A method for recovering FLV files when disk partition is damaged

Abstract

The present invention discloses a method for recovering FLV files when a disk partition is damaged. The method combines the file system format of the Windows operating system, the disk partition size, the cluster size and the structural characteristics of the FLV file itself, compares the byte length of the previous tag contained in the next cluster with the byte length of the last tag of the current cluster, determines the order relationship between the current cluster and the next cluster, and sequentially splices the data of the previous and next two adjacent clusters to recover the FLV file.

Description

Technical Field

[0001] The invention belongs to the field of electronic evidence collection and data recovery, and relates to a method for recovering an FLV file, and in particular to a method for recovering an FLV file when a disk partition is damaged. Background Art

[0002] FLV file is the abbreviation of FLASH VIDEO. FLV streaming media format is a video format developed with the launch of Flash MX. Because it forms extremely small files and loads very quickly, it makes it possible to watch video files on the Internet. Its appearance effectively solves the problem that after the video files are imported into Flash, the exported SWF files are huge in size and cannot be used well on the Internet.

[0003] FLV files are used by many new generation video sharing websites and are the fastest growing and most widely used video dissemination format. They are developed based on the compression algorithm of Sorenson. FLV format can not only be easily imported into Flash, but also has a very fast speed and can protect copyrights, and can play videos without using local Microsoft or REAL players.

[0004] FLV file is a binary file, which consists of FLV header and many tags. Tags can be divided into three categories: audio, video, script, which represent audio stream, video stream, script stream (keywords or file information, etc.) respectively.

[0005] FLV file = FLV file header + tag1 + tag2 + tag3 + ... + tagN.

[0006] The composition of each tag is the same, that is, tag = byte length of the previous tag (Previous tagsize) + tag header (Tag header) + tag data (Tag data).

[0007] The composition of each tag header is the same, that is, tag header = tag type + byte length of tag data + timestamp, extended timestamp_ex + stream information ID.

[0008] However, as a kind of electronic data, FLV files are generally stored in storage spaces such as disks and USB flash drives. They are also easily damaged. For example, when a disk partition is damaged, the partition cannot be recognized normally by the Windows operating system, and data cannot be read, and the order relationship between clusters cannot be determined. Even if a normal and complete FLV file is stored, we still cannot play it normally. Therefore, in view of the technical problem that FLV files cannot be recovered in the prior art, especially when the disk partition is damaged, there is an urgent need for a method for recovering FLV files when the disk partition is damaged, which has solved the problem of electronic forensics and data recovery of FLV files. Summary of the invention

[0009] In view of the problems of the prior art, the present invention provides a method for recovering FLV files when a disk partition is damaged. Combining the file system format of the Windows operating system, the disk partition size, the cluster size and the structural characteristics of the FLV file itself, the byte length of the previous tag contained in the next cluster (Previous tag size) is compared with the byte length of the last tag of the current cluster, and the order relationship between the current cluster and its next cluster is determined, so as to sequentially splice the data of the previous and next two adjacent clusters and recover the FLV file.

[0010] The method provided by the present invention comprises the following steps:

[0011] S100: Determine the file system format, disk partition size, and cluster size of the Windows operating system, wherein the file system format includes FAT16, FAT32, and NTFS;

[0012] S200: Determine whether the current disk partition contains an FLV file: search for an FLV file feature identifier in the current disk partition in cluster units. If found, execute step S300; otherwise, execute step SA00;

[0013] S300: taking clusters as units, sequentially traverse each cluster of the current disk partition to determine whether the current cluster is a non-FLV file. If so, execute step S400; otherwise, execute step S500, wherein the non-FLV file includes disk management data information and type file data;

[0014] S400: addressing the next cluster, executing step S300;

[0015] S500: Determine whether the last label of the current cluster is complete, if yes, execute step S600, otherwise, execute step S700;

[0016] S600: Execute the first type of recovery: when the last label of the current cluster is complete, compare the byte length of the previous label contained in the next cluster with the byte length of the last label of the current cluster, determine the order relationship between the current cluster and the next cluster, and perform sequential splicing to restore the FLV file, and execute step S900;

