Depth data recovery method for damaged BTRFS file system

Abstract

The invention discloses a depth data recovery method for a damaged BTRFS file system, and the method is characterized in that the method comprises the following steps: S100, employing a data structure of the BTRFS file system to obtain undamaged metadata, including a super block, a block tree, a root tree and a file system tree; s200: scanning the space in the partition except the metadata which is not damaged in the step S100, and extracting damaged metadata according to the structural characteristics of the metadata of the BTRFS file system; and S300, analyzing the metadata, extracting file information and performing duplicate removal. According to the technical scheme disclosed by the invention, the technical problem that in the prior art, data cannot be recovered or the recovery effect is poor due to the fact that the management file of the BTRFS file system is abnormal due to deletion, viruses and manual misoperation for the damaged BTRFS file system is solved.

Description

Technical Field

[0001] The invention belongs to the field of electronic data and data recovery and evidence collection, and relates to a deep data recovery method for a damaged BTRFS file system. Background Art

[0002] As a new generation of file system after Ext, BTRFS inherits the advantages of many file systems and adds a lot of new features, such as built-in arrays, subvolumes, snapshots, etc. After years of improvement and optimization, it has been increasingly applied to actual environments.

[0003] The BTRFS file system stores a large number of files. For a damaged BTRFS file system, for example, due to virus invasion, human error, etc., files may be lost; at the same time, virus invasion, disk damage, etc. may also damage the BTRFS file system itself and make it unusable. Such damage will cause abnormalities in the management files of the BTRFS file system.

[0004] The existing technology can only recover the data of the normal BTRFS file system. For the damaged BTRFS file system, for example, due to deletion, virus, or human error, the abnormality of the management file of the BTRFS file system cannot be recovered or the recovery effect is poor. Therefore, studying the data recovery method of the damaged BTRFS file system can fill this deficiency and has high practical value. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention deeply studies the internal structure of the BTRFS file system and provides a deep data recovery method for a damaged BTRFS file system: by adopting the data structure of the BTRFS file system, obtaining undamaged metadata, extracting damaged metadata, parsing metadata, and extracting file information, the method includes the following steps:

[0006] S100: Using the data structure of the BTRFS file system to obtain undamaged metadata, including a super block, a block tree, a root tree, and a file system tree, step S100 includes the following steps:

[0007] S101: Taking the first address of the partition as the starting address, taking 0x10000, 0x4000000, and 0x4000000000 as the offsets, respectively addressing and obtaining the continuous 4KB byte content, and respectively using them as the first super block, the second super block, and the third super block;

[0008] S102: According to the data structure of the super block of the BTRFS file system, check and determine whether the first super block, the second super block, and the third super block are not damaged. If so, execute step S103; otherwise, execute step S200;

[0009] S103: Record the undamaged super block as the fourth super block, and obtain the logical address, block tree block item, and block tree device item of the block tree of the fourth super block;

[0010] S104: Calculate the physical address of the block tree: the physical address of the block tree is equal to the logical address of the block tree - the offset of the block tree block item + the offset of the stripe of the block tree block item + the offset of the block tree device item, wherein each offset takes the partition first address as the starting address;

[0011] S105: extracting the block tree according to the physical address of the block tree;

[0012] S106: using the fourth super block to obtain the logical address of the root tree;

[0013] S107: Searching for a root tree block item and a root tree device item corresponding to a root tree logical address in a block tree;

[0014] S108: Calculate the physical address of the root tree: the physical address of the root tree is equal to the logical address of the root tree - the offset of the root tree block item + the offset of the stripe of the root tree block item + the offset of the root tree device item, wherein each offset takes the partition first address as the starting address;

[0015] S109: extracting a root tree using the root tree physical address;

[0016] S110: using the root tree to obtain the logical address of the file system tree;

[0017] S111: Searching for the file system tree block item and the file system tree device item corresponding to the file system tree logical address in the block tree;

[0018] S112: Calculate the physical address of the file system tree: the physical address of the file system tree is equal to the logical address of the file system tree - the offset of the file system tree block item + the offset of the stripe of the file system tree block item + the offset of the file system tree device item, wherein each offset takes the partition first address as the starting address;

[0019] S113: extracting the file system tree using the file system tree physical address;

[0020] S200: Scan the space in the partition except for the metadata that is not damaged in step S100, and extract the damaged metadata according to the structural characteristics of the BTRFS file system metadata;

[0021] S300: Parse metadata, extract file information and remove duplicates.

