A method, device and electronic device for searching file deletion time in NTFS
The method and device in the NTFS system allow for determining the deletion time of files by searching and parsing the $Logfile file, sorting record items, and extracting relevant data, enhancing data recovery capabilities.
Patent Information
- Application Number
- CN202011502940.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-12-17
- Publication Date
- 2024-12-10
- Estimated Expiration
- 2040-12-17
AI Technical Summary
Existing NTFS file systems do not provide a method to determine the deletion time of deleted files, which is crucial for users recovering accidentally deleted files.
A method and device that search for the $Logfile file in the NTFS system, parse and sort its record items, divide them into transactions, identify deletion transactions, and extract the file name and deletion time from target record items using specific operations.
Enables the determination of the deletion time of deleted files in the NTFS file system, facilitating effective recovery of lost data.
Smart Images
Figure CN112486924B_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of the present specification relate to the technical field of searching for file deletion time in NTFS, and more particularly to a method, device, and electronic device for searching for file deletion time in NTFS. Background Art
[0002] NTFS is the mainstream file system on Windows. Under this file system, if you need to recover deleted files, you currently mostly look for them based on the $MFT file of the file system. However, even if you can find the deleted files, you can only determine the creation time and modification time of the deleted files, but not the deletion time of the files. After a file is deleted, many people may not remember when the file was created or modified, but only when the file was deleted. Therefore, for users who want to recover accidentally deleted files, determining the deletion time of deleted files is of great practical significance. Summary of the invention
[0003] In view of this, the purpose of one or more embodiments of the present specification is to provide a method, device and electronic device for searching for file deletion time in NTFS, which can determine the deletion time of deleted files in the NTFS file system.
[0004] Based on the above purpose, one or more embodiments of this specification provide a method for finding file deletion time in NTFS, including:
[0005] Find the $Logfile file based on the NTFS volume header information;
[0006] Parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence numbers of the record items;
[0007] Dividing the sorted record items into a plurality of transactions;
[0008] For each transaction, find whether there is a record entry whose redo operation is DeallocateFileRecordSegmen in the transaction. If yes, the transaction is a delete transaction.
[0009] For each record item in the delete transaction, find the target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop;
[0010] The file name and the corresponding file deletion time are extracted from the target record item.
[0011] As an optional implementation manner, locating and searching the $Logfile file according to the volume header information of NTFS includes:
[0012] Locate the $MFT file based on the NTFS volume header information;
[0013] Search the $Logfile file through the $MFT file.
[0014] As an optional implementation, the serial number consists of the first 8 bytes of the record item.
[0015] As an optional implementation manner, the ordering the record items based on the sequence numbers of the record items includes:
[0016] The record items are sorted in ascending order of the sequence numbers.
[0017] As an optional implementation, the record item sequence is divided into multiple transactions, wherein the first record item of each transaction is a record item with a previous sequence number of 0, and the last record item is a record item with a redo operation of ForgetTransaction.
[0018] As an optional implementation, the integer consisting of 8 bytes starting from the offset 8 bytes of each record item is the previous sequence number, and the integer value consisting of 2 bytes at the offset 0x30 position of each record item is the redo operation value.
[0019] As an optional implementation, the 2-byte integer value at the offset 0x32 position of each record item is the undo operation value.
[0020] As an optional implementation, in the content area of the redo operation of the target record item, the 8 bytes starting from the offset 0x20 are the value of the deletion time, and the 8 bytes starting from the offset 0x52 are the name of the deleted file or folder.
[0021] As a second aspect of the present invention, a device for searching for file deletion time in NTFS is also provided, comprising:
[0022] The first search unit is used to search for the $Logfile file according to the volume header information of NTFS;
[0023] A parsing and sorting unit, used for parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence numbers of the record items;
[0024] A division unit, used for dividing the sorted record items into a plurality of transactions;
[0025] The second search unit is used to search, for each transaction, whether there is a record entry whose redo operation is DeallocateFileRecordSegmen in the transaction, and if so, the transaction is a delete transaction;
[0026] A third search unit is used to search for a target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop for each record item in the deletion transaction;
[0027] The extraction unit is used to extract the file name and the corresponding file deletion time from the target record item.
