Method, device and electronic device for recovering deleted data in NTFS

Abstract

One or more embodiments of the present specification provide a method, device, and electronic device for recovering deleted data in NTFS. The method searches for $MFT file information in the file system, searches for all base records in the $MFT file information by traversing, obtains associated records associated with the base record according to the attribute value of the base record, obtains the file name, file size, and storage information of the deleted file based on the base record and the associated records associated with the base record, and outputs the deleted file information, thereby ensuring the integrity of the deleted file.

Description

Technical Field

[0001] One or more embodiments of the present disclosure relate to the technical field of file recovery in NTFS, and more particularly to a method, device, and electronic device for recovering deleted data in NTFS. Background Art

[0002] When user data is deleted, the $MFT in the NTFS file system may still contain file records, and the deleted data can be retrieved through this information.

[0003] The inventors discovered that a file might be too large or have been edited frequently, resulting in fragmented file information. This can lead to it being stored in multiple file records, rather than a single file record. Existing solutions, when a file's information is distributed across multiple MFT file records, retrieve and export information from each file record individually. This can result in incomplete information, such as missing file names, incorrect file sizes, and incomplete information. Summary of the Invention

[0004] In view of this, the purpose of one or more embodiments of this specification is to provide a method, device and electronic device for recovering deleted data in NTFS, which can solve the technical problems existing in the prior art.

[0005] Based on the above objectives, one or more embodiments of this specification provide a method for recovering deleted data in NTFS, including:

[0006] Find $MFT file information based on NTFS volume header information;

[0007] Traverse each file record in the $MFT file information in turn to obtain all base records;

[0008] For each base record, based on the attribute value of the base record, obtain the associated record associated with the base record;

[0009] Based on the base record and the associated records associated with the base record, the file name, file size and storage information of the deleted file are obtained, and the deleted file information is output.

[0010] As an optional implementation, searching for $MFT file information based on NTFS volume header information includes:

[0011] In the source NTFS partition, locate the starting cluster number and cluster size of the $MFT file based on the NTFS volume header information;

[0012] Calculate the starting storage location of the $MFT file based on the starting cluster number and cluster size of the $MFT file;

[0013] Based on the starting storage location of the $MFT file, the $MFT file information is obtained.

[0014] As an optional implementation, traversing each file record in the $MFT file information in sequence to obtain all base records includes:

[0015] For each file record, if the value represented by the 4 bytes at offset 0x20 in the file record is 0, the file record is a base record.

[0016] As an optional implementation manner, for each base record, obtaining associated records associated with the base record based on the attribute value of the base record includes:

[0017] For each base record, find all attribute values ​​of the base record;

[0018] Find the target attribute value based on the attribute type of the attribute value;

[0019] Based on the record of the target attribute value, an associated record associated with the base record is obtained.

[0020] As an optional implementation manner, searching for a target attribute value based on an attribute type of an attribute value includes:

[0021] For each attribute value, obtain the attribute type of the attribute value. The first 4 bytes of each attribute value are the attribute type.

[0022] If the attribute type of the attribute value is 0x20, the attribute value is the target attribute value.

[0023] As an optional implementation manner, obtaining the associated record associated with the base record based on the record of the attribute value includes:

[0024] Based on the record of the attribute value, obtain the number and storage information of the associated record;

[0025] Based on the number and storage information of the associated record, the associated record associated with the base record is obtained.

[0026] As an optional implementation, obtaining the file name, file size, and storage information of the deleted file based on the base record and the associated records associated with the base record, and outputting the deleted file information includes:

[0027] For each base record, obtain the file size, storage time, and file storage information of the base record and the associated records associated with the base record;

[0028] Based on the file storage information, obtain the file name of the deleted file;

[0029] Obtaining the largest file size among all file sizes in the base record and associated records associated with the base record as the file size of the deleted file;

[0030] Obtain file storage information of the base record and associated records associated with the base record, remove duplicates from the file storage information, and merge them to obtain storage information of the deleted file;

[0031] Output the file information of the deleted file, wherein the file information includes the storage time, file name, file size and storage information of the deleted file.