[0022] Preferably, step S200 includes the following steps:

[0023] S201: Obtain the byte length of the leaf node through the super block: determine whether there is a damaged super block. If the super block is damaged, the byte length of the leaf node is set to 16KB. Otherwise, read the byte length of the leaf node recorded in the super block.

[0024] S202: Determine whether the scan reaches the end of the partition, if yes, execute step S300, otherwise, execute step S203;

[0025] S203: Check and determine whether the currently scanned space is a space other than the metadata that is not damaged in step S100, if yes, execute step S204, otherwise, execute step S207;

[0026] S204: addressing the first address of the current sector and continuously reading the byte content, the byte length of the read byte content is the byte length of the current leaf node;

[0027] S205: According to the structural characteristics of the leaf node in the BTRFS file system tree, check whether the currently read byte content is a leaf node of the file system tree, if yes, execute step S206, otherwise, execute step S208;

[0028] S206: extract the leaf node, and insert the corresponding file system tree according to the tree ID contained in the leaf node, and execute step S208;

[0029] S207: address the next sector and execute step S202;

[0030] S208: Addressing the Nth sector offset backward from the current sector, executing step S202, where N corresponds to the byte length of the current leaf node:

[0031] When the byte length of the current leaf node is 16KB, N is 32;

[0032] When the byte length of the current leaf node is 32KB, N is 64.

[0033] Preferably, step S300 includes the following steps:

[0034] S301: Obtain a first file system tree and its first leaf node, and a first leaf item of the first leaf node, and set the extracted file information set to be empty;

[0035] S302: Determine whether the parsing of all file system trees is completed, if yes, execute step S316, otherwise, execute step S303;

[0036] S303: Determine whether the scan reaches the end of the current file system tree. If yes, execute step S304; otherwise, execute step S305;

[0037] S304: Get the next file system tree and execute step S302;

[0038] S305: Determine whether the scan reaches the end of the current leaf node, if yes, execute step S306, otherwise, execute step S307;

[0039] S306: Get the next leaf node and execute step S303;

[0040] S307: Check whether the leaf item is a region item, if yes, execute step S311, otherwise, execute step S308;

[0041] S308: parsing leaf items and extracting file information according to the data structure in the BTRFS file system, wherein the leaf items include node items and directory items;

[0042] S309: Check whether the extracted file information set is the same as the file information extracted in step S308, if yes, execute step 310, otherwise, execute step S305;

[0043] S310: Deduplication: discard the file information extracted in the current step S308, keep the file data in the extracted file information set non-duplicate, and execute step S305;

[0044] S311: According to the data structure in the BTRFS file system, the zone item is parsed to obtain the logical address and byte length of the file data;

[0045] S312: Searching for a block item and a device item corresponding to the logical address in the block tree;

[0046] S313: Calculate the physical address of the file data: the physical address of the file data is equal to the logical address - the offset of the block item + the offset of the stripe of the block item + the offset of the device item, wherein each offset takes the first address of the partition as the starting address;

[0047] S314: using the physical address and byte length, addressing and acquiring file data, and adding the acquired file data to the extracted file information set;

[0048] S315: Get the next leaf item and execute step S305;

[0049] S316: Output the extracted file information set and end the process.

[0050] The beneficial effects of the present invention are:

[0051] 1. Efficiently extract BTRFS file system metadata from damaged partitions;

[0052] 2. Quickly and accurately extract file information and data through metadata. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is the overall flow chart of the present invention;

[0054] Figure 2 A flowchart of obtaining undamaged metadata in an embodiment of the present invention;

[0055] Figure 3 A flowchart of extracting damaged metadata in an embodiment of the present invention;

[0056] Figure 4 The flowchart of parsing metadata, extracting file information and removing duplicates in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The terms that may be used in the present invention are as follows:

[0058] Sector: The smallest storage unit of a disk.

[0059] Block: A certain number of consecutive sectors, which is the basic unit for storing data.

[0060] B-tree: A self-balancing multi-way search tree used to keep data in order and optimize data reading and writing.

