A method and device for deleting data and recovering history based on an SSD mapping table

Abstract

The application provides a method and device for deleting data and recovering history record based on SSD mapping table, which comprises reading all flash blocks for storing mapping table on SSD, marking the flash blocks as mapping table blocks, and sorting the mapping table blocks in sequence; taking all mapping records of all logical addresses (LBA) on the SSD from each bank in sequence from old to new according to the mapping table sorting sequence; taking the latest mapping record from each bank, recombining the SSD hard disk data, and taking one history mapping record of each bank as a rollback state; when recovering the history editing record of a file, analyzing and calculating the sector map of the file to obtain the bank block where all LBA of the file are located, taking all history mapping records of all banks where the file is located, sorting the mapping records of all banks, and taking each mapping record as a rollback state, so that the user can select the history editing record to be recovered in the rollback state. The application can realize data recovery and file editing record recovery through mapping record.

Description

Technical Field

[0001] This invention relates to the field of computational forensics security technology, and in particular to a method and apparatus for recovering deleted data and historical records based on an SSD mapping table. Background Technology

[0002] SSD (Solid State Drive), also known as a solid-state drive, mainly consists of an SSD controller and a flash array. It boasts excellent random read / write performance and is gradually replacing traditional mechanical hard drives. However, because the TRIM instruction introduced by SSDs erases data at logical addresses (LBAs) in real time, SSD data recovery is extremely difficult. Currently, there is no mature and universally applicable method for recovering deleted data from SSDs.

[0003] Because SSDs can zero out LBA data in real time, traditional file system-based data recovery methods can no longer recover deleted data. Research has found that SSDs internally manage the mapping relationship between Flash Addresses (PBAs) and LBAs through the FTL software layer. When a file is deleted, the FTL deletes the LBA mapping relationship but does not actually delete the data. Since the LBA mapping relationship is deleted after data is deleted from an SSD, current recovery software on the market cannot truly recover data by reading the LBA data. Summary of the Invention

[0004] This invention proposes a method and apparatus for recovering deleted data and historical records based on an SSD mapping table, in order to overcome the shortcomings of the prior art mentioned above.

[0005] In one aspect, the present invention proposes a method for recovering deleted data and historical records based on an SSD mapping table, comprising the following steps:

[0006] S1: Read all Flash blocks on the SSD used to store the mapping table, record the Flash blocks as mapping table blocks, and sort the mapping table blocks in order;

[0007] S2: According to the mapping table sorting order from old to new, retrieve all mapping records of all logical addresses LBA on each Bank in each Bank, and obtain the mapping records of all Banks from old to new;

[0008] S3: Retrieve the latest mapping record from each Bank, reassemble the SSD hard drive data to complete the SSD hard drive data recovery, and use one historical mapping record from each Bank as a rollback state;

[0009] S4: When restoring the historical editing records of a file, the sector map of the file is analyzed to calculate the Bank blocks where all LBAs of the file are located. All historical mapping records of all Banks where the file is located are extracted and sorted. Each mapping record corresponds to a rollback state. The user selects the historical editing records to be restored in the rollback state.

[0010] In a specific embodiment, sorting the mapping table blocks in order includes block sorting rules and page sorting rules within the same block, wherein...

[0011] The block sorting rules include first sorting the mapping table blocks according to the block allocation order, with the blocks allocated in the larger order placed first and the blocks allocated in the smaller order placed last.

[0012] The page sorting rules within the same block include sorting pages within the same mapping table block by page number, with larger page numbers listed first and smaller page numbers listed last.

[0013] In a specific embodiment, S2 specifically includes:

[0014] S21: Put all mapping table blocks on the SSD into set F, and read the allocation order in the OOB of each mapping table block and put it into its corresponding mapping table block allocation order FSn. Sort set F according to the block sorting rules.

[0015] S22: Take the latest unprocessed block Fi from set F, put the mapping tables of all banks on the latest unprocessed block Fi into set M, and read the starting page number of each bank mapping table in set M. If a file is stored on the disk, sort set M according to the page sorting rules within the same block.