[0032] As a second aspect of the present invention, a device for recovering deleted data in NTFS is provided, comprising:

[0033] A search unit is used to search for $MFT file information based on the NTFS volume header information;

[0034] A traversal unit, configured to sequentially traverse each file record in the $MFT file information to obtain all base records;

[0035] an acquiring unit, configured to acquire, for each base record, associated records associated with the base record based on an attribute value of the base record;

[0036] The output unit is used to obtain the file name, file size and storage information of the deleted file based on the base record and the associated record associated with the base record, and output the deleted file information.

[0037] As an optional implementation, the searching unit includes:

[0038] The positioning module is used to locate the starting cluster number and cluster size of the $MFT file in the source NTFS partition according to the NTFS volume header information;

[0039] a calculation module, configured to calculate a starting storage location of the $MFT file based on a starting cluster number and a cluster size of the $MFT file;

[0040] The acquisition module is used to acquire the $MFT file information based on the starting storage position of the $MFT file.

[0041] As a third aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the program.

[0042] As can be seen from the above description, one or more embodiments of this specification provide a method, device, and electronic device for recovering deleted data in NTFS. The method searches for $MFT file information in the file system, searches for all base records in the $MFT file information by traversing, and then obtains associated records associated with the base record according to the attribute value of the base record. Based on the base record and the associated records associated with the base record, the file name, file size, and storage information of the deleted file are obtained, and the deleted file information is output, thereby ensuring the integrity of the deleted file. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only one or more embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A logical diagram of a method for recovering deleted data in NTFS according to one or more embodiments of this specification;

[0045] Figure 2 A logical diagram of a device for recovering deleted data in NTFS according to one or more embodiments of this specification;

[0046] Figure 3 A schematic diagram of an electronic device according to one or more embodiments of the present disclosure. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0048] To achieve the above object, the present invention provides a method for recovering deleted data in NTFS, comprising:

[0049] Find $MFT file information based on NTFS volume header information;

[0050] Traverse each file record in the $MFT file information in turn to obtain all base records;

[0051] For each base record, based on the attribute value of the base record, obtain the associated record associated with the base record;

[0052] Based on the base record and the associated records associated with the base record, the file name, file size and storage information of the deleted file are obtained, and the deleted file information is output.

[0053] In an embodiment of the present invention, by searching the $MFT file information in the file system, all base records in the $MFT file information are searched through a traversal method, and then the associated records associated with the base record are obtained according to the attribute value of the base record. Based on the base record and the associated records associated with the base record, the file name, file size and storage information of the deleted file are obtained, and the deleted file information is output, thereby ensuring the integrity of the deleted file.

[0054] like Figure 1 As shown, the present invention provides a method for recovering deleted data in NTFS, comprising:

[0055] S100. Search $MFT file information based on NTFS volume header information.

[0056] Optionally, the S100 includes:

[0057] S110. In the source NTFS partition, locate the starting cluster number and cluster size of the $MFT file according to the NTFS volume header information;

[0058] S120. Calculate the starting storage location of the $MFT file based on the starting cluster number and cluster size of the $MFT file;

[0059] S130. Based on the starting storage location of the $MFT file, obtain the $MFT file information.

[0060] S200: Traverse each file record in the $MFT file information in sequence to obtain all base records.

[0061] In each file record, the integer represented by the 4 bytes at offset 0x20 is the number of the base record. If the value is 0, the file record is a base record, otherwise it is an extended record.

[0062] S300: For each base record, based on the attribute value of the base record, obtain the associated record associated with the base record;

[0063] Optionally, the S300 includes:

[0064] S310: For each base record, search for all attribute values ​​of the base record;

[0065] S320, searching for a target attribute value based on the attribute type of the attribute value;

[0066] Optionally, for each attribute value, obtain the attribute type of the attribute value. The 4 bytes of the header of each attribute value are the attribute type. If the attribute type of the attribute value is 0x20, the attribute value is the target attribute value; otherwise, the attribute value is not the target attribute value.

