A NTFS file formatting parameter analysis method, terminal device and storage medium

Abstract

The present invention relates to an NTFS file formatting parameter analysis method, a terminal device and a storage medium. In the method, a comprehensive hypothesis verification analysis is performed on the formatted MFT record, the cluster size is determined based on the total number of clusters and the physical occupied size in the MFT record, and the partition start sector is determined based on the file multi-level index combined with the hypothesis verification analysis. The present invention can more accurately obtain the formatting parameters required for NTFS data recovery, can provide better technical support for subsequent NTFS data recovery, and improve the recovery accuracy.

Description

Technical Field

[0001] The present invention relates to the field of file technology, and in particular to an NTFS file formatting parameter analysis method, a terminal device and a storage medium. Background Art

[0002] After the NTFS file system is formatted, current data recovery technology mainly relies on the parameters of the formatted partition to perform corresponding data recovery. Since formatting parameters are easily modified and partition space is easily reallocated, current recovery technology cannot guarantee the accuracy of recovery results in some cases. Traditionally, the formatted parameters are used as the NTFS file system formatting recovery parameters. When the formatting parameters are modified, the partition space is reallocated, and the partitions are interleaved, the recovered file data or file index positioning will be wrong, resulting in inaccurate recovery results. Summary of the invention

[0003] In order to solve the above problems, the present invention proposes an NTFS file formatting parameter analysis method, a terminal device and a storage medium.

[0004] The specific plan is as follows:

[0005] A method for analyzing NTFS file formatting parameters comprises the following steps:

[0006] S1: searching for MFT file records in the formatted partition sector by sector, parsing the found MFT file records, and adding the parsing results to the first set;

[0007] S2: searching for index buffer records in the formatted partition sector by sector, parsing the found index buffer records, and adding the parsing results to the second set;

[0008] S3: Initialize and set the sequence number i=1, the partition start sector to 0, the number of elements in the second set to m, and the cluster size to the cluster size of the partition being formatted;

[0009] S4: Determine whether i≥m is true, if so, end; otherwise, enter S5;

[0010] S5: Determine whether there is an element in the first set such that the file MFT number of the element is equal to the file MFT number of the i-th element in the second set. If so, set the element to element j and go to S6; if not, increment i by 1 and return to S4.

[0011] S6: Determine whether the number of linked list elements corresponding to element j in the first set is equal to 1. If so, proceed to S7; otherwise, increment i by 1 and return to S4;

[0012] S7: Search for all elements in the first set whose parent directory MFT number is equal to the parent directory MFT number of the i-th element in the second set. If the search result is not empty, go to S8; if the search result is empty, increment i by 1 and return to S4.

[0013] S8: For any element in the search result, determine whether the file MFT number of the element is the same as the file MFT number of a linked list element in the subdirectory index linked list of the i-th element in the second set. If both are satisfied, go to S9; if there is an element that does not satisfy the condition, increment i by 1 and return to S4;

[0014] S9: Determine whether there is an element in the first set such that the physical size of the element is greater than 512 and the cluster list is not empty. If so, proceed to S10; if not, end.

[0015] S10: updating the value of the cluster size according to the physical size corresponding to the element in the first set determined to exist in step S9 and the sum of the cluster data occupied by all the linked list elements in the cluster linked list;

[0016] S11: Update the value of the partition start sector according to the sector number of the index buffer header corresponding to the i-th element in the second set, the cluster start corresponding to the element j in the first set, and the updated cluster size.

[0017] Furthermore, when searching for the MFT file record in step S1, the method for determining whether the found data block belongs to the MFT file record block is:

[0018] Parse the data block DataBuff according to the structure of the NTFS file record to obtain the MFT identifier MFTMagic, the file record time length FileRecordRealLenth and the file record allocation length FileRecordAllocLenth; when the following three conditions are met at the same time, it is determined that the data block DataBuff belongs to the MFT file record block;

[0019] Condition 1: DataBuff

[30] is equal to DataBuff

[1022] , and DataBuff

[31] is equal to DataBuff

[1023] ; where DataBuff[i] represents the i-th byte in the data block DataBuff, and i is an integer between 1 and 1024;

[0020] Condition 2: The MFT flag MFTMagic is FILE;

[0021] Condition three: The file record time length FileRecordRealLenth is less than or equal to the file record allocation length FileRecordAllocLenth, and the file record allocation length FileRecordAllocLenth is equal to 1024.