[0016] S23: Take the latest unprocessed Bank mapping table from set M and put it at the end of the mapping record of its corresponding Bank mapping table set;

[0017] S24: Repeat S23 until all Bank mapping tables in set M have been processed. Repeat S22 until all mapping table blocks in set Fi have been processed. All Bank mapping records are arranged in the order of mapping and placed into the set B of all Bank mapping table mapping records.

[0018] In a specific embodiment, step S3, which involves retrieving the latest mapping record from each Bank and reconstructing the SSD hard disk data, specifically includes:

[0019] S31: Take the unprocessed block LBA with the smallest address from the set of all LBAs of the SSD, calculate the Bank in which it belongs, and take the set of mapping records Bi of the Bank from set B;

[0020] S32: Take the latest unprocessed mapping relationship of the unprocessed block LBA with the smallest address from set Bi, map the latest unprocessed mapping relationship to the valid physical address PBA, and write the latest unprocessed mapping relationship into the reassembled mapping table;

[0021] S33: Fill the physical address PBA into the logical address LBA according to the reassembled mapping table;

[0022] S34: Scan the latest data area of ​​the SSD disk, obtain the storage area set of all files, and for any file in the storage area set, retrieve the startoffset and length elements in the LBA set of the storage area in the reorganized mapping table to obtain all corresponding PBA sets, and fill the PBA data into the file in the order of the corresponding LBA.

[0023] In a specific embodiment, S4 specifically includes:

[0024] S41: Take an unprocessed element from the LBA set of the file storage area, and calculate the Bank number of the element based on the startoffset and length;

[0025] S42: Take out the mapping record of the Bank where the LBA of the storage area storing a certain file exists in the set B, store it in the set XB, sort the set XB, and calculate the number of elements in the set XB. The number of elements is the number of historical editing records of the file. Each Bank in the record maps to a modification record of the file and writes the rollback status of the disk data.

[0026] S43: Based on the different historical edit records selected by the user, replace all LBAs in the Bank to which the record belongs in the file with LBA data from the historical records.

[0027] In a specific embodiment, S42 further includes, in response to the Bank number not existing in the Bank mapping record set XB where the LBA of the storage area storing a certain file is located, taking all mapping records of the Bank number from set Bi and putting them into set XB; repeating S41 until all elements in the LBA set of the file storage area have been processed.

[0028] In a specific embodiment, sorting the set XB in S42 specifically includes: first sorting according to the mapping table block allocation order FSn, with the larger mapping table block allocation order FSn being newer and the smaller being older; for Banks with the same mapping table block allocation order FSn, sorting according to the page number of the starting page where the Bank mapping table is located, with the larger page number being newer and the smaller being older.

[0029] According to a second aspect of the invention, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a computer processor, performs the above-described method.

[0030] According to a third aspect of the present invention, a device for recovering deleted data and historical records based on an SSD mapping table is provided, comprising:

[0031] Disk data reading module: Configured to read all Flash blocks on the SSD used to store mapping tables, record the Flash blocks as mapping table blocks, and sort the mapping table blocks in order;

[0032] Mapping record acquisition module: Configured to retrieve all mapping records of all logical addresses (LBAs) on each Bank in order from oldest to newest according to the mapping table sorting order, thus obtaining the mapping records of all Banks from oldest to newest;

[0033] Data Reconstruction Module: Configured to retrieve the latest mapping record from each Bank, reconstruct the SSD hard drive data to complete the SSD hard drive data recovery, and use one historical mapping record from each Bank as a rollback state;

[0034] Historical Edit Record Recovery Module: When recovering the historical edit record of a file, the module analyzes the file's sector map to calculate the Bank blocks where all LBAs of the file are located, extracts all historical mapping records of all Banks, sorts the mapping records of all Banks, and assigns one rollback state to each mapping record. The user can select the historical edit record to be recovered in the rollback state.

[0035] In a specific embodiment, sorting the mapping table blocks in order includes block sorting rules and page sorting rules within the same block, wherein...