[0067] In each file record, offset 0x38 starts with multiple attribute values. The first 4 bytes of each attribute value are the attribute type. When the attribute type is 0x20, the attribute value is the target attribute value. The information stored in the attribute value is the associated record associated with the file record.

[0068] S330: Based on the record of the target attribute value, obtain the associated record associated with the base record.

[0069] Optionally, if the attribute value is a target attribute value, the number and storage information of the associated record are obtained based on the record of the attribute value; and the associated record associated with the base record is obtained based on the number and storage information of the associated record.

[0070] S400: Based on the base record and the associated records associated with the base record, obtain the file name, file size and storage information of the deleted file, and output the deleted file information.

[0071] Optionally, the S400 includes:

[0072] S410: For each base record, obtain the file size, storage time, and file storage information of the base record and associated records associated with the base record;

[0073] S420: Obtain the file name of the deleted file based on the file storage information;

[0074] S430: Obtain the largest file size among all file sizes in the base record and associated records associated with the base record, as the file size of the deleted file;

[0075] S440: Obtain file storage information of the base record and associated records associated with the base record, remove duplicates from the file storage information, and merge them to obtain storage information of the deleted file.

[0076] S450: Output file information of the deleted file, where the file information includes storage time, file name, file size, and storage information of the deleted file.

[0077] It should be noted that the methods of one or more embodiments of this specification can be performed by a single device, such as a computer or server. The methods of this embodiment can also be applied in a distributed scenario, where multiple devices cooperate to perform the method. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the methods of one or more embodiments of this specification, and the multiple devices will interact with each other to complete the method.

[0078] It should be noted that the foregoing description of this specification is based on specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0079] Corresponding to the method for recovering deleted data in NTFS, the present invention also provides a device for recovering deleted data in NTFS, such as Figure 2 As shown, including:

[0080] A search unit 10 is used to search for $MFT file information based on NTFS volume header information;

[0081] A traversal unit 20 is used to traverse each file record in the $MFT file information in sequence to obtain all base records;

[0082] An acquiring unit 30 is configured to acquire, for each base record, associated records associated with the base record based on an attribute value of the base record;

[0083] The output unit 40 is configured to obtain the file name, file size, and storage information of the deleted file based on the base record and the associated records associated with the base record, and output the deleted file information.

[0084] In an embodiment of the present invention, by searching the $MFT file information in the file system, all base records in the $MFT file information are searched through a traversal method, and then the associated records associated with the base record are obtained according to the attribute value of the base record. Based on the base record and the associated records associated with the base record, the file name, file size and storage information of the deleted file are obtained, and the deleted file information is output, thereby ensuring the integrity of the deleted file.

[0085] Optionally, the search unit 10 includes:

[0086] The positioning module 11 is used to locate the starting cluster number and cluster size of the $MFT file in the source NTFS partition according to the NTFS volume header information;

[0087] A calculation module 12, configured to calculate a starting storage location of the $MFT file based on a starting cluster number and a cluster size of the $MFT file;

[0088] The acquisition module 13 is configured to acquire the $MFT file information based on the starting storage location of the $MFT file.

[0089] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of this specification should have the usual meanings understood by persons with ordinary skills in the field to which this disclosure belongs. The words "first," "second," and similar terms used in one or more embodiments of this specification do not indicate any order, quantity, or importance, but are simply used to distinguish different components. Words such as "include" or "comprising" mean that the element or object preceding the word includes the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0090] For the convenience of description, the above devices are described as being functionally divided into various modules. Of course, when implementing one or more embodiments of this specification, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0091] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, one or more embodiments of this specification also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for recovering deleted data in NTFS described in any of the above-mentioned embodiments is implemented.

[0092] Figure 3 10 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0093] The electronic device of the above embodiment is used to implement the corresponding method for recovering deleted data in NTFS in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0094] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present specification as described above, which are not provided in detail for the sake of simplicity.