[0028] As a third aspect of the present invention, there is also provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the program.
[0029] From the above description, it can be seen that one or more embodiments of the present specification provide a method, device and electronic device for searching file deletion time in NTFS, which searches for the $Logfile file in the file system, sorts the record items in the found $Logfile file, divides the sorted record items into multiple transactions, finds the deletion transaction therein, searches for the target record item based on the redo operation and the undo operation for the record item in the deletion transaction, extracts the file name and the corresponding file deletion time from the target record item, thereby realizing the determination of the deletion time of the deleted file in the NTFS file system. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] In order to more clearly illustrate one or more embodiments of the present specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only one or more embodiments of the present specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0031] Figure 1 A logical diagram of a method for finding file deletion time in NTFS according to one or more embodiments of this specification;
[0032] Figure 2 A logical schematic diagram of a device for searching for file deletion time in NTFS according to one or more embodiments of the present specification;
[0033] Figure 3 A schematic diagram of an electronic device according to one or more embodiments of the present specification. DETAILED DESCRIPTION
[0034] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.
[0035] To achieve the above-mentioned object of the invention, the present invention provides a method for searching file deletion time in NTFS, comprising:
[0036] Find the $Logfile file based on the NTFS volume header information;
[0037] Parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence numbers of the record items;
[0038] Dividing the sorted record items into a plurality of transactions;
[0039] For each transaction, find whether there is a record entry whose redo operation is DeallocateFileRecordSegmen in the transaction. If yes, the transaction is a delete transaction.
[0040] For each record item in the delete transaction, find the target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop;
[0041] The file name and the corresponding file deletion time are extracted from the target record item.
[0042] In an embodiment of the present invention, by searching for a $Logfile file in a file system and sorting the record items in the found $Logfile file, the sorted record items are divided into multiple transactions, and the deletion transaction is found. For the record items in the deletion transaction, the target record item is searched based on the redo operation and the undo operation, and the file name and the corresponding file deletion time are extracted from the target record item, thereby realizing the determination of the deletion time of the deleted file in the NTFS file system.
[0043] like Figure 1 As shown, the present invention provides a method for searching file deletion time in NTFS, comprising:
[0044] S100. Search for the $Logfile file according to the NTFS volume header information.
[0045] Optionally, locating and searching for the $Logfile file according to the volume header information of NTFS includes:
[0046] Locate the $MFT file based on the NTFS volume header information;
[0047] Search the $Logfile file through the $MFT file.
[0048] S200, parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence numbers lsn of the record items.
[0049] The serial number lsn is composed of the first 8 bytes of the record item.
[0050] The record items are sorted in ascending order of the sequence numbers.
[0051] Among them, the record item: record is an operation on the NTFS metafile.
[0052] S300: Divide the sorted record items into multiple transactions.
[0053] Transaction: A transaction consists of multiple record items.
[0054] Applications can use Transactional NTFS to group a series of changes to files into a transaction. Transactions ensure that all changes are either effective or invalidated at the same time, and that external applications cannot be notified of any changes until the transaction is committed.
[0055] The first record item of each transaction is the record item with the previous sequence number pre lsn being 0, and the last record item is the record item with the redo operation being ForgetTransaction (value being 27).
[0056] Among them, the Redo operation is the operation performed on the current record item.
[0057] Each record item stores the serial number lsn of the current record item and the serial number of the record item immediately before the current record item, recorded as the previous serial number pre lsn.
[0058] For the first record item of each transaction, there is no previous record item, so the previous sequence number pre lsn of the first record item is 0.
[0059] The integer consisting of 8 bytes starting from the offset of 8 bytes of each record item is the previous sequence number pre lsn, and the integer value consisting of 2 bytes at the offset of 0x30 of each record item is the redo operation value.