[0036] The block sorting rules include first sorting the mapping table blocks according to the block allocation order, with the blocks allocated in the larger order placed first and the blocks allocated in the smaller order placed last.

[0037] The page sorting rules within the same block include sorting pages within the same mapping table block by page number, with larger page numbers listed first and smaller page numbers listed last.

[0038] In a specific embodiment, the mapping record acquisition module is specifically configured to execute the following methods:

[0039] S21: Put all mapping table blocks on the SSD into set F, and read the allocation order in the OOB of each mapping table block and put it into its corresponding mapping table block allocation order FSn. Sort set F according to the block sorting rules.

[0040] S22: Take the latest unprocessed block Fi from set F, put the mapping tables of all banks on the latest unprocessed block Fi into set M, and read the starting page number of each bank mapping table in set M. If a file is stored on the disk, sort set M according to the page sorting rules within the same block.

[0041] S23: Take the latest unprocessed Bank mapping table from set M and put it at the end of the mapping record of its corresponding Bank mapping table set;

[0042] S24: Repeat S23 until all Bank mapping tables in set M have been processed. Repeat S22 until all mapping table blocks in set Fi have been processed. All Bank mapping records are arranged in the order of mapping and placed into the set B of all Bank mapping table mapping records.

[0043] In a specific embodiment, the data reconstruction module retrieves the latest mapping record from each Bank, and the reconstruction of SSD hard disk data specifically includes:

[0044] Take the unprocessed block LBA with the smallest address from the set of all LBAs of the SSD, calculate the Bank in which it belongs, and take the set of mapping records Bi of the Bank from set B.

[0045] Take the latest unprocessed mapping relationship of the unprocessed block LBA with the smallest address from set Bi, map the latest unprocessed mapping relationship to the valid physical address PBA, and write the latest unprocessed mapping relationship into the reassembled mapping table;

[0046] Fill the logical address LBA into the physical address PBA according to the reconstructed mapping table;

[0047] Scan the latest data area of ​​the SSD disk to obtain the storage area set of all files. For any file in the storage area set, retrieve the startoffset and length elements in the LBA set of the storage area from the reorganized mapping table to obtain all corresponding PBA sets, and fill the PBA data into the file according to the corresponding LBA order.

[0048] In a specific embodiment, the history edit record recovery module is specifically configured to:

[0049] Calculate the Bank number it belongs to based on the startoffset and length elements;

[0050] Take out the mapping record of the LBA of the storage area where a certain file is stored on the disk from set B, store it in set XB, sort set XB, and calculate the number of elements in set XB. The number of elements is the number of historical editing records of the file. Each Bank in the record maps to a modification record of the file and writes the rollback status of the disk data.

[0051] Based on the different historical editing records selected by the user, replace all LBAs in the Bank to which the record belongs in the file with LBA data from the historical records;

[0052] The specific steps for sorting set XB are as follows: First, sort according to the mapping table block allocation order FSn, with the larger FSn being newer and the smaller one being older; for Banks with the same mapping table block allocation order FSn, sort according to the page number of the starting page where the Bank's mapping table is located, with the larger page number being newer and the smaller one being older.

[0053] This invention reads all Flash blocks on an SSD used to store mapping tables, designating these Flash blocks as mapping table blocks, and sorts them sequentially. For each sorted mapping table block, it retrieves the mapping record stored in the latest logical address of the corresponding mapping table in the sorted order, and reconstructs the mapping table that was not erased by the TRIM instruction based on the retrieved mapping records. Deleted data is then recovered using the reconstructed mapping table. The SSD disk is rescanned to obtain the latest mapping records based on the reconstructed latest mapping table. Each obtained mapping record is recorded as one of the file's historical editing records and written to the disk data rollback state. When recovering the file's historical editing records, the user selects the desired historical editing record from the rollback state. This solution not only enables data recovery but also allows recovery of file editing records from mapping records. Attached Figure Description

[0054] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Other features, objects, and advantages of this application will become more apparent from reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0055] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0056] Figure 2This is a flowchart of a method for recovering deleted data and historical records based on an SSD mapping table, according to an embodiment of the present invention.

