A method and apparatus for disk scan acceleration for windows systems

Abstract

This disclosure provides a method and apparatus for accelerating disk scanning in Windows systems, relating to the computer field. The method includes the following steps: opening a master file table, wherein the master file table includes file records; determining the data attributes of the file corresponding to each file record; based on the file records, extracting the block numbers of file blocks whose data attributes are non-resident, obtaining a block number set; based on the block number set, extracting the logical block number of each block number; based on the logical block numbers, generating a logical block number list; and reading file content based on the logical block number list to complete the disk scan. The method and system of this disclosure, during the disk scanning process, employs a method that sequentially arranges the logical block numbers in the file records of the master file table, allowing the read / write head to sequentially read disk sectors, thereby improving disk scanning speed and saving disk scanning time.

Description

Technical Field

[0001] This disclosure relates to the field of computers, and in particular to a method and apparatus for accelerating disk scanning in Windows systems. Background Technology

[0002] From the perspective of industrial control system security, and considering the stringent requirements for reliability, stability, and business continuity of industrial control systems, as well as the frequency of software and equipment updates, and the characteristics of communication and data, the concept of an "industrial control system network security whitelist" is proposed based on the "white environment" of industrial control system network security. In industrial control system software using industrial whitelists, disk scanning requires a full disk scan of all files, generating file feature values ​​using hash algorithms, and the software needs to provide a function for searching based on these feature values. This process, requiring a full disk scan of all files, can take tens of minutes or even hours, especially for slower hard drives like mechanical hard drives.

[0003] When traversing all files on the entire disk, file access takes up the majority of the time. For mechanical hard drives, due to the randomness of file storage locations, the read / write head needs to constantly move and locate disk sectors when opening and reading files. Therefore, the read / write head addressing operation during file access is the most time-consuming and laborious, becoming the performance bottleneck for mechanical hard drives.

[0004] Currently, the NTFS file system is the mainstream file system used in Windows operating systems. In this system, accessing files on the disk via the system-provided Application Programming Interface (API) must be done through the file system. This approach cannot solve the problem of slow disk scanning speed. When reading files with resident data attributes, the application layer of the file system calls `CreateFile`, which in turn calls `NtCreateFile`. `NtCreateFile` then uses the `sysenter` instruction to trap into the kernel and call the `ZwCreateFile` function. `ZwCreateFile` sends an Interrupt Request Packet (IRP) to the file driver. The file driver parses the IRP, locates the file in the object manager, creates a kernel object for the file in the kernel, and returns a handle to that kernel object. The application layer then calls `ReadFile` to read the file content. It can be seen that reading files with resident data attributes is cumbersome and time-consuming. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this disclosure provides a method and apparatus for accelerating disk scanning in Windows systems that can bypass the file system and directly access the disk, employing the following technical solution:

[0006] This disclosure provides a method for accelerating disk scanning in Windows systems, including the following steps:

[0007] S1. Open the main file table, which includes file records;

[0008] S2. Determine the data attributes of the file corresponding to each file record;

[0009] S3. Based on the above file records, extract the block numbers of file blocks whose data attributes are non-resident, and obtain a set of block numbers;

[0010] S4. Based on the above block number set, extract the logical block number for each block number;

[0011] S5. Based on the above logical block numbers, generate a list of logical block numbers;

[0012] S6. Read the file content based on the above logical block number list to complete the disk scan.

[0013] Furthermore, data attributes include: resident and non-resident.

[0014] Furthermore, based on the above logical block numbers, a list of logical block numbers is generated, specifically including:

[0015] Sort the above logic block numbers in ascending order to obtain a list of logic block numbers.

[0016] Furthermore, based on the aforementioned list of logical block numbers, the file content is read to complete the disk scan, specifically including:

[0017] Calculate and process each logical block number in the above logical block number list to obtain the corresponding disk offset address;

[0018] The file is read based on the disk offset address mentioned above, and the disk scan is completed.