[0061] Metadata: describes the management information of data, including super block, root tree, block tree, file system tree, etc. in BTRFS file system

[0062] Superblock: A block that stores critical information in the BTRFS file system.

[0063] Root tree: A B-tree in the BTRFS file system that is used to manage information about other trees.

[0064] Block tree: A B-tree in the BTRFS file system that manages blocks and maintains the mapping between logical addresses and physical addresses.

[0065] File system tree: A B-tree in the BTRFS file system used to manage file information.

[0066] Leaf node: A node without child nodes in the B-tree. It is the bottom-level node in the B-tree and is used to store actual data. In the BTRFS file system, it is usually 32 consecutive sectors.

[0067] Leaf item: A general term for the data structures in the leaf nodes of the B-tree in the BTRFS file system, including block items, device items, node items, directory items, zone items, etc.

[0068] Stripe: A data structure in a block item that is used to describe the data blocks that are divided when building an array.

[0069] This application incorporates the entire contents of the invention application entitled "A method for extracting BTRFS file system metadata from a partition", application number and application date into this invention application by reference.

[0070] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0071] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0072] S100: Using the data structure of the BTRFS file system to obtain undamaged metadata, including a super block, a block tree, a root tree, and a file system tree.

[0073] Figure 2 A flow chart of obtaining undamaged metadata in an embodiment of the present invention is shown.

[0074] like Figure 2 As shown, step S100 includes the following steps:

[0075] S101: Taking the first address of the partition as the starting address, taking 0x10000, 0x4000000, and 0x4000000000 as the offsets, respectively addressing and obtaining the continuous 4KB byte content, and respectively using them as the first super block, the second super block, and the third super block;

[0076] S102: According to the data structure of the super block of the BTRFS file system, check and determine whether the first super block, the second super block, and the third super block are not damaged. If so, execute step S103; otherwise, execute step S200;

[0077] S103: Record the undamaged super block as the fourth super block, and obtain the logical address, block tree block item, and block tree device item of the block tree of the fourth super block;

[0078] S104: Calculate the physical address of the block tree: the physical address of the block tree is equal to the logical address of the block tree - the offset of the block tree block item + the offset of the stripe of the block tree block item + the offset of the block tree device item, wherein each offset takes the partition first address as the starting address;

[0079] S105: extracting the block tree according to the physical address of the block tree;

[0080] S106: using the fourth super block to obtain the logical address of the root tree;

[0081] S107: Searching for a root tree block item and a root tree device item corresponding to a root tree logical address in a block tree;

[0082] S108: Calculate the physical address of the root tree: the physical address of the root tree is equal to the logical address of the root tree - the offset of the root tree block item + the offset of the stripe of the root tree block item + the offset of the root tree device item, wherein each offset takes the partition first address as the starting address;

[0083] S109: extracting a root tree using the root tree physical address;

[0084] S110: using the root tree to obtain the logical address of the file system tree;

[0085] S111: Searching for the file system tree block item and the file system tree device item corresponding to the file system tree logical address in the block tree;

[0086] S112: Calculate the physical address of the file system tree: the physical address of the file system tree is equal to the logical address of the file system tree - the offset of the file system tree block item + the offset of the stripe of the file system tree block item + the offset of the file system tree device item, wherein each offset takes the partition first address as the starting address;

[0087] S113: extracting the file system tree using the file system tree physical address;

[0088] S200: Scan the space in the partition except for the metadata that is not damaged in step S100, and extract the damaged metadata according to the structural characteristics of the BTRFS file system metadata.

[0089] Figure 3 A flow chart of extracting damaged metadata in an embodiment of the present invention is shown.

[0090] like Figure 3 As shown, step S200 includes the following steps:

[0091] S201: Obtain the byte length of the leaf node through the super block: determine whether there is a damaged super block. If the super block is damaged, the byte length of the leaf node is set to 16KB. Otherwise, read the byte length of the leaf node recorded in the super block.

[0092] S202: Determine whether the scan reaches the end of the partition, if yes, execute step S300, otherwise, execute step S203;

[0093] S203: Check and determine whether the currently scanned space is a space other than the metadata that is not damaged in step S100, if yes, execute step S204, otherwise, execute step S207;

[0094] S204: addressing the first address of the current sector and continuously reading the byte content, the byte length of the read byte content is the byte length of the current leaf node;

[0095] This application incorporates the entire contents of the invention application entitled "A method for extracting BTRFS file system metadata from a partition", application number and application date into this invention application by reference.