[0057] Figure 3 This is a flowchart of a specific embodiment of the present invention for recovering deleted data based on an SSD mapping table;

[0058] Figure 4 This is a flowchart of a specific embodiment of the present invention for recovering file history based on an SSD mapping table;

[0059] Figure 5 This is a diagram illustrating the effect of data deletion and history recovery according to a specific embodiment of the present invention;

[0060] Figure 6 This is a framework diagram of a data deletion and history recovery device based on an SSD mapping table, according to an embodiment of the present invention.

[0061] Figure 7 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0062] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0063] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0064] Figure 1 An exemplary system architecture 100 is shown, in which an SSD mapping table-based method for recovering deleted data and historical records can be applied according to embodiments of this application.

[0065] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0066] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various applications can be installed on terminal devices 101, 102, and 103, such as data processing applications, data visualization applications, and web browser applications.

[0067] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules (e.g., software programs or software modules used to provide distributed services) or as a single software program or software module. No specific limitations are imposed here.

[0068] Server 105 can be a server that provides various services, such as a background information processing server that supports the mapping table data displayed on terminal devices 101, 102, and 103. The background information processing server can process the obtained logical address and generate processing results (such as deleting data).

[0069] It should be noted that the method provided in this application embodiment can be executed by server 105 or by terminal devices 101, 102, and 103. The corresponding device is generally set in server 105 or can be set in terminal devices 101, 102, and 103.

[0070] It should be noted that a server can be either hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software programs or software modules (such as software programs or software modules used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0071] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0072] A method for recovering deleted data and historical records based on an SSD mapping table according to an embodiment of the present invention. Figure 2 A flowchart illustrating a method for recovering deleted data and historical records based on an SSD mapping table according to an embodiment of the present invention is shown. Figure 2 As shown, the method includes the following steps:

[0073] S1: Read all Flash blocks on the SSD used to store the mapping table, record the Flash blocks as mapping table blocks, and sort the mapping table blocks in order;

[0074] S2: According to the mapping table sorting order from old to new, retrieve all mapping records of all logical addresses LBA on each Bank in each Bank, and obtain the mapping records of all Banks from old to new;

[0075] S3: Retrieve the latest mapping record from each Bank, reassemble the SSD hard drive data to complete the SSD hard drive data recovery, and use one historical mapping record from each Bank as a rollback state;

[0076] S4: When restoring the historical editing records of a file, the sector map of the file is analyzed to calculate the Bank blocks where all LBAs of the file are located. All historical mapping records of all Banks where the file is located are extracted and sorted. Each mapping record corresponds to a rollback state. The user selects the historical editing records to be restored in the rollback state.

[0077] In one specific implementation, for example, the file's sector map occupies 5 banks, and each bank has 2 edit records. In this case, according to the permutations and combinations, the file has 2... 5 This application provides a set of historical editing records. By sorting the mapping records of all banks occupied by a file, the file will have 2+2+2+2+2=10 historical records. This significantly reduces invalid historical records during history recovery. This is the core advantage of this application. It solves the problem of excessive invalid historical records caused by multiple historical record permutations and combinations.

[0078] In a specific embodiment, the order includes the application order marked by the SSD controller for the mapping table block when the SSD stores the mapping table block.

[0079] In a specific embodiment, sorting the mapping table blocks in order specifically includes:

[0080] First, sort the mapping table blocks according to the block allocation order, with the blocks with larger allocation orders placed first and the blocks with smaller allocation orders placed last.

[0081] Pages within the same mapping table block are sorted by page number, with larger page numbers appearing first and smaller page numbers appearing last.

[0082] In a specific embodiment, S2 specifically includes:

[0083] S21: Put all mapping table blocks on the SSD into set F, and read the allocation order in the OOB of each mapping table block and put it into its corresponding mapping table block allocation order FSn. Sort set F according to the block sorting rules.

[0084] S22: Take the latest unprocessed block Fi from set F, put the mapping tables of all banks on the latest unprocessed block Fi into set M, and read the starting page number of each bank mapping table in set M. If a file is stored on the disk, sort set M according to the page sorting rules within the same block.