[0019] Furthermore, the disk offset address is calculated using the following formula:

[0020] A = LCN × S × 512

[0021] Where A is the disk offset address, LCN is the logical block number, and S is the number of sectors contained in the file block.

[0022] Furthermore, based on the aforementioned disk offset address, file reading is performed to complete the disk scan, specifically including:

[0023] The disk head is used to locate the disk according to the disk offset addresses mentioned above, and the file content of the file corresponding to each disk offset address is read to complete the disk scan.

[0024] Furthermore, the aforementioned methods for accelerating disk scanning in Windows systems also include:

[0025] Read the file records of files with the data attribute of "resident" from the file records, and complete the reading of the files with the data attribute of "resident".

[0026] The present invention also provides a disk scanning acceleration device for a Windows system, comprising:

[0027] The open unit is used to open the main file table, which includes file records;

[0028] The determination unit is used to determine the data attributes of the file corresponding to each file record;

[0029] The first extraction unit is used to extract the block numbers of files whose data attributes are non-resident based on the above file records, and obtain a set of block numbers;

[0030] The second extraction unit is used to extract the logical block number of each block number based on the above block number set;

[0031] The generation unit is used to generate a list of logical block numbers based on the above logical block numbers;

[0032] The scanning unit is used to read file content based on the above list of logical block numbers to complete the disk scan.

[0033] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the above methods.

[0034] The present invention also provides a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps of any of the above methods.

[0035] The beneficial effects of the above-mentioned technical solutions provided in this disclosure include at least the following:

[0036] This disclosure discloses a disk scanning acceleration method and apparatus for Windows systems. During the disk scanning process, it bypasses the file system and directly accesses the disk. The logical block numbers in the master file table are arranged sequentially, allowing the read / write head to read the disk sectors sequentially. During the disk scanning process, the read / write head does not need to perform continuous and disordered position movement and positioning operations, thereby improving the disk scanning speed and greatly saving disk scanning time.

[0037] For files with resident data attributes, the reading process is simplified, omitting many steps and significantly improving the reading speed. For files with non-resident data attributes, the reading process bypasses the file system, simplifying the reading process, and the sequential reading method further improves the file reading speed. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0039] Figure 1 A flowchart illustrating a method for accelerating disk scanning in a Windows system, provided as an embodiment of this disclosure;

[0040] Figure 2 Example diagram of VCN-LCN mapping relationship for files with non-resident data attributes provided in this embodiment of the disclosure;

[0041] Figure 3 A structural block diagram of a disk scanning acceleration device for a Windows system provided in this disclosure embodiment;

[0042] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0043] To better understand this disclosure, various aspects of this disclosure will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are merely illustrative of exemplary embodiments of this disclosure and are not intended to limit the scope of this disclosure in any way.

[0044] As used herein, the terms “approximately,” “about,” and similar terms are used to indicate approximation, not degree, and are intended to describe inherent biases in measured or calculated values ​​that will be recognized by those skilled in the art. Furthermore, the order in which the steps are described in this disclosure does not necessarily indicate the order in which these steps occur in actual operation, unless otherwise expressly defined or deduced from the context.

[0045] It should also be understood that expressions such as "comprising," "including," "having," "containing," and / or "comprising" are open-ended rather than closed-ended expressions in this specification, indicating the presence of the stated features, elements, and / or components, but not excluding the presence of one or more other features, elements, components, and / or combinations thereof. Furthermore, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features, not just individual elements in the list. Additionally, when describing embodiments of this disclosure, the word "may" is used to mean "one or more embodiments of this disclosure." And the term "exemplary" is intended to refer to an example or illustration.

[0046] Unless otherwise specified, all terms used herein (including engineering and technical terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It should also be understood that, unless expressly stated in this disclosure, terms as defined in common dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or overly formalized meaning.