[0017] S700: Execute the second type of recovery, including recovering the FLV file in the following situations:

[0018] Case 1: The byte length of the previous label contained in the last label of the current cluster is incomplete;

[0019] Case 2: The last label of the current cluster contains the complete byte length of the previous label;

[0020] Case 3: The label header contained in the last label of the current cluster is incomplete;

[0021] Case 4: The last label of the current cluster contains the complete byte length of the previous label and the complete label header;

[0022] Case 5: The label data contained in the last label of the current cluster is incomplete, wherein the label data includes an audio stream and / or a video stream and / or a script stream;

[0023] S800: sequentially splicing the current cluster and the next cluster according to a sequential relationship to restore the FLV file;

[0024] S900: Determine whether the recovery of the FLV file in the current disk partition is completed, if yes, execute step SA00, otherwise, execute step S400;

[0025] SA00: Determine whether the next disk partition exists. If so, execute step S200; otherwise, end the process.

[0026] Preferably, the FLV file feature identifier is a 3-byte ASCII code 0x464C56.

[0027] Preferably, the FLV file consists of an FLV file header and an FLV file body, the FLV file header consists of an FLV file feature identifier, a version, a type tag, and a data offset, the FLV file body consists of multiple tags, the tag consists of the byte length of the previous tag, a tag header, and tag data, the tag header includes the tag type, the byte length of the tag data, a timestamp, an extended timestamp, and a stream information ID.

[0028] Preferably, in step S300, determining whether the current cluster is a non-FLV file includes the following steps:

[0029] S301: Determine whether the type tag in the FLV file header contains an audio stream and / or a video stream. If yes, execute step S500; otherwise, execute step S302;

[0030] S302: Determine whether the sum of the byte length of the label data contained in the current label header + the byte length of the label header is equal to the byte length of the previous label contained in the next label. If yes, execute step S500; otherwise, execute step S303;

[0031] S303: Determine whether the current tag header conforms to the storage structure of the tag header, if yes, execute step S500, otherwise, execute step S304;

[0032] S304: Do the adjacent tags satisfy: the byte length of the tag data contained in the Nth tag + 11 = the byte length of the previous tag contained in the N+1th tag? If so, execute step S500; otherwise, it indicates that the current cluster is a non-FLV file, and execute step S400.

[0033] Preferably, the equivalent step of step S301 is: determine whether the tag type of the current tag header includes an audio stream and / or a video stream and / or a script stream, if yes, execute step S500, otherwise, execute step S302.

[0034] Preferably, step S600 includes the following steps:

[0035] When the last label of the current cluster is complete, the byte length of the previous label contained in the next cluster is equal to the byte length of the last label of the current cluster, and the storage structure of the next cluster conforms to the storage structure of the tag header, then it is determined that the current cluster and the next cluster are continuous clusters of the same FLV file, and they are sequentially spliced ​​in order to restore the FLV file, and step S900 is executed.

[0036] Preferably, step S700 includes the following steps:

[0037] S701: Determine whether the byte length of the previous label contained in the last label of the current cluster is complete, if yes, execute step S703, otherwise, execute step S702;

[0038] S702: Execute the recovery of the FLV file of case 1: splice the byte content of the byte length of the previous label contained in the current cluster with the byte content of the byte length of the previous label contained in the next cluster, read the spliced ​​byte content and determine whether it is equal to the byte length of the last label of the current cluster, if so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800, otherwise, execute step S704;

[0039] S703: Execute the recovery of the FLV file in case 2: determine whether the storage structure of the next cluster conforms to the storage structure of the tag header, if yes, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800, otherwise, execute step S704;

[0040] S704: Determine whether the label header contained in the last label of the current cluster is complete. If so, execute step S706; otherwise, execute step S705;

[0041] S705: Execute the recovery of the FLV file in case 3: splice the tag header included in the last tag of the current cluster with the tag header included in the next cluster, read the spliced ​​byte content and determine whether it conforms to the storage structure of the tag header. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S707.