[0022] Furthermore, when searching for the index buffer record in step S2, the method for determining whether the found data block belongs to the index buffer record is:

[0023] Parse the data block to obtain the index identifier IndexMagic, the index item size IndexLenth, the index allocation size IndexAllocLenth, and the index fill value IndexAlign. Only when the following two conditions are met at the same time, the data block is judged to belong to the index buffer record:

[0024] Condition 1: The index flag IndexMagic is equal to INDX, and the index fill value IndexAlign is equal to 0;

[0025] Condition 2: The index item size IndexLenth is less than or equal to the index allocation size IndexAllocLenth, and the sum of the index allocation size IndexAllocLenth and 24 is a multiple of 512.

[0026] Furthermore, the update formula of the cluster size in step S10 is: the cluster size is the ratio of the physical size corresponding to the elements in the first set to the sum of the cluster data occupied by all the linked list elements in the cluster linked list.

[0027] Furthermore, the update formula of the partition start sector PartitionStartSector in step S11 is:

[0028] PartitionStartSector=IndexHeaderSector Ii -CluserSectorNumber*CStart CListFj0

[0029] Among them, IndexHeaderSector Ii Indicates the sector number where the index buffer header corresponding to the i-th element in the second set I is located, CluserSectorNumber indicates the updated cluster size, CStart CListFj0 Indicates the start of the cluster corresponding to element j in the first set.

[0030] An NTFS file formatting parameter analysis terminal device comprises a processor, a memory and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method described above in the embodiment of the present invention are implemented.

[0031] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above in an embodiment of the present invention are implemented.

[0032] The present invention adopts the above technical solution, performs comprehensive hypothesis verification analysis on the formatted MFT record, determines the cluster size based on the total number of clusters and the physical occupied size in the MFT record, and determines the partition start sector based on the file multi-level index combined with hypothesis verification analysis. The method of this embodiment can more accurately obtain the formatting parameters required for NTFS data recovery, which can provide key technical support for subsequent NTFS data recovery and improve recovery accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Shown is a flow chart of Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0034] To further illustrate various embodiments, the present invention provides drawings. These drawings are part of the disclosure of the present invention, which are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in this field should be able to understand other possible implementations and advantages of the present invention.

[0035] The present invention will now be further described with reference to the accompanying drawings and specific implementation methods.

[0036] Embodiment 1:

[0037] The embodiment of the present invention provides a method for analyzing NTFS file formatting parameters. Figure 1 As shown, the method comprises the following steps:

[0038] S1: Searching for MFT file records in the formatted partition sector by sector, parsing the found MFT file records, and adding the parsing results to the first set F.

[0039] When searching for an MFT file record in this embodiment, the method for determining whether the found data block belongs to an MFT file record block is as follows:

[0040] Parse the data block DataBuff according to the structure of the NTFS file record to obtain the MFT identifier MFTMagic, the file record time length FileRecordRealLenth and the file record allocation length FileRecordAllocLenth; when the following three conditions are met at the same time, it is determined that the data block DataBuff belongs to the MFT file record block;

[0041] Condition 1: DataBuff

[30] is equal to DataBuff

[1022] , and DataBuff

[31] is equal to DataBuff

[1023] ; where DataBuff[i] represents the i-th byte in the data block DataBuff, and i is an integer between 1 and 1024;

[0042] Condition 2: The MFT flag MFTMagic is FILE;

[0043] Condition three: The file record time length FileRecordRealLenth is less than or equal to the file record allocation length FileRecordAllocLenth, and the file record allocation length FileRecordAllocLenth is equal to 1024.

[0044] The first set F is used to store metadata information of files or folders. Each element in the set includes: file name FileName, cluster list CList (each element in the list includes: cluster start CStart and cluster number CNumber), physical size PFileSize, file MFT number FileMFTNumber, parent directory MFT number ParentMFTNumber. If the data in CList is a file, it comes from the parsing result of the 0x80 attribute, and the data in the folder comes from the parsing result of the 0xA0 attribute.

[0045] S2: Searching for index buffer records in the formatted partition sector by sector, parsing the found index buffer records, and adding the parsing results to the second set I.

[0046] In this embodiment, when searching for index buffer records, the method for determining whether the found data block belongs to the index buffer record is:

[0047] Parse the data block to obtain the index identifier IndexMagic, the index item size IndexLenth, the index allocation size IndexAllocLenth, and the index fill value IndexAlign. Only when the following two conditions are met at the same time, the data block is judged to belong to the index buffer record:

[0048] Condition 1: The index flag IndexMagic is equal to INDX, and the index fill value IndexAlign is equal to 0;

[0049] Condition 2: The index item size IndexLenth is less than or equal to the index allocation size IndexAllocLenth, and the sum of the index allocation size IndexAllocLenth and 24 is a multiple of 512.