[0047] It should be noted that, where there is no conflict, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0048] Figure 1 Please refer to the flowchart of a disk scanning acceleration method for a Windows system provided in this disclosure embodiment. Figure 1 This disclosure provides a method for accelerating disk scanning in Windows systems, comprising the following steps:

[0049] S1. Open the main file table, which includes file records;

[0050] In the NTFS (New Technology File System) file system, the Master File Table (MFT) is stored at the very beginning of each partition's disk. The MFT contains file records for all files in the current partition, with one file record for each file. After opening the MFT of the current partition and obtaining the first file record, the read / write head can automatically align to the next file record for reading. Using the method disclosed herein, during disk scanning, the NTFS file system can be bypassed, allowing direct access to the MFT.

[0051] Specifically, the MFT of each partition is opened sequentially to obtain file records until the MFTs of all partitions are traversed and file records of all files are obtained. Here, the master file table includes file records.

[0052] Furthermore, when the data in the MFT is incomplete, the MFT backup saved in the last location of the partition where the current MFT is located is used for recovery.

[0053] S2. Determine the data attributes of the file corresponding to each file record;

[0054] Furthermore, each file record in the MFT has 1K of storage space. When the actual space occupied by the file's metadata is less than 1K, and the file content is small enough to be stored in the aforementioned 1K of storage space, the file record can include the file content.

[0055] Specifically, data attributes include resident and non-resident. For files with non-resident data attributes, the file record includes the file's metadata, where metadata refers to information describing the data attributes (properties) to support functions such as indicating storage location, historical data, resource lookup, and file records. For files with resident data attributes, the file record includes the file's metadata and file content.

[0056] S3. Based on the above file records, extract the block numbers of file blocks whose data attributes are non-resident, and obtain a set of block numbers;

[0057] For files with non-resident data attributes, since the file records do not include the file content, reading the file records will cause the read / write head to reposition, affecting the continuous reading of file records in the MFT. Specifically, in this disclosure, when reading the file records of files with non-resident data attributes, the file content is not read; only the block numbers of the file blocks in the metadata are extracted to obtain a set of block numbers, thereby improving the reading speed.

[0058] Specifically, a file may have multiple file blocks, and the block numbers of all file blocks in the file record corresponding to that file are stored. When extracting the block numbers of a file's file blocks, the block numbers of all file blocks in that file should be extracted.

[0059] S4. Based on the above block number set, extract the logical block number for each block number;

[0060] Specifically, NTFS allocates disk storage space for files in units of blocks, with a default of 4KB. Each file contains 8 consecutive sectors, each with 512 bytes of space. The data run field in the File Record of each file records the content of the blocks related to that file, including the Logical Cluster Number (LCN) and Virtual Cluster Number (VCN). NTFS uses VCN and LCN to locate blocks, recording run or disk extent information through the mapping relationship between VCN and LCN. Specifically, VCN is used to logically number the blocks used by that file from 0 to m, and LCN is used to sequentially number the blocks in the entire volume from 0 to n. In this case, based on the above set of block numbers, the logical block number of each block number is extracted.

[0061] S5. Based on the above logical block numbers, generate a list of logical block numbers;

[0062] Specifically, based on the above logical block numbers, they are sorted from smallest to largest to obtain a list of logical block numbers, which facilitates the read / write head to read the disk sectors sequentially from front to back, thereby improving the read speed.

[0063] S6. Read the file content based on the above logical block number list to complete the disk scan.

[0064] Specifically, each logical block number in the above logical block number list is calculated and processed to obtain the corresponding disk offset address;

[0065] The file is read based on the disk offset address mentioned above, and the disk scan is completed.

[0066] Furthermore, the disk head is used to locate the disk according to the disk offset addresses mentioned above, and the file content of the file corresponding to each disk offset address is read to complete the disk scan.

[0067] The disk offset address mentioned above is calculated using the following formula:

[0068] A = LCN × S × 512

[0069] Where A is the disk offset address, LCN is the logical block number, and S is the number of sectors contained in the file block. Specifically, each file block consists of 8 consecutive sectors, meaning that a file block contains 8 sectors.