[0042] S706: Restoration of the FLV file in Execution Situation 4:

[0043] The byte length of the label data in the label header contained in the last label of the current cluster is used to calculate the sum of the byte length of the label data + 11, which is used as the byte length of the last label of the current cluster;

[0044] Address the byte length of the previous tag after the first tag data contained in the next cluster and read the byte content;

[0045] Determine whether the byte length of the last tag read is equal to the byte length of the tag data + 11. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S707.

[0046] S707: Execute the recovery of the FLV file in situation 5, including the following steps:

[0047] S7071: Read the byte length of the label data in the label header contained in the last label of the current cluster;

[0048] S7072: Obtain the actual byte length of the last tag data of the current cluster;

[0049] S7073: Byte length of the tag data in the tag header minus the actual byte length of the last tag data in the current cluster, to obtain the difference;

[0050] S7074: Using the start address of the next cluster as the first address and the difference as the offset, address and read the byte content of 4 consecutive bytes;

[0051] S7075: Determine whether the byte content of the read continuous 4 bytes is equal to the sum of the actual byte length of the last tag data of the current cluster + the byte length of the last tag header of the current cluster. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S900.

[0052] The present invention has the following beneficial effects:

[0053] 1. Improve the speed of scanning disk partitions based on the size of disk partition data blocks.

[0054] 2. According to the FLV file storage structure, analyze and judge the correctness and completeness of FLV file data to improve the judgment and detection speed of FLV files.

[0055] 3. Improve the recovery rate of FLV files.

[0056] 4. When the disk partition is damaged, the partition cannot be recognized normally by the Windows operating system, the data cannot be read, and the order relationship between clusters cannot be determined, a method for recovering FLV files is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 The overall flow chart of the method provided by the present invention;

[0058] Figure 2 A data structure diagram of a tag header in an embodiment provided by the present invention;

[0059] Figure 3 A specific flow chart of determining whether the current cluster is a non-FLV file in the method provided by the present invention;

[0060] Figure 4 This is a specific flow chart of restoring an FLV file when the last tag of the current cluster is incomplete in the method provided by the present invention. DETAILED DESCRIPTION

[0061] Figure 1 The overall flow chart of the method provided by the present invention is shown. Figure 1 As shown, the method of the present invention comprises the following steps:

[0062] S100: Determine the file system format, disk partition size and cluster size of the Windows operating system, wherein the file system format includes FAT16, FAT32 and NTFS. The cluster size in the partition under various file system formats is related to the disk partition size.

[0063] For example, if the disk partition is 512MB to 1023MB, its cluster size is 16KB in FAT16 format, 4KB in FAT32 format, and 1KB in NTFS format.

[0064] For example, if the disk partition is 2048MB to 8GB, the cluster size is 4KB in FAT32 and NTFS formats.

[0065] In Windows operating system, the most commonly used file system is NTFS, and the disk partition size is generally larger than 2GB, so the following descriptions are based on the disk file system format of Windows operating system is NTFS, and the disk partition is larger than 2GB. Therefore, the size of the cluster described in this article is 4KB = 0x1000 bytes.

[0066] Figure 2 FIG. 2 shows a data structure diagram of a tag header in an embodiment provided by the present invention. Figure 2 As shown, the FLV file feature identifier is a 3-byte ASCII code 0x464C56.

[0067] S200: Determine whether the current disk partition contains an FLV file: search the FLV file feature identifier 0x464C56 in the current disk partition in cluster units. If found, execute step S300; otherwise, execute step SA00;

[0068] In addition, the FLV file consists of an FLV file header and an FLV file body. The FLV file header consists of an FLV file feature identifier, version, type tag, and data offset. The FLV file body consists of multiple tags. A tag consists of the byte length of the previous tag, a tag header, and tag data. The tag header includes the tag type, the byte length of the tag data, a timestamp, an extended timestamp, and a stream information ID.