[0085] S23: Take the latest unprocessed Bank mapping table from set M and put it at the end of the mapping record of its corresponding Bank mapping table set;

[0086] S24: Repeat S23 until all Bank mapping tables in set M have been processed. Repeat S22 until all mapping table blocks in set Fi have been processed. All Bank mapping records are arranged in the order of mapping and placed into the set B of all Bank mapping table mapping records.

[0087] In a specific embodiment, step S3, which involves retrieving the latest mapping record from each Bank and reconstructing the SSD hard disk data, specifically includes:

[0088] S31: Take the unprocessed block LBA with the smallest address from the set of all LBAs of the SSD, calculate the Bank in which it belongs, and take the set of mapping records Bi of the Bank from set B;

[0089] S32: Take the latest unprocessed mapping relationship of the unprocessed block LBA with the smallest address from set Bi, map the latest unprocessed mapping relationship to the valid physical address PBA, and write the latest unprocessed mapping relationship into the reassembled mapping table;

[0090] S33: Fill the physical address PBA into the logical address LBA according to the reassembled mapping table;

[0091] S34: Scan the latest data area of ​​the SSD disk, obtain the storage area set of all files, and for any file in the storage area set, retrieve the startoffset and length elements in the LBA set of the storage area in the reorganized mapping table to obtain all corresponding PBA sets, and fill the PBA data into the file in the order of the corresponding LBA.

[0092] In a specific embodiment, S4 specifically includes:

[0093] S41: Take an unprocessed element from the LBA set of the file storage area, and calculate the Bank number of the element based on the startoffset and length;

[0094] S42: Take the mapping records of the Banks containing the LBAs of the storage area where a file is stored on the disk from set B, store them in set XB, sort set XB, and calculate the number of elements in set XB. The number of elements is the number of historical editing records of the file. Each Bank mapping corresponds to a modification record of the file and writes the rollback status of the disk data. In response to the Bank number not existing in the set XB of the Bank mapping records of the LBAs of the storage area where a file is stored on the disk, take all the mapping records of the Bank number from set Bi and put them into set XB. Repeat S41 until all elements in the LBA set of the file storage area have been processed.

[0095] S43: Based on the different historical edit records selected by the user, replace all LBAs in the Bank to which the record belongs in the file with LBA data from the historical records.

[0096] In a specific embodiment, sorting the set XB in S42 specifically includes: first sorting according to the mapping table block allocation order FSn, with the larger mapping table block allocation order FSn being newer and the smaller being older; for Banks with the same mapping table block allocation order FSn, sorting according to the page number of the starting page where the Bank mapping table is located, with the larger page number being newer and the smaller being older.

[0097] SSDs (Solid State Drives), also known as solid-state drives, are primarily composed of an SSD controller and a flash array. They offer excellent random read / write performance and are gradually replacing traditional hard disk drives (HDDs). However, the TRIM instruction introduced by SSDs erases data at logical addresses (LBAs) in real time, making SSD data recovery extremely difficult. Currently, there is no mature and universally applicable method for recovering deleted data from SSDs. Research has found that SSD controllers manage and map flash data and logical data through the FTL layer, enabling real-time erasure of LBA data. After in-depth research into the principles of SSDs, a method and device for recovering deleted data and file history based on SSD mapping tables are proposed. This method reconstructs the SSD mapping table information and mapping records deleted by TRIM by analyzing the historical records of the SSD's secondary mapping table. This not only enables data recovery but also allows recovery of file editing records from the mapping records.

[0098] Because SSDs can zero out LBA data in real time, traditional file system-based data recovery methods can no longer recover deleted data. Research has found that SSDs internally manage the mapping relationship between Flash Addresses (PBAs) and LBAs through the FTL software layer. When a file is deleted, the FTL deletes the LBA mapping relationship but does not actually delete the data. Since the LBA mapping relationship is deleted after data is deleted from an SSD, current recovery software on the market cannot truly recover data by reading the LBA data.