[0070] For example, please refer to Figure 2 In this formula, Standard information represents standard information, Filename represents the filename, Data represents the data, Starting VCN represents the starting virtual block number, Starting LCN represents the starting logical block number, and Number of clusters represents the number of blocks. For example, in the figure, a file block with VCN 0 has a logical block number of 1355 and contains 8 sectors. The calculation is based on the above formula. 5550080 is the disk offset address of this file. When reading this file, the read / write head will move to this disk offset address.

[0071] Furthermore, the above-mentioned disk scanning acceleration method for Windows systems also includes: for files with resident data attributes, the file record includes file content, and during the process of reading the file record of the file with resident data attributes, the file content of the resident file is read simultaneously.

[0072] The beneficial effects of the above-mentioned technical solutions provided in this disclosure include at least the following:

[0073] This disclosure discloses a disk scanning acceleration method for Windows systems. During the disk scanning process, it bypasses the file system and directly accesses the disk. The logical block numbers in the MFT file record are arranged sequentially, so that the read / write head can read the disk sectors sequentially. During the disk scanning process, the read / write head does not need to perform continuous and disordered position movement and positioning operations, which improves the disk scanning speed and greatly saves disk scanning time.

[0074] For files with resident data attributes, the reading process is simplified, omitting many steps and significantly improving the reading speed. For files with non-resident data attributes, the reading process bypasses the file system, simplifying the reading process, and the sequential reading method further improves the file reading speed.

[0075] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0076] Figure 3Please refer to the structural block diagram of a disk scanning acceleration device for a Windows system provided in this disclosure embodiment. Figure 3 The present invention also provides a disk scanning acceleration device for a Windows system, comprising:

[0077] Opening unit 310 is used to open the main file table, wherein the main file table includes file records;

[0078] The determining unit 320 is used to determine the data attributes of the file corresponding to each file record;

[0079] The first extraction unit 330 is used to extract the block number of a file whose data attribute is non-resident based on the above file records, and obtain a block number set;

[0080] The second extraction unit 340 is used to extract the logical block number of each block number based on the above block number set;

[0081] The generation unit 350 is used to generate a list of logical block numbers based on the above logical block numbers;

[0082] The scanning unit 360 is used to read file content based on the above logical block number list to complete the disk scan.

[0083] Furthermore, data attributes include: resident and non-resident.

[0084] Furthermore, based on the above logical block numbers, a list of logical block numbers is generated, specifically including:

[0085] Sort the above logic block numbers in ascending order to obtain a list of logic block numbers.

[0086] Furthermore, based on the aforementioned list of logical block numbers, the file content is read to complete the disk scan, specifically including:

[0087] Calculate and process each logical block number in the above logical block number list to obtain the corresponding disk offset address;

[0088] The file is read based on the disk offset address mentioned above, and the disk scan is completed.

[0089] Furthermore, the disk offset address is calculated using the following formula:

[0090] A = LCN × S × 512

[0091] Where A is the disk offset address, LCN is the logical block number, and S is the number of sectors contained in the file block.

[0092] Furthermore, based on the aforementioned disk offset address, file reading is performed to complete the disk scan, specifically including:

[0093] The disk head is used to locate the disk according to the disk offset addresses mentioned above, and the file content of the file corresponding to each disk offset address is read to complete the disk scan.

[0094] Furthermore, the aforementioned disk scanning acceleration device for Windows systems also includes:

[0095] The reading unit 370 is used to read the file records of files with the data attribute of being resident in the file records, and to complete the reading of the files with the data attribute of being resident.

[0096] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this disclosure.