[0069] Specifically, an FLV file is a binary file consisting of an FLV header and many tags. Tags can include three categories: audio, video, and script, which represent audio streams, video streams, and script streams (keywords or file information, etc.) respectively.

[0070] FLV file = FLV file header + tag1 + tag2 + tag3 + ... + tagN.

[0071] The composition of each tag is the same, that is, tag = byte length of the previous tag (Previous tagsize) + tag header (Tag header) + tag data (Tag data).

[0072] The byte length of a tag = the byte length of the tag header (Tag header) + the byte length of the tag data (Tag data).

[0073] The composition of each tag header is the same, that is, tag header = tag type + byte length of tag data + timestamp, extended timestamp_ex + stream information ID.

[0074] S300: taking clusters as units, sequentially traverse each cluster of the current disk partition to determine whether the current cluster is a non-FLV file. If so, execute step S400; otherwise, execute step S500, wherein the non-FLV file includes disk management data information and type file data;

[0075] Figure 3 FIG. 2 shows a specific flow chart of determining whether the current cluster is a non-FLV file in the method provided by the present invention. Figure 3 As shown, step S300 includes the following steps:

[0076] S301: Determine whether the type flag (Type Flags) in the FLV file header contains an audio stream (audio) and / or a video stream (video), if yes, execute step S500, otherwise, execute step S302;

[0077] The equivalent steps of S301 are: determining whether the tag type (Type) of the current tag header (Tag header) contains an audio stream (audio) and / or a video stream (video) and / or a script stream (script); if so, executing step S500; otherwise, executing step S302.

[0078] S302: Determine whether the sum of the byte length of the tag data contained in the current tag header (Tag header) + the byte length of the tag header (Tag header) is equal to the byte length of the previous tag contained in the next tag (Previous tag size). If yes, execute step S500; otherwise, execute step S303.

[0079] S303: Determine whether the current tag header conforms to the storage structure of the tag header, if yes, execute step S500, otherwise, execute step S304;

[0080] The storage structure of the tag header is: tag type (Type) + byte length of tag data (Datasize) + timestamp (Timestamp), extended timestamp (Timestamp_ex) + stream information ID (Stream ID).

[0081] In the FLV file, the byte length of the previous tag (Previous tag size) records the byte length of the previous tag Tag. Therefore, it can be used to determine the association relationship between adjacent tags: the byte length of the tag data in the Nth tag (Data size) + the 11 bytes occupied by the Nth tag header (Tag header) = the Previous tag size in the N+1th tag.

[0082] S304: Do the adjacent tags satisfy: the byte length of the tag data contained in the Nth tag (Datasize) + 11 = the byte length of the previous tag contained in the N+1th tag (Previous tag size), if yes, execute step S500, otherwise, it indicates that the current cluster is a non-FLV file, execute step S400. Among them, 11 indicates the fixed byte length of the tag header (Tagheader), that is, 11 bytes.

[0083] S400: addressing the next cluster, executing step S300;

[0084] S500: Determine whether the last label of the current cluster is complete, if yes, execute step S600, otherwise, execute step S700;

[0085] S600: Perform the first type of recovery: that is, when the last tag contained in the current cluster is complete and unsplit, compare the byte length of the previous tag contained in the next cluster with the byte length of the last tag of the current cluster, determine the order relationship between the current cluster and its next cluster, and perform sequential splicing to restore the FLV file, and execute step S900. Among them, the byte length of the tag = the byte length of the tag header (Tag header) + the byte length of the tag data (Tag data). Step S600 includes the following steps:

[0086] Assuming that the last tag of the current cluster is TAG n, and TAG n is complete and undivided, the byte length of the previous tag contained in the next cluster is equal to the byte length of TAG n of the current cluster, and the storage structure of the next cluster conforms to the storage structure of the tag header, it is determined that the current cluster and the next cluster are continuous clusters of the same FLV file, and they are sequentially spliced ​​in order to restore the FLV file, and step S900 is executed. The storage structure of the tag header is as described above and will not be repeated here.