[0096] S205: According to the structural characteristics of the leaf node in the BTRFS file system tree, check whether the currently read byte content is a leaf node of the file system tree, if yes, execute step S206, otherwise, execute step S208;

[0097] Regarding the question of how to check whether the currently read byte content is a leaf node of the file system tree, please refer to the technical solution disclosed in the above-mentioned invention application "A method for extracting BTRFS file system metadata from a partition" and refer to the step S501 to determine whether it is a leaf node (the detailed steps are included in steps S501 to S513).

[0098] S206: extract the leaf node, and insert the corresponding file system tree according to the tree ID contained in the leaf node, and execute step S208;

[0099] S207: address the next sector and execute step S202;

[0100] S208: Addressing the Nth sector offset backward from the current sector, executing step S202, where N corresponds to the byte length of the current leaf node:

[0101] When the byte length of the current leaf node is 16KB, N is 32;

[0102] When the byte length of the current leaf node is 32KB, N is 64;

[0103] S300: Parse metadata, extract file information and remove duplicates.

[0104] Figure 4 A flow chart of parsing metadata, extracting file information and removing duplicates in an embodiment of the present invention is shown.

[0105] like Figure 4 As shown, step S300 includes the following steps:

[0106] S301: Obtain a first file system tree and its first leaf node, as well as a first leaf item of the first leaf node, and set the extracted file information set to be empty;

[0107] S302: Determine whether the parsing of all file system trees is completed, if yes, execute step S316, otherwise, execute step S303;

[0108] S303: Determine whether the scan reaches the end of the current file system tree. If yes, execute step S304; otherwise, execute step S305;

[0109] S304: Get the next file system tree and execute step S302;

[0110] S305: Determine whether the scan reaches the end of the current leaf node, if yes, execute step S306, otherwise, execute step S307;

[0111] S306: Get the next leaf node and execute step S303;

[0112] S307: Check whether the leaf item is a region item, if yes, execute step S311, otherwise, execute step S308;

[0113] S308: parsing leaf items and extracting file information according to the data structure in the BTRFS file system, wherein the leaf items include node items and directory items;

[0114] S309: Check whether the extracted file information set is the same as the file information extracted in step S308, if yes, execute step 310, otherwise, execute step S305;

[0115] S310: Deduplication: discard the file information extracted in the current step S308, keep the file data in the extracted file information set non-duplicate, and execute step S305;

[0116] S311: According to the data structure in the BTRFS file system, the zone item is parsed to obtain the logical address and byte length of the file data;

[0117] S312: Searching for a block item and a device item corresponding to the logical address in the block tree;

[0118] S313: Calculate the physical address of the file data: the physical address of the file data is equal to the logical address - the offset of the block item + the offset of the stripe of the block item + the offset of the device item, wherein each offset takes the first address of the partition as the starting address;

[0119] S314: using the physical address and byte length, addressing and acquiring file data, and adding the acquired file data to the extracted file information set;

[0120] S315: Get the next leaf item and execute step S305;

[0121] S316: Output the extracted file information set and end the process.

[0122] The method provided by the present invention solves the technical problem in the prior art that the damaged BTRFS file system cannot be restored or the restoration effect is poor.

