A method, apparatus, and electronic device for data recovery of NTFS partitions.

Abstract

This specification provides one or more embodiments of a data recovery method, apparatus, and electronic device for NTFS partitions. The method involves locating a target sector containing file record information, obtaining the starting cluster number and cluster chain information through parsing, and performing a cluster size guessing operation when it is determined that the target sector's location information is not stored in the $MFT file's storage information. This guessing operation yields the cluster size of the file record information before formatting. Finally, based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated, thereby locating and recovering lost data and effectively improving the accuracy of file recovery.

Description

Technical Field

[0001] This specification relates to the field of data recovery technology, and in particular to a data recovery method, apparatus and electronic device for NTFS partitions. Background Technology

[0002] In NTFS partitions, cluster size can have various values ​​(from 512 bytes to 2048KB). During formatting, the cluster size can be selected, and only the current cluster size is recorded in the partition. When the cluster size changes, the way storage information is calculated changes. If file storage information is calculated based on the current cluster size during data recovery, errors will occur, making deleted files unrecoverable. Summary of the Invention

[0003] In view of the above, the purpose of one or more embodiments of this specification is to provide a data recovery method, apparatus and electronic device for NTFS partitions, which can effectively solve the technical problems in the background art.

[0004] To achieve the above objectives, one or more embodiments of this specification provide a data recovery method for NTFS partitions, including:

[0005] Obtain the starting position of the $MFT file based on the NTFS volume header information;

[0006] Based on the starting position of the $MFT file, obtain the storage information of the $MFT file;

[0007] Traverse the entire NTFS partition sector by sector to find the target sector containing file record information;

[0008] The file record information in the target sector is parsed according to the characteristics of the file records to obtain the starting cluster number and cluster chain information;

[0009] If the sector location information of the target sector is not stored in the storage information of the $MFT file, then a cluster size guessing operation is performed on the file record information in the target sector to obtain the cluster size of the file record information before formatting;

[0010] Based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated;

[0011] Based on the file storage information prior to formatting, the lost data is located and recovered.

[0012] As an optional implementation, if the sector location information of the target sector is not stored in the storage information of the $MFT file, then a cluster size guessing operation is performed on the file record information in the target sector to obtain the cluster size of the file record information before formatting, including:

[0013] If the number of clusters of file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the possible storage location is calculated based on the possible cluster size. Based on the storage location, the file content is read. If the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting.

[0014] If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records.

[0015] As an optional implementation, obtaining the storage information of the $MFT file based on its starting position includes:

[0016] Based on the starting position of the $MFT file, obtain the first file record of the $MFT file;

[0017] The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

[0018] As an optional implementation, the step of traversing the entire NTFS partition sector by sector to find the target sector containing file record information includes:

[0019] Traverse the entire NTFS partition sector by sector, and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 respectively. This sector is the target sector that contains file record information.

[0020] As a second aspect of the present invention, a data recovery device for an NTFS partition is provided, comprising:

[0021] The first acquisition unit is used to obtain the starting position of the $MFT file based on the NTFS volume header information;

[0022] The second acquisition unit is used to acquire the storage information of the $MFT file based on the starting position of the $MFT file;

[0023] The search unit is used to traverse the entire NTFS partition sector by sector to find the target sector containing file record information.

[0024] The parsing unit is used to parse the file record information in the target sector according to the characteristics of the file record to obtain the starting cluster number and cluster chain information;

[0025] The guessing unit is used to perform a cluster size guessing operation on the file record information in the target sector if the sector location information of the target sector is not stored in the storage information of the $MFT file, so as to obtain the cluster size of the file record information before formatting;

[0026] The calculation unit is used to calculate the file storage information before formatting based on the cluster size, starting cluster number, and cluster chain information.

[0027] The recovery unit is used to locate and recover lost data based on the file storage information prior to the formatting.