[0087] S700: Execute the second type of recovery, including recovering the FLV file in the following situations:

[0088] Case 1: The byte length of the previous tag (Previous tag size) contained in the last tag of the current cluster is incomplete;

[0089] Case 2: The last tag of the current cluster contains the complete byte length of the previous tag (Previous tagsize);

[0090] Case 3: The tag header contained in the last tag of the current cluster is incomplete;

[0091] Case 4: The last tag of the current cluster contains the complete byte length of the previous tag (Previous tag size) and the complete tag header;

[0092] Case 5: The tag data contained in the last tag of the current cluster is incomplete, wherein the tag data includes an audio stream and / or a video stream and / or a script stream;

[0093] Figure 4 FIG. 4 shows a specific flow chart of restoring an FLV file when the last tag of the current cluster is incomplete in the method provided by the present invention. Figure 4 As shown, step S700 includes the following steps:

[0094] S701: Determine whether the byte length of the previous tag (Previous tagsize) contained in the last tag of the current cluster is complete. If yes, execute step S703; otherwise, execute step S702;

[0095] It should be understood whether the byte length of the previous tag (Previous tag size) is complete, that is, whether the byte length of the previous tag (Previous tag size) is divided and stored in two adjacent clusters.

[0096] S702: Execute the recovery of the FLV file in case 1: splice the byte content of the byte length of the previous tag (Previous tag size) stored in the current cluster with the remaining byte content of the byte length of the previous tag (Previous tag size) stored in the next cluster, read the spliced ​​byte content and determine whether it is equal to the byte length of the last tag of the current cluster. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800; otherwise, execute step S704;

[0097] S703: Recovery of the FLV file in execution situation 2: determine whether the storage structure of the next cluster conforms to the storage structure of the tag header. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S704. The storage structure of the tag header is as described above and will not be repeated here.

[0098] S704: Determine whether the tag header contained in the last tag of the current cluster is complete. If so, execute step S706; otherwise, execute step S705.

[0099] It should be understood whether the tag header is complete, that is, whether the tag header is divided and stored in two adjacent clusters.

[0100] S705: Recovery of the FLV file in execution situation 3: splice the tag header (Tagheader) contained in the last tag of the current cluster with the tag header (Tag header) contained in the next cluster, read the spliced ​​byte content and determine whether it conforms to the storage structure of the tag header (Tag header); if so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800; otherwise, execute step S707; the storage structure of the tag header (Tag header) is as described above and will not be repeated here.

[0101] It should be understood whether the tag header included in the last tag of the current cluster is incomplete, that is, whether the tag header is divided and stored in two adjacent clusters.

[0102] S706: Restoration of the FLV file in Execution Situation 4:

[0103] The byte length (Data size) of the tag data in the tag header (Tag header) contained in the last tag of the current cluster is used to calculate the sum of the byte length (Data size) of the tag data + 11 as the byte length of the last tag of the current cluster;

[0104] Address the byte length of the previous tag (Previous tag size) after the first tag data (Data size) contained in the next cluster and read the byte content;

[0105] Determine whether the byte length of the previous tag read is equal to the byte length of the tag data + 11. If yes, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S707.

[0106] It should be understood whether the tag data (Tag data) included in the last tag of the current cluster is incomplete, that is, whether the tag data (Tag data) is divided and stored in two adjacent clusters.

[0107] S707: Execute the recovery of the FLV file in situation 5, including the following steps:

[0108] S7071: Assume that the last tag of the current cluster is TAG n, the current cluster contains the tag header and part of the tag data of TAG n, and the next cluster contains the rest of the tag data of TAG n. In this case, we read the byte length of the tag data in the tag header of the last tag TAG n in the current cluster;

[0109] S7072: Obtain the actual byte length of the last tag data (Tag data) of the current cluster; in other words, obtain the byte length occupied by the tag data (Tag data) of TAG n in the current cluster.

[0110] S7073: The byte length of the tag data in the tag header minus the actual byte length of the last tag data in the current cluster, obtains the difference; in other words, the difference is the byte length of the tag data of TAG n in the next cluster.