Claims

1. A method for recovering deleted data in NTFS, characterized in that: include: Find $MFT file information based on NTFS volume header information; Traverse each file record in the $MFT file information in turn to obtain all base records; For each base record, based on the attribute value of the base record, obtain the associated record associated with the base record; Based on the base record and the associated records associated with the base record, obtaining the file name, file size and storage information of the deleted file, and outputting the deleted file information; The step of acquiring, for each base record, associated records associated with the base record based on the attribute value of the base record includes: For each base record, find all attribute values ​​of the base record; Find the target attribute value based on the attribute type of the attribute value; Based on the record of the target attribute value, obtaining the associated record associated with the base record; Wherein, obtaining the associated record associated with the base record based on the record of the attribute value includes: Based on the record of the attribute value, obtain the number and storage information of the associated record; Based on the number and storage information of the associated record, obtaining the associated record associated with the base record; The step of obtaining the file name, file size, and storage information of the deleted file based on the base record and the associated record associated with the base record, and outputting the deleted file information includes: For each base record, obtain the file size, storage time, and file storage information of the base record and the associated records associated with the base record; Based on the file storage information, obtain the file name of the deleted file; Obtaining the largest file size among all file sizes in the base record and associated records associated with the base record as the file size of the deleted file; Obtain file storage information of the base record and associated records associated with the base record, remove duplicates from the file storage information, and merge them to obtain storage information of the deleted file; Outputting file information of the deleted file, the file information including storage time, file name, file size and storage information of the deleted file; The step of searching for the $MFT file information based on the NTFS volume header information includes: In the source NTFS partition, locate the starting cluster number and cluster size of the $MFT file based on the NTFS volume header information; Calculate the starting storage location of the $MFT file based on the starting cluster number and cluster size of the $MFT file; Based on the starting storage location of the $MFT file, the $MFT file information is obtained.

2. The method for recovering deleted data in NTFS according to claim 1, characterized in that: The step of sequentially traversing each file record in the $MFT file information to obtain all base records includes: For each file record, if the value represented by the 4 bytes at offset 0x20 in the file record is 0, the file record is a base record.

3. The method for recovering deleted data in NTFS according to claim 1, characterized in that: The method of searching for a target attribute value based on the attribute type of the attribute value includes: For each attribute value, obtain the attribute type of the attribute value. The 4 bytes at the head of each attribute value are the attribute type. If the attribute type of the attribute value is 0x20, the attribute value is the target attribute value.

4. A device for recovering deleted data in NTFS, characterized in that: include: A search unit is used to search for $MFT file information based on the NTFS volume header information; A traversal unit, configured to sequentially traverse each file record in the $MFT file information to obtain all base records; an acquiring unit, configured to acquire, for each base record, associated records associated with the base record based on an attribute value of the base record; an output unit, configured to obtain the file name, file size, and storage information of the deleted file based on the base record and the associated records associated with the base record, and output the deleted file information; The acquisition unit is specifically configured to: For each base record, find all attribute values ​​of the base record; Find the target attribute value based on the attribute type of the attribute value; Based on the record of the target attribute value, obtaining the associated record associated with the base record; The acquisition unit is further specifically configured to: Based on the record of the attribute value, obtain the number and storage information of the associated record; Based on the number and storage information of the associated record, obtaining the associated record associated with the base record; The output unit is specifically used for: For each base record, obtain the file size, storage time, and file storage information of the base record and the associated records associated with the base record; Based on the file storage information, obtain the file name of the deleted file; Obtaining the largest file size among all file sizes in the base record and associated records associated with the base record as the file size of the deleted file; Obtain file storage information of the base record and associated records associated with the base record, remove duplicates from the file storage information, and merge them to obtain storage information of the deleted file; Outputting file information of the deleted file, the file information including storage time, file name, file size and storage information of the deleted file; Wherein, the search unit includes: The positioning module is used to locate the starting cluster number and cluster size of the $MFT file in the source NTFS partition according to the NTFS volume header information; a calculation module, configured to calculate a starting storage location of the $MFT file based on a starting cluster number and a cluster size of the $MFT file; The acquisition module is used to acquire the $MFT file information based on the starting storage position of the $MFT file.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 3 is implemented.

Images