[0099] To address this problem, this invention first extracts the mapping records from LBA to PBA from the historical records of the SSD mapping table, sorts the LBA to PBA mapping records according to the mapping order, and then reconstructs the complete logical data that has not been disconnected by the TRIM instruction. After the file system parses the data, the historical records of a certain LBA (including files, RAW, file system metadata, etc.) can be obtained through intelligent analysis or manual analysis. Then, the editing records of that LBA can be recovered, realizing file recovery and historical record recovery.

[0100] To better illustrate the solution of this invention, some relevant concepts and principles of SSDs will be explained below:

[0101] I. SSD mapping principle:

[0102] Because data modifications to NandFlash require erasing before writing, the file system must perform numerous operations during read and write operations. To address this issue, SSD controllers introduce the FTL layer, allowing the file system to operate the SSD like a traditional hard drive. To avoid rewriting the entire mapping table for every modification, the SSD internally divides the entire data disk into several regions, hereinafter referred to as Banks. Each time data in a specific LBA is modified, the SSD internally instructs the disk to discard the mapping table of the Bank containing that LBA and rewrite it into a new Bank mapping table.

[0103] II. SSD Data Deletion and File History Recovery Method Based on Mapping Tables:

[0104] In-depth research on data deletion using the TRIM command on SSDs revealed that when an SSD deletes data at a specific LBA address using the TRIM command, it only deletes the mapping relationship corresponding to that LBA; the actual PBA data is not immediately deleted. Therefore, by obtaining the LBA mapping record, the LBA mapping relationship can be recompiled based on the mapping record, enabling data recovery. Further research showed that more historical mapping records can be compiled, thus achieving file history recovery. The key to the data deletion and file history recovery method and apparatus based on SSD mapping tables proposed in this application lies in obtaining the LBA mapping record and mapping the LBA to the PBA whose mapping record still contains valid data. In practical use cases, when performing file editing, file system metadata updates, and RAW data changes, a large number of LBA-to-PBA records are generated internally within the SSD, and there can be many mapping records for the same address. This poses a significant challenge to reconstructing the mapping table, but also offers hope for file history recovery. A thorough study of FTL's working principle reveals that the SSD controller allocates specific Flash blocks to store the mapping table. The allocation order of the block and the Bank number to which the mapping table belongs are marked on the Out-of-Brow (OOB) of each page within that block. Furthermore, within each mapping table block, allocations are made in page-number order. For ease of description, the Flash block storing the mapping table will be referred to as the mapping table block.

[0105] By reading all mapping table blocks on the SSD and sorting them according to the application order, the mapping records for each Bank are organized separately. Then, the latest mapping record for each LBA is extracted and used to reconstruct the SSD data, thus reconstructing the mapping table that was not erased by the TRIM command. This enables data recovery. Furthermore, by combining file system characteristics, file characteristics, and RAW data characteristics to adjust the mapping record of a specific LBA to a record in its historical mapping records, file edit history recovery can be achieved. This method can be used not only to recover file edit history and RAW data records but also to recover file system metadata, demonstrating excellent recovery results in cases of accidental file system formatting.

[0106] Based on the above concepts and principles, the specific process of the solution will be illustrated below using a concrete example:

[0107] I. Conceptual Assumptions in this Embodiment:

[0108] Two sorting rules are introduced: the mapping table block sorting rule (BSR) and the page sorting rule (PSR) within the same mapping table block;

[0109] 1. Block Sorting Rule (BSR): Sort the set to be sorted according to the block allocation order, with larger block allocation order placed first and smaller block allocation order placed last.

[0110] 2. Page sorting rules within the same block: PSR: Sort by page number, with larger page numbers listed first and smaller page numbers listed last.

[0111] 3. Set F is the set of all mapping table blocks, and FSn is the allocation order of the mapping table blocks.

[0112] 4. Set M is the set of all Bank mapping tables on block Fi in set F, and PSn is the page number of the starting page of a certain Bank mapping table in set T.

[0113] 5. Set B is the set of all Bank mapping records.

[0114] 6. Set L is the set of all LBAs in SSD.

[0115] 7. ReMapTable is the reorganized mapping table.