[0050] The second set I is used to store the NTFS file index buffer index information. Each element in the set includes: the file's parent directory MFT number ParentMFTNumber, the sector number IndexHeaderSector where the index buffer header is located, and the subdirectory index linked list ChildIndexList (each element in the linked list includes: file name FileName, file MFT number FileMFTNumber).

[0051] It should be noted that the sector number IndexHeaderSector where the index buffer header is located is equal to the position of the searched sector.

[0052] S3: Initialize and set the sequence number i=1, the partition start sector PartitionStartSector to 0, the number of elements in the second set I to m, and the cluster size CluserSectorNumber to be the cluster size of the partition being formatted.

[0053] The cluster size of the formatted partition is obtained by parsing the DBR of the partition.

[0054] S4: Determine whether i≥m is true. If so, end; otherwise, enter S5.

[0055] S5: Determine whether there is an element in the first set F such that the file MFT number of the element is equal to the file MFT number of the i-th element in the second set I. If so, set the element to element j and go to S6; if not, increment i by 1 and return to S4.

[0056] S6: Determine whether the number of linked list elements corresponding to the element j in the first set F is equal to 1. If so, proceed to S7; otherwise, increment i by 1 and return to S4.

[0057] S7: Search in the first set F for all elements whose parent directory MFT number is equal to the parent directory MFT number of the i-th element in the second set I. If the search result is not empty, go to S8; if the search result is empty, increment i by 1 and return to S4.

[0058] S8: For any element in the search result, determine whether the file MFT number of the element is the same as the file MFT number of a linked list element in the subdirectory index linked list of the i-th element in the second set I. If both are satisfied, go to S9; if there is an element that does not satisfy the condition, let i be incremented by 1 and return to S4.

[0059] S9: Determine whether there is an element in the first set F such that the physical size of the element is greater than 512 and the cluster linked list is not empty. If so, proceed to S10; if not, end.

[0060] S10: Update the value of the cluster size CluserSectorNumber according to the physical size corresponding to the elements in the first set F determined to exist in step S9 and the sum of the cluster data occupied by all the linked list elements in the cluster linked list.

[0061] Specifically in this embodiment: the cluster size is the ratio of the physical size corresponding to the elements in the first set F to the sum of the cluster data occupied by all the linked list elements in the cluster linked list.

[0062] S11: According to the sector number IndexHeaderSector where the index buffer header corresponding to the i-th element in the second set I is located Ii , the cluster start CStart corresponding to element j in the first set F CListFj0 And the updated cluster size CluserSectorNumber, update the value of the partition start sector PartitionStartSector.

[0063] Specifically in this embodiment:

[0064] PartitionStartSector=IndexHeaderSector Ii -CluserSectorNumber*CStart CListFj0

[0065] The embodiment of the present invention performs comprehensive hypothesis verification analysis on the formatted MFT record, determines the cluster size based on the total number of clusters and the physical occupied size in the MFT record, and determines the partition start sector based on the file multi-level index combined with hypothesis verification analysis. The method of this embodiment can more accurately obtain the formatting parameters required for NTFS data recovery, provide key technical support for subsequent NTFS data recovery, and improve recovery accuracy.

[0066] Embodiment 2:

[0067] The present invention also provides an NTFS file formatting parameter analysis terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the above-mentioned method embodiment of the first embodiment of the present invention when executing the computer program.

[0068] Further, as an executable solution, the NTFS file formatting parameter analysis terminal device can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The NTFS file formatting parameter analysis terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the composition structure of the above-mentioned NTFS file formatting parameter analysis terminal device is only an example of the NTFS file formatting parameter analysis terminal device, and does not constitute a limitation on the NTFS file formatting parameter analysis terminal device, and may include more or less components than the above-mentioned, or combine certain components, or different components. For example, the NTFS file formatting parameter analysis terminal device may also include input and output devices, network access devices, buses, etc., and the embodiments of the present invention do not limit this.

[0069] Further, as an executable solution, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the NTFS file formatting parameter analysis terminal device, and uses various interfaces and lines to connect various parts of the entire NTFS file formatting parameter analysis terminal device.

[0070] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the NTFS file formatting parameter analysis terminal device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required for a function; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0071] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method in the embodiment of the present invention are implemented.

[0072] If the module / unit integrated in the NTFS file formatting parameter analysis terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory) and software distribution medium, etc.