[0123] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A deep data recovery method for a damaged BTRFS file system, characterized in that The following steps are involved: S100: Using the data structure of the BTRFS file system to obtain undamaged metadata, including a super block, a block tree, a root tree, and a file system tree, step S100 includes the following steps: S101: Taking the first address of the partition as the starting address, taking 0x10000, 0x4000000, and 0x4000000000 as the offsets, respectively addressing and obtaining the continuous 4KB byte content, and respectively using them as the first super block, the second super block, and the third super block; S102: According to the data structure of the super block of the BTRFS file system, check and determine whether the first super block, the second super block, and the third super block are not damaged. If so, execute step S103; otherwise, execute step S200; S103: Record the undamaged super block as the fourth super block, and obtain the logical address, block tree block item, and block tree device item of the block tree of the fourth super block; S104: Calculate the physical address of the block tree: the physical address of the block tree is equal to the logical address of the block tree - the offset of the block tree block item + the offset of the stripe of the block tree block item + the offset of the block tree device item, wherein each offset takes the partition first address as the starting address; S105: extracting the block tree according to the physical address of the block tree; S106: using the fourth super block to obtain the logical address of the root tree; S107: Searching for a root tree block item and a root tree device item corresponding to a root tree logical address in a block tree; S108: Calculate the physical address of the root tree: the physical address of the root tree is equal to the logical address of the root tree - the offset of the root tree block item + the offset of the stripe of the root tree block item + the offset of the root tree device item, wherein each offset takes the partition first address as the starting address; S109: extracting a root tree using the root tree physical address; S110: using the root tree to obtain the logical address of the file system tree; S111: Searching for the file system tree block item and the file system tree device item corresponding to the file system tree logical address in the block tree; S112: Calculate the physical address of the file system tree: the physical address of the file system tree is equal to the logical address of the file system tree - the offset of the file system tree block item + the offset of the stripe of the file system tree block item + the offset of the file system tree device item, wherein each offset takes the partition first address as the starting address; S113: extracting the file system tree using the file system tree physical address; S200: Scan the space in the partition except for the metadata that is not damaged in step S100, and extract the damaged metadata according to the structural characteristics of the BTRFS file system metadata; S300: Parse metadata, extract file information and remove duplicates.

2. A deep data recovery method for a damaged BTRFS file system according to claim 1, characterized in that: Step S200 includes the following steps: S201: Obtain the byte length of the leaf node through the super block: determine whether there is a damaged super block. If the super block is damaged, the byte length of the leaf node is set to 16KB. Otherwise, read the byte length of the leaf node recorded in the super block. S202: Determine whether the scan reaches the end of the partition, if yes, execute step S300, otherwise, execute step S203; S203: Check and determine whether the currently scanned space is a space other than the metadata that is not damaged in step S100, if yes, execute step S204, otherwise, execute step S207; S204: addressing the first address of the current sector and continuously reading the byte content, the byte length of the read byte content is the byte length of the current leaf node; S205: According to the structural characteristics of the leaf node in the BTRFS file system tree, check whether the currently read byte content is a leaf node of the file system tree, if yes, execute step S206, otherwise, execute step S208; S206: extract the leaf node, and insert the corresponding file system tree according to the tree ID contained in the leaf node, and execute step S208; S207: address the next sector and execute step S202; S208: Addressing the Nth sector offset backward from the current sector, executing step S202, where N corresponds to the byte length of the current leaf node: When the byte length of the current leaf node is 16KB, N is 32; When the byte length of the current leaf node is 32KB, N is 64.

3. A deep data recovery method for a damaged BTRFS file system according to claim 1, characterized in that: Step S300 includes the following steps: S301: Obtain a first file system tree and its first leaf node, and a first leaf item of the first leaf node, and set the extracted file information set to be empty; S302: Determine whether the parsing of all file system trees is completed, if yes, execute step S316, otherwise, execute step S303; S303: Determine whether the scan reaches the end of the current file system tree. If yes, execute step S304; otherwise, execute step S305; S304: Get the next file system tree and execute step S302; S305: Determine whether the scan reaches the end of the current leaf node, if yes, execute step S306, otherwise, execute step S307; S306: Get the next leaf node and execute step S303; S307: Check whether the leaf item is a region item, if yes, execute step S311, otherwise, execute step S308; S308: parsing leaf items and extracting file information according to the data structure in the BTRFS file system, wherein the leaf items include node items and directory items; S309: Check whether the extracted file information set is the same as the file information extracted in step S308, if yes, execute step 310, otherwise, execute step S305; S310: Deduplication: discard the file information extracted in the current step S308, keep the file data in the extracted file information set non-duplicate, and execute step S305; S311: According to the data structure in the BTRFS file system, the zone item is parsed to obtain the logical address and byte length of the file data; S312: Searching for a block item and a device item corresponding to the logical address in the block tree; S313: Calculate the physical address of the file data: the physical address of the file data is equal to the logical address - the offset of the block item + the offset of the stripe of the block item + the offset of the device item, wherein each offset takes the first address of the partition as the starting address; S314: using the physical address and byte length, addressing and acquiring file data, and adding the acquired file data to the extracted file information set; S315: Get the next leaf item and execute step S305; S316: Output the extracted file information set and end the process.

Images