[0028] As an optional implementation, the guessing unit is used for:

[0029] If the number of clusters of file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the possible storage location is calculated based on the possible cluster size. Based on the storage location, the file content is read. If the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting.

[0030] If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records.

[0031] As an optional implementation, the second acquisition unit is used for:

[0032] Based on the starting position of the $MFT file, obtain the first file record of the $MFT file;

[0033] The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

[0034] As an optional implementation, the search unit is used for:

[0035] Traverse the entire NTFS partition sector by sector, and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 respectively. This sector is the target sector that contains file record information.

[0036] As a third aspect of the invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0037] As can be seen from the above, the data recovery method, apparatus, and electronic device for NTFS partitions provided by one or more embodiments of this specification locates the target sector containing file record information, obtains the starting cluster number and cluster chain information through parsing, and when it is determined that the sector location information of the target sector is not stored in the storage information of the $MFT file, a cluster size guessing operation is performed to obtain the cluster size of the file record information before formatting by guessing the cluster size. Finally, based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated, thereby finding and recovering lost data and effectively improving the accuracy of file recovery. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in one or more embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only one or more embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a logical diagram illustrating one or more embodiments of the data recovery method for NTFS partitions in this specification.

[0040] Figure 2 This is a logical diagram of a data recovery device for an NTFS partition according to one or more embodiments of this specification;

[0041] Figure 3 This is a schematic diagram of an electronic device according to one or more embodiments of this specification. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0043] To achieve the above-mentioned objective, this invention provides a data recovery method for NTFS partitions, comprising:

[0044] Obtain the starting position of the $MFT file based on the NTFS volume header information;

[0045] Based on the starting position of the $MFT file, obtain the storage information of the $MFT file;

[0046] Traverse the entire NTFS partition sector by sector to find the target sector containing file record information;

[0047] The file record information in the target sector is parsed according to the characteristics of the file records to obtain the starting cluster number and cluster chain information;

[0048] If the sector location information of the target sector is not stored in the storage information of the $MFT file, then a cluster size guessing operation is performed on the file record information in the target sector to obtain the cluster size of the file record information before formatting;

[0049] Based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated;

[0050] Based on the file storage information prior to formatting, the lost data is located and recovered.

[0051] In this embodiment of the invention, the target sector containing file record information is located, and the starting cluster number and cluster chain information are obtained through parsing. If it is determined that the sector location information of the target sector is not stored in the storage information of the $MFT file, a cluster size guessing operation is performed. The cluster size of the file record information before formatting is obtained by guessing the cluster size. Finally, based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated, thereby finding and recovering lost data and effectively improving the accuracy of file recovery.

[0052] Optional, such as Figure 1 As shown, one or more embodiments of this specification provide a data recovery method for NTFS partitions, including:

[0053] S100. Obtain the starting position of the $MFT file based on the NTFS volume header information.

[0054] S200. Based on the starting position of the $MFT file, obtain the storage information of the $MFT file.

[0055] Optionally, S200 includes:

[0056] Based on the starting position of the $MFT file, obtain the first file record of the $MFT file;

[0057] The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

[0058] S300: Traverse the entire NTFS partition sector by sector to find the target sector containing file record information.

[0059] Optionally, the step of traversing the entire NTFS partition sector by sector to find the target sector containing file record information includes:

[0060] Traverse the entire NTFS partition in units of sectors (512 bytes) and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 (i.e., the file record header marker "FILE0"). This sector is the target sector that contains the file record information.

[0061] S400. Parse the file record information in the target sector according to the characteristics of the file record to obtain the starting cluster number and cluster chain information.

[0062] Optionally, the file size can be obtained from the 0x30H attribute of the file record information in the target sector, and the starting cluster number and cluster chain information can be obtained from the 0x80H attribute.

[0063] S500. If the sector location information of the target sector is not stored in the storage information of the $MFT file, then perform a cluster size guessing operation on the file record information in the target sector to obtain the cluster size of the file record information before formatting.