[0060] S400. For each transaction, find out whether there is a record entry whose redo operation is DeallocateFileRecordSegmen (value is 3) in the transaction. If yes, the transaction is a delete transaction.
[0061] S500, for each record item in the deletion transaction, search for a target record item whose redo operation is UpdateNonResidentValue (value is 8) and whose undo operation is Noop (value is 0);
[0062] Among them, the undo operation is to withdraw the operation of the current record item. The 2 bytes at the offset 0x38 of each record item represent the offset of the undo operation content, and the 2 bytes at the position 0x40 represent the length of the undo operation content.
[0063] The 2-byte integer value at the offset 0x32 position of each record item is the undo operation value. In the content area of the undo operation value, the name of the deleted file or folder starts at the offset 0x52 position.
[0064] S600: Extract the file name and the corresponding file deletion time from the target record item.
[0065] Among them, in the content area of the redo operation of the target record item, the 8 bytes starting from the offset 0x20 are the value of the deletion time, and the 8 bytes starting from the offset 0x52 are the names of the deleted files or folders.
[0066] Among them, the 2 bytes at the offset 0x34 position of the target record item represent the offset of the redo operation content, and the 2 bytes at the position 0x36 represent the length of the redo operation content.
[0067] It should be noted that the method of one or more embodiments of this specification can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of this specification, and the multiple devices will interact with each other to complete the described method.
[0068] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0069] Corresponding to the method for searching for file deletion time in NTFS, the present invention also provides a device for searching for file deletion time in NTFS, such as Figure 2 As shown, including:
[0070] The first search unit 10 is used to search for the $Logfile file according to the volume header information of NTFS;
[0071] A parsing and sorting unit 20, configured to parse the $Logfile file, obtain the record items therein, and sort the record items based on the sequence numbers of the record items;
[0072] A division unit 30, configured to divide the sorted record items into a plurality of transactions;
[0073] The second search unit 40 is used to search, for each transaction, whether there is a record entry whose redo operation is DeallocateFileRecordSegmen in the transaction, and if so, the transaction is a delete transaction;
[0074] The second search unit 50 is used to search for a target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop for each record item in the deletion transaction;
[0075] The extraction unit 60 is used to extract the file name and the corresponding file deletion time from the target record item.
[0076] In an embodiment of the present invention, by searching for a $Logfile file in a file system and sorting the record items in the found $Logfile file, the sorted record items are divided into multiple transactions, and the deletion transaction is found. For the record items in the deletion transaction, the target record item is searched based on the redo operation and the undo operation, and the file name and the corresponding file deletion time are extracted from the target record item, thereby realizing the determination of the deletion time of the deleted file in the NTFS file system.
[0077] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of this specification should be understood by people with ordinary skills in the field to which this disclosure belongs. The words "first", "second" and similar words used in one or more embodiments of this specification do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprises" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.
[0078] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more embodiments of this specification, the functions of each module can be implemented in the same or multiple software and / or hardware.
[0079] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, one or more embodiments of this specification also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for searching for file deletion time in NTFS described in any of the above embodiments is implemented.
[0080] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.
[0081] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.
[0082] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.
[0083] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.
[0084] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).
[0085] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).
[0086] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.
[0087] The electronic device of the above embodiment is used to implement the method of searching for file deletion time in NTFS corresponding to any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.
[0088] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. In line with the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present specification as described above, which are not provided in detail for the sake of simplicity.
[0089] One or more embodiments of this specification are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification should be included in the scope of protection of this disclosure.