[0073] Although the present invention has been specifically shown and described in conjunction with the preferred embodiments, it should be understood by those skilled in the art that various changes may be made to the present invention in form and details without departing from the spirit and scope of the present invention as defined by the appended claims, all of which are within the scope of protection of the present invention.

Claims

1. A method for analyzing NTFS file formatting parameters, characterized in that: The following steps are involved: S1: searching for MFT file records in the formatted partition sector by sector, parsing the found MFT file records, and adding the parsing results to the first set; S2: searching for index buffer records in the formatted partition sector by sector, parsing the found index buffer records, and adding the parsing results to the second set; S3: Initialize and set the sequence number i=1, the partition start sector to 0, the number of elements in the second set to m, and the cluster size to the cluster size of the partition being formatted; S4: Determine whether i≥m is true, if so, end; otherwise, enter S5; S5: Determine whether there is an element in the first set such that the file MFT number of the element is equal to the file MFT number of the i-th element in the second set. If so, set the element to element j and go to S6; if not, increment i by 1 and return to S4. S6: Determine whether the number of linked list elements corresponding to element j in the first set is equal to 1. If so, proceed to S7; Otherwise, increment i by 1 and return to S4; S7: Search in the first set for all elements whose parent directory MFT number is equal to the parent directory MFT number of the i-th element in the second set. If the search result is not empty, go to S8; If the search result is empty, increment i by 1 and return to S4; S8: for any element in the search result, determine whether the file MFT number of the element is the same as the file MFT number of a linked list element in the subdirectory index linked list of the i-th element in the second set. If both are satisfied, proceed to S9; If there are elements that do not satisfy the condition, increment i by 1 and return to S4; S9: Determine whether there is an element in the first set, such that the physical size of the element is greater than 512 and the cluster list is not empty. If so, proceed to S10; if not, end. S10: updating the value of the cluster size according to the physical size corresponding to the element in the first set determined to exist in step S9 and the sum of the cluster data occupied by all the linked list elements in the cluster linked list; the cluster size update formula is: the cluster size is the ratio of the physical size corresponding to the element in the first set to the sum of the cluster data occupied by all the linked list elements in the cluster linked list; S11: Update the value of the partition start sector according to the sector number of the index buffer header corresponding to the i-th element in the second set, the cluster start corresponding to the element j in the first set, and the updated cluster size.

2. The NTFS file formatting parameter analysis method according to claim 1, characterized in that: When searching for the MFT file record in step S1, the method for determining whether the found data block belongs to the MFT file record block is: Parse the data block DataBuff according to the structure of the NTFS file record to obtain the MFT identifier MFTMagic, the file record time length FileRecordRealLenth and the file record allocation length FileRecordAllocLenth; when the following three conditions are met at the same time, it is determined that the data block DataBuff belongs to the MFT file record block; Condition 1: DataBuff[30] is equal to DataBuff[1022], and DataBuff[31] is equal to DataBuff[1023]; where DataBuff[i] represents the i-th byte in the data block DataBuff, and i is an integer between 1 and 1024; Condition 2: The MFT flag MFTMagic is FILE; Condition three: The file record time length FileRecordRealLenth is less than or equal to the file record allocation length FileRecordAllocLenth, and the file record allocation length FileRecordAllocLenth is equal to 1024.

3. The NTFS file formatting parameter analysis method according to claim 1, characterized in that: When searching for the index buffer record in step S2, the method for determining whether the found data block belongs to the index buffer record is: Parse the data block to obtain the index identifier IndexMagic, the index item size IndexLenth, the index allocation size IndexAllocLenth, and the index fill value IndexAlign. Only when the following two conditions are met at the same time, the data block is judged to belong to the index buffer record: Condition 1: The index flag IndexMagic is equal to INDX, and the index fill value IndexAlign is equal to 0; Condition 2: The index item size IndexLenth is less than or equal to the index allocation size IndexAllocLenth, and the sum of the index allocation size IndexAllocLenth and 24 is a multiple of 512.

4. The NTFS file formatting parameter analysis method according to claim 1, characterized in that: The update formula of the partition start sector PartitionStartSector in step S11 is: PartitionStartSector=IndexHeaderSector Ii -CluserSectorNumber*CStart CListFj0 Among them, IndexHeaderSector Ii Indicates the sector number where the index buffer header corresponding to the i-th element in the second set I is located, CluserSectorNumber indicates the updated cluster size, CStart CListFj0 Indicates the start of the cluster corresponding to element j in the first set.

5. A terminal device for analyzing NTFS file formatting parameters, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 4 when executing the computer program.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images