[0064] If the sector location information of the target sector's file record information is A, and the actual storage area of ​​the sector stored in the $MFT file is S (starting position, storage block size, etc.), determine whether A is in area S. If it is, the file record belongs to the content in $MFT, indicating that the cluster size of the NTFS partition did not change before and after formatting, and the lost data can be directly searched and recovered; if it is not, it means that the file record information is a remnant from before formatting, and a cluster size guessing operation needs to be performed to obtain the cluster size of the file record information before formatting.

[0065] Optional, the S500 includes:

[0066] If the number of clusters of file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the possible storage location is calculated based on the possible cluster size. Based on the storage location, the file content is read. If the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting.

[0067] Windows systems offer several selectable cluster sizes, including 512 bytes, 1KB, 2KB, 4KB, 8KB, 16KB, 32KB, 64KB, 128KB, 256KB, 512KB, 1MB, and 2MB. From these values, a cluster size that satisfies the condition "file size ≤ cluster size" is selected. The corresponding file storage location is then calculated. The file content is read. If the file content exhibits characteristics specific to a particular file type (e.g., some JPG headers have fixed header flags), then the cluster size corresponding to that storage location is the cluster size of the file record information before formatting; that is, the correct cluster size has been found.

[0068] If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records.

[0069] Since the number of clusters and the file size are both known, the correct cluster size can be calculated.

[0070] S600. Based on the cluster size, starting cluster number, and cluster chain information, calculate the file storage information before formatting.

[0071] S700: Based on the file storage information prior to formatting, locate and recover the lost data.

[0072] It should be noted that the methods of one or more embodiments of this specification can be executed by a single device, such as a computer or server. The methods of this embodiment can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the methods of one or more embodiments of this specification, and the multiple devices will interact with each other to complete the method described.

[0073] It should be noted that the above description describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims may be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0074] Corresponding to the method described above, embodiments of the present invention also provide a data recovery device for NTFS partitions, such as... Figure 2 As shown, it includes:

[0075] The first acquisition unit 10 is used to obtain the starting position of the $MFT file based on the NTFS volume header information;

[0076] The second acquisition unit 20 is used to acquire the storage information of the $MFT file based on the starting position of the $MFT file;

[0077] The search unit 30 is used to traverse the entire NTFS partition in sectors to find the target sector containing file record information.

[0078] The parsing unit 40 is used to parse the file record information in the target sector according to the characteristics of the file record to obtain the starting cluster number and cluster chain information;

[0079] The guessing unit 50 is used to perform a cluster size guessing operation on the file record information in the target sector if the sector location information of the target sector is not stored in the storage information of the $MFT file, so as to obtain the cluster size of the file record information before formatting.

[0080] The calculation unit 60 is used to calculate the file storage information before formatting based on the cluster size, starting cluster number and cluster chain information;

[0081] Recovery unit 70 is used to locate and recover lost data based on the file storage information prior to the formatting.

[0082] In this embodiment of the invention, the target sector containing file record information is located, and the starting cluster number and cluster chain information are obtained through parsing. If it is determined that the sector location information of the target sector is not stored in the storage information of the $MFT file, a cluster size guessing operation is performed. The cluster size of the file record information before formatting is obtained by guessing the cluster size. Finally, based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated, thereby finding and recovering lost data and effectively improving the accuracy of file recovery.

[0083] As an optional implementation, the guessing unit is used for:

[0084] If the number of clusters of file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the possible storage location is calculated based on the possible cluster size. Based on the storage location, the file content is read. If the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting.

[0085] If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records.

[0086] As an optional implementation, the second acquisition unit is used for:

[0087] Based on the starting position of the $MFT file, obtain the first file record of the $MFT file;

[0088] The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

[0089] As an optional implementation, the search unit is used for:

[0090] Traverse the entire NTFS partition sector by sector, and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 respectively. This sector is the target sector that contains file record information.