Claims
1. A method for finding file deletion time in NTFS, characterized in that: include: Find the $Logfile file based on the NTFS volume header information; Parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence numbers of the record items; Divide the sorted record items into multiple transactions, and the application uses transactional NTFS to group a series of changes to the file into one transaction to ensure that all changes are effective and invalidated at the same time, and ensure that external applications cannot be notified of any changes before the transaction is committed; For each transaction, find out whether there is a record item with redo operation as DeallocateFileRecordSegmen in the transaction. If yes, the transaction is a delete transaction, the redo operation value of DeallocateFileRecordSegmen is 3, the 8-byte integer starting from the offset 8 bytes of each record item is the previous sequence number, the 2-byte integer value at the offset 0x30 position of each record item is the redo operation value, the 2 bytes at the offset 0x34 position of the target record item represent the offset of the redo operation content, and the 2 bytes at the 0x36 position represent the length of the redo operation content; For each record item in the deletion transaction, search for the target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop. The redo operation value of UpdateNonResidentValue is 8, and the undo operation value of Noop is 0. The integer value consisting of the 2 bytes at the offset 0x32 position of each record item is the undo operation value. The 2 bytes at the offset 0x38 position of each record item represent the offset of the undo operation content. The 2 bytes at the offset 0x40 position represent the length of the undo operation content. Extract the file name and the corresponding file deletion time from the target record item. In the content area of the redo operation of the target record item, the 8 bytes starting from the offset 0x20 are the value of the deletion time, and the 8 bytes starting from the offset 0x52 are the names of the deleted files or folders. The searching for the $Logfile file according to the NTFS volume header information includes: locating the location of the $MFT file according to the NTFS volume header information; searching for the $Logfile file through the $MFT file; The sequence number is composed of the first 8 bytes of the record item; The step of sorting the record items based on the serial numbers of the record items comprises: sorting the record items in ascending order of the serial numbers; The record item sequence is divided into multiple transactions, wherein the first record item of each transaction is a record item with a previous sequence number of 0, and the last record item is a record item with a redo operation of ForgetTransaction, and the redo operation value of the ForgetTransaction action is 27.
2. A device for searching file deletion time in NTFS, characterized in that: include: The first search unit is used to search for the $Logfile file according to the volume header information of NTFS; A parsing and sorting unit, used for parsing the $Logfile file, obtaining the record items therein, and sorting the record items based on the sequence number of the record item, wherein the sequence number is composed of the first 8 bytes of the record item, and the record items are sorted in ascending order according to the sequence number; A partitioning unit, used to partition the sorted record items into a plurality of transactions, wherein the application uses transactional NTFS to group a series of changes to the file into one transaction, so as to ensure that all changes are effective and invalidated at the same time, and ensure that an external application cannot be informed of any changes before the transaction is committed; The second search unit is used to search for a record item whose redo operation is DeallocateFileRecordSegmen in each transaction. If so, the transaction is a delete transaction. The redo operation value of DeallocateFileRecordSegmen is 3. The integer consisting of 8 bytes starting from the offset 8 bytes of each record item is the previous sequence number. The integer value consisting of 2 bytes at the offset 0x30 position of each record item is the redo operation value. The 2 bytes at the offset 0x34 position of the target record item represent the offset of the redo operation content. The 2 bytes at the offset 0x36 position represent the length of the redo operation content. A third search unit is used to search for a target record item whose redo operation is UpdateNonResidentValue and whose undo operation is Noop for each record item in the deletion transaction, wherein the redo operation value of UpdateNonResidentValue is 8, the undo operation value of Noop is 0, the integer value consisting of 2 bytes at the offset 0x32 position of each record item is the undo operation value, the 2 bytes at the offset 0x38 position of each record item represent the offset of the undo operation content, and the 2 bytes at the offset 0x40 position represent the length of the undo operation content; an extraction unit, configured to extract a file name and a corresponding file deletion time from the target record item, wherein in the content area of the redo operation of the target record item, the 8 bytes starting from the offset 0x20 position are the value of the deletion time, and the 8 bytes starting from the offset 0x52 position are the names of the deleted files or folders; Searching for the $Logfile file according to the NTFS volume header information includes: locating the location of the $MFT file according to the NTFS volume header information; searching for the $Logfile file through the $MFT file; The record item sequence is divided into a plurality of transactions, wherein the first record item of each transaction is a record item with a previous sequence number of 0, and the last record item is a record item with a redo operation of ForgetTransaction, and the redo operation value of ForgetTransaction is 27.
3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to claim 1 is implemented.