[0111] S7074: Use the starting address of the next cluster as the first address and the difference as the offset to address and read the byte content of 4 consecutive bytes; in other words, the address of the tag data (Tag data) of TAG n at the end of the byte length occupied by the next cluster is actually the address of the byte length (Previous tag size) of the first previous tag of the next cluster, and read the byte content of 4 consecutive bytes with this address as the starting address, which is actually the byte length (Previous tag size) of the first previous tag of the next cluster.

[0112] S7075: Determine whether the byte content of the read continuous 4 bytes is equal to the sum of the byte length of the tag data (Tag data) of the current cluster TAG n in the current cluster + the byte length of the tag header (Tag header) of the current cluster TAG n. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800. Otherwise, execute step S900. As mentioned above, the byte length of the tag header (Tag header) is fixed to 11 bytes.

[0113] S800: sequentially splicing the current cluster and the next cluster according to a sequential relationship to restore the FLV file.

[0114] S900: Determine whether the recovery of the FLV file in the current disk partition is completed, if yes, execute step SA00, otherwise, execute step S400;

[0115] SA00: Determine whether the next disk partition exists. If so, execute step S200; otherwise, end the process.

[0116] The method provided by the present invention can restore FLV files in the Windows operating system format, thereby solving the technical problem that there is no method for restoring FLV files when a disk partition is damaged in the prior art.

[0117] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for recovering FLV files when a disk partition is damaged, characterized in that: The following steps are involved: S100: Determine the file system format, disk partition size, and cluster size of the Windows operating system, wherein the file system format includes FAT16, FAT32, and NTFS; S200: Determine whether the current disk partition contains an FLV file: search for an FLV file feature identifier in the current disk partition in cluster units. If found, execute step S300; otherwise, execute step SA00; S300: taking clusters as units, sequentially traverse each cluster of the current disk partition to determine whether the current cluster is a non-FLV file. If so, execute step S400; otherwise, execute step S500, wherein the non-FLV file includes disk management data information and type file data; S400: addressing the next cluster, executing step S300; S500: Determine whether the last label of the current cluster is complete, if yes, execute step S600, otherwise, execute step S700; S600: Execute the first type of recovery: when the last label of the current cluster is complete, compare the byte length of the previous label contained in the next cluster with the byte length of the last label of the current cluster, determine the order relationship between the current cluster and the next cluster, and perform sequential splicing to restore the FLV file, and execute step S900, wherein the byte length of the label = the byte length of the label header + the byte length of the label data; S700: Execute the second type of recovery, including recovering the FLV file in the following situations: Case 1: The byte length of the previous label contained in the last label of the current cluster is incomplete; Case 2: The last label of the current cluster contains the complete byte length of the previous label; Case 3: The label header contained in the last label of the current cluster is incomplete; Case 4: The last label of the current cluster contains the complete byte length of the previous label and the complete label header; Case 5: The label data contained in the last label of the current cluster is incomplete, wherein the label data includes an audio stream and / or a video stream and / or a script stream; S800: sequentially splicing the current cluster and the next cluster according to a sequential relationship to restore the FLV file; S900: Determine whether the recovery of the FLV file in the current disk partition is completed, if yes, execute step SA00, otherwise, execute step S400; SA00: Determine whether the next disk partition exists. If so, execute step S200; otherwise, end the process.

2. A method for recovering FLV files when a disk partition is damaged according to claim 1, characterized in that: The FLV file feature identifier is a 3-byte ASCII code 0x464C56.

3. The method for recovering FLV files when a disk partition is damaged according to claim 1, characterized in that: The FLV file consists of an FLV file header and an FLV file body. The FLV file header consists of an FLV file feature identifier, version, type tag, and data offset. The FLV file body consists of multiple tags. A tag consists of the byte length of the previous tag, a tag header, and tag data. The tag header includes the tag type, the byte length of the tag data, a timestamp, an extended timestamp, and a stream information ID.

