstract

The invention discloses a method for recovering a file by reducing the initial cluster number of an FAT32 directory entry. The method comprises the following steps: 1, searching a data area, and distinguishing deleted files; 2, acquiring the high level of the initial cluster number of the directory entry according to the directory entry of a deleted file; 3, searching a directory entry of which the high level is zeroed, and recoding; 4, extracting the directory entry recorded in the step 3 to recover a corresponding file; and 5, judging whether the task is completed, if the task is completed, ending the operation, and if the task is not completed, executing the step 4. By adopting the method, files of which the high level of the initial cluster number is cleared can be found and recovered, the research range can be reduced according to a parent directory or the high level of a file of a same class, the program operation time is shortened, files can be recovered through three levels of judgment, and the success rate is increased.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for recovering a file by restoring the initial cluster number of a FAT32 directory item. Background technique [0002] FAT32 is one of the main partition formats of Windows system hard disk. The stored data involves people's work, study, life, communication, finance, leisure, entertainment, emotion, etc., which are very precious intangible assets for individuals or companies. At the same time, as a kind of electronic evidence, the hard disk data of criminal suspects is the key to solving cases by public security organs, procuratorates and other judicial departments. [0003] At present, the common method of recovering deleted data in the FAT32 file system is mainly to restore the low bits of the initial cluster number of the file directory entry, but if the high bit of the initial cluster number is cleared, the first cluster of the combination of high and lo...

AI Technical Summary

Problems solved by technology

[0003] At present, the common method of recovering deleted data in the FAT32 file system is mainly to restore the low bits of the initial cluster number of the file directory entry, but if the high bit of the initial cluster number is cleared, the first cluster of the combination of high and low bits is incorrect and cannot Correctly restore files; therefore, there is an urgent need for a method to restore the starting cluster number of the FAT32 directory entry to restore the file

Images