[0091] For ease of description, the above apparatus is described in terms of function, divided into various modules. Of course, when implementing one or more embodiments of this specification, the functions of each module can be implemented in one or more software and / or hardware.

[0092] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of this specification should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in one or more embodiments of this specification do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, but do not exclude other elements or objects.

[0093] Based on the same inventive concept, corresponding to any of the above embodiments, one or more embodiments of this specification also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the above embodiments.

[0094] Figure 3This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0095] The electronic devices described above are used to implement the corresponding methods in any of the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0096] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this specification as described above, which are not provided in detail for the sake of brevity.

Claims

1. A method for data recovery from an NTFS partition, characterized in that, include: Obtain the starting position of the $MFT file based on the NTFS volume header information; Based on the starting position of the $MFT file, obtain the storage information of the $MFT file; Traverse the entire NTFS partition sector by sector to find the target sector containing file record information; The file record information in the target sector is parsed according to the characteristics of the file records to obtain the starting cluster number and cluster chain information; If the sector location information of the target sector is not stored in the storage information of the $MFT file, then a cluster size guessing operation is performed on the file record information in the target sector to obtain the cluster size of the file record information before formatting. Specifically, this includes: if the number of clusters of the file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the storage location is calculated based on the cluster size; based on the storage location, the file content is read; if the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting. If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records. Based on the cluster size, starting cluster number, and cluster chain information, the file storage information before formatting is calculated; Based on the file storage information prior to formatting, the lost data is located and recovered.

2. The data recovery method according to claim 1, characterized in that, The step of obtaining the storage information of the $MFT file based on its starting position includes: Based on the starting position of the $MFT file, obtain the first file record of the $MFT file; The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

3. The data recovery method according to claim 1, characterized in that, The process of traversing the entire NTFS partition sector by sector to find the target sector containing file record information includes: Traverse the entire NTFS partition sector by sector, and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 respectively. This sector is the target sector that contains file record information.

4. A data recovery device for NTFS partitions, characterized in that, include: The first acquisition unit is used to obtain the starting position of the $MFT file based on the NTFS volume header information; The second acquisition unit is used to acquire the storage information of the $MFT file based on the starting position of the $MFT file; The search unit is used to traverse the entire NTFS partition sector by sector to find the target sector containing file record information. The parsing unit is used to parse the file record information in the target sector according to the characteristics of the file record to obtain the starting cluster number and cluster chain information; The guessing unit is used to perform a cluster size guessing operation on the file record information in the target sector if the sector location information of the target sector is not stored in the storage information of the $MFT file, so as to obtain the cluster size of the file record information before formatting; The calculation unit is used to calculate the file storage information before formatting based on the cluster size, starting cluster number, and cluster chain information. The recovery unit is used to locate and recover lost data based on the file storage information prior to formatting. The guessing unit is used for: If the number of clusters of file record information in the target sector is 1, and the file size is less than or equal to the cluster size, the storage location is calculated based on the cluster size. Based on the storage location, the file content is read. If the file content has the characteristics of a specific file type, then the cluster size corresponding to the storage location is the cluster size of the file record information before formatting. If the number of clusters of file record information in the target sector is greater than 1, the cluster size is calculated according to the formula: cluster size * number of clusters ≥ file size, cluster size * (number of clusters - 1) < file size. The file size is obtained by parsing the file record information in the target sector according to the characteristics of the file records.

5. The data recovery device according to claim 4, characterized in that, The second acquisition unit is used for: Based on the starting position of the $MFT file, obtain the first file record of the $MFT file; The storage information of $MFT is obtained from the 0x80H attribute in the first file record.

6. The data recovery device according to claim 4, characterized in that, The search unit is used for: Traverse the entire NTFS partition sector by sector, and find the sector whose first 5 bytes are 0x46, 0x49, 0x4c, 0x45 and 0x30 respectively. This sector is the target sector that contains file record information.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 3.

Images