4. The method for recovering FLV files when a disk partition is damaged according to claim 1, characterized in that: In step S300, determining whether the current cluster is a non-FLV file includes the following steps: S301: Determine whether the type tag in the FLV file header contains an audio stream and / or a video stream. If yes, execute step S500; otherwise, execute step S302; S302: Determine whether the sum of the byte length of the label data contained in the current label header + the byte length of the label header is equal to the byte length of the previous label contained in the next label. If yes, execute step S500; otherwise, execute step S303; S303: Determine whether the current tag header conforms to the storage structure of the tag header, if yes, execute step S500, otherwise, execute step S304; S304: Do the adjacent tags satisfy: the byte length of the tag data contained in the Nth tag + 11 = the byte length of the previous tag contained in the N+1th tag? If so, execute step S500; otherwise, it indicates that the current cluster is a non-FLV file, and execute step S400.

5. The method for recovering FLV files when a disk partition is damaged according to claim 3, characterized in that: The equivalent steps of step S301 are: determining whether the tag type of the current tag header includes an audio stream and / or a video stream and / or a script stream; if so, executing step S500; otherwise, executing step S302.

6. The method for recovering FLV files when a disk partition is damaged according to claim 1, characterized in that: Step S600 includes the following steps: When the last label of the current cluster is complete, the byte length of the previous label contained in the next cluster is equal to the byte length of the last label of the current cluster, and the storage structure of the next cluster conforms to the storage structure of the tag header, then it is determined that the current cluster and the next cluster are continuous clusters of the same FLV file, and they are sequentially spliced ​​in order to restore the FLV file, and step S900 is executed.

7. The method for recovering FLV files when a disk partition is damaged according to claim 1, characterized in that: Step S700 includes the following steps: S701: Determine whether the byte length of the previous label contained in the last label of the current cluster is complete, if yes, execute step S703, otherwise, execute step S702; S702: Execute the recovery of the FLV file of case 1: splice the byte content of the byte length of the previous label contained in the current cluster with the byte content of the byte length of the previous label contained in the next cluster, read the spliced ​​byte content and determine whether it is equal to the byte length of the last label of the current cluster, if so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800, otherwise, execute step S704; S703: Execute the recovery of the FLV file in case 2: determine whether the storage structure of the next cluster conforms to the storage structure of the tag header, if yes, determine that the current cluster and the next cluster are continuous clusters of the same FLV file, and execute step S800, otherwise, execute step S704; S704: Determine whether the label header contained in the last label of the current cluster is complete. If so, execute step S706; otherwise, execute step S705; S705: Execute the recovery of the FLV file in case 3: splice the tag header included in the last tag of the current cluster with the tag header included in the next cluster, read the spliced ​​byte content and determine whether it conforms to the storage structure of the tag header. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S707. S706: Restoration of the FLV file in Execution Situation 4: The byte length of the label data in the label header contained in the last label of the current cluster is used to calculate the sum of the byte length of the label data + 11, which is used as the byte length of the last label of the current cluster; Address the byte length of the previous tag after the first tag data contained in the next cluster and read the byte content; Determine whether the byte length of the last tag read is equal to the byte length of the tag data + 11. If so, determine that the current cluster and the next cluster are continuous clusters of the same FLV file and execute step S800. Otherwise, execute step S707. S707: Execute the recovery of the FLV file in situation 5, including the following steps: S7071: Read the byte length of the label data in the label header contained in the last label of the current cluster; S7072: Obtain the actual byte length of the last tag data of the current cluster; S7073: Byte length of the tag data in the tag header minus the actual byte length of the last tag data in the current cluster, to obtain the difference; S7074: Using the start address of the next cluster as the first address and the difference as the offset, address and read the byte content of 4 consecutive bytes; S7075: Determine whether the byte content of the read consecutive 4 bytes is equal to the sum of the actual byte length of the last tag data of the current cluster + the byte length of the last tag header of the current cluster. If so, determine that the current cluster and the next cluster are consecutive clusters of the same FLV file and execute step S800. Otherwise, execute step S900.

Images