[0097] The following is for reference. Figure 4 It shows a schematic diagram of the structure of an electronic device 400 suitable for implementing some embodiments of the present disclosure. Figure 4 The server shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0098] like Figure 4 As shown, electronic device 400 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from storage device 408 into random access memory (RAM) 403. RAM 403 also stores various programs and data required for the operation of electronic device 400. Processing device 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0099] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 4 Each box shown can represent a device or multiple devices as needed.

[0100] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 409, or installed from storage device 408, or installed from ROM 402. When the computer program is executed by processing device 401, it performs the functions defined above in the methods of some embodiments of this disclosure.

[0101] It should be noted that, in some embodiments of this disclosure, the computer-readable medium described above may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0102] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0103] The aforementioned computer-readable medium may be included in the aforementioned device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: open a master file table, wherein the master file table includes file records; determine the data attributes of the file corresponding to each file record; based on the file records, extract the block numbers of file blocks whose data attributes are non-resident, obtaining a set of block numbers; based on the set of block numbers, extract the logical block number of each block number; based on the logical block numbers, generate a list of logical block numbers; and based on the list of logical block numbers, read the file content to complete a disk scan.

[0104] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including an opening unit, a determining unit, a first extraction unit, a second extraction unit, a generating unit, and a scanning unit. The names of these units do not necessarily limit the specific unit; for example, the opening unit may also be described as a "unit for opening the master file table."

[0107] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0108] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A method for accelerating disk scanning in Windows systems, characterized in that, Includes the following steps: Open the main file table, which includes file records; Determine the data attributes of the file corresponding to each file record; Based on the file records, extract the block numbers of file blocks whose data attributes are non-resident to obtain a set of block numbers; Based on the block number set, extract the logical block number for each block number; Based on the aforementioned logical block number, generate a list of logical block numbers; The file content is read based on the logical block number list to complete the disk scan; Read the file records of files whose data attribute is resident from the file records, and complete the reading of the files whose data attribute is resident; The data attributes include: permanent and non-permanent; The step of generating a list of logical block numbers based on the logical block numbers specifically includes: sorting the logical block numbers in ascending order to obtain a list of logical block numbers; The process of reading file content based on the logical block number list to complete the disk scan specifically includes: Calculate and process each logical block number in the logical block number list to obtain the corresponding disk offset address; The file is read based on the disk offset address, and the disk scan is completed. The disk offset address is calculated using the following formula. A = LCN × S × 512 Where A is the disk offset address, LCN is the logical block number, and S is the number of sectors contained in the file block.

2. The disk scanning acceleration method for Windows systems according to claim 1, characterized in that, The process of reading files based on the disk offset address to complete the disk scan specifically includes: The disk head is used to locate the disk according to the disk offset address, and the file content of the file corresponding to each disk offset address is read to complete the disk scan.

3. A disk scanning acceleration device for a Windows system, characterized in that, include: An opening unit is used to open a master file table, wherein the master file table includes file records; The determination unit is used to determine the data attributes of the file corresponding to each file record; The first extraction unit is used to extract the block numbers of files whose data attributes are non-resident based on the file records, and obtain a set of block numbers; The second extraction unit is used to extract the logical block number of each block number based on the block number set; The generation unit is used to generate a list of logical block numbers based on the logical block numbers; The scanning unit is used to read file content based on the logical block number list and complete the disk scan; The reading unit is used to read the file records of files with the data attribute of being resident in the file records, and to complete the reading of the files with the data attribute of being resident; The data attributes include: permanent and non-permanent; The step of generating a list of logical block numbers based on the logical block numbers specifically includes: sorting the logical block numbers in ascending order to obtain a list of logical block numbers; The process of reading file content based on the logical block number list to complete the disk scan specifically includes: Calculate and process each logical block number in the logical block number list to obtain the corresponding disk offset address; The file is read based on the disk offset address, and the disk scan is completed. The disk offset address is calculated using the following formula. A = LCN × S × 512 Where A is the disk offset address, LCN is the logical block number, and S is the number of sectors contained in the file block.

4. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 2.

5. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 2.

Images