[0116] 8. Suppose that D = {D1, D2, ..., Dn} is the LBA set of the storage area on the disk that stores a certain file. Then each element Dn in the set contains two elements: startoffset and length.

[0117] 9. Suppose that XB = {XB1, XB2, ..., XBn} is the set of Bank mapping records where the LBA of the storage area storing a certain file on the disk is located.

[0118] 10. Definitions: Bank represents a mapping table, Flash block represents a mapping table block, LBA represents a logical address, and PBA represents a Flash address.

[0119] II. Description of the Data Recovery Process

[0120] Figure 3 A flowchart illustrating a specific embodiment of the present invention for data recovery based on an SSD mapping table is shown, as follows: Figure 3 The specific process is as follows:

[0121] Step 301. Scan all mapping table blocks on the SSD and put them into set F, and read the allocation order in the OOB of each mapping table block and put it into its corresponding FSn.

[0122] Step 302. Sort set F according to sorting rule BSR.

[0123] Step 303. Take the latest unprocessed block Fi from set F, scan all the Bank mapping tables on Fi and put them into set M, and read the starting page number of each Bank mapping table in set M as the PSn of that Bank mapping table.

[0124] Step 304. Sort set M according to sorting rule PSR.

[0125] Step 305. Retrieve the latest unprocessed Bank mapping table from set M. Place this mapping table at the end of the mapping records in its corresponding Bank mapping table set Bi.

[0126] Step 306. Determine whether all Bank mapping tables in set M have been processed. If yes, continue to step 307; otherwise, skip to step 305.

[0127] Step 307. Determine if all mapping table blocks in set Fi have been processed. If yes, continue to step 308; otherwise, skip to step 303.

[0128] Step 308. At this point, all mapping records of the Bank have been organized in the order of mapping and placed into set B.

[0129] Step 309. Take the unprocessed block LBA with the smallest address from set L and calculate its corresponding Bank. Take the set of mapping records Bi for that Bank from set B.

[0130] Step 310. Retrieve the latest unprocessed mapping relation L2P for this LBA from set Bi.

[0131] Step 311. Determine whether the L2P is mapped to a valid PBA. If yes, write the L2P to the ReMapTable and jump to step 313; otherwise, continue to step 312.

[0132] Step 312. Determine whether all mapping table records in set Bi have been processed. If yes, continue to step 313; otherwise, skip to step 310.

[0133] Step 313. Determine whether all LBAs in set L have been processed. If yes, continue to step 314; otherwise, skip to step 309.

[0134] Step 314. Fill the LBA with PBA data from the ReMapTable. Proceed to step 315.

[0135] Step 315. Scan the latest data area of ​​the SSD disk to obtain the storage area set of all files, denoted as set X; skip to step 316.

[0136] Step 316. For any file storage area LBA set D in set X, retrieve all corresponding PBA sets for the elements Di.startoffset and Di.length in set ReMapTable, and fill the PBA data into the file according to the corresponding LBA order; skip to step 317.

[0137] Step 317. The SSD data recovery process is now complete.

[0138] III. Methods and Procedures for Restoring Historical Edit Records in the File System

[0139] Figure 4 A flowchart illustrating a specific embodiment of the present invention for file history recovery based on an SSD mapping table is shown, as follows: Figure 4 The specific process is as follows:

[0140] Step 401. Scan the data area corresponding to the latest mapping table of the SSD disk, parse the disk file system, obtain the set of all files X on the disk, and for any file Xi in the set, the set of its storage area LBA is D;

[0141] Step 402. Take an unprocessed element Di from set D. Calculate its Bank number, denoted as Bidx, based on Di.startoffset and Di.length;

[0142] Step 403. Determine if Bidx is already in set XB. If yes, proceed to step 405; otherwise, continue to step 404.

[0143] Step 404. Take all mapping records of Bidx from set Bi and put them into set XB.

[0144] Step 405. Have all elements in set D been processed? If yes, proceed to step 406; otherwise, skip to step 402.

[0145] Step 406. Sort the set XB according to the following rules: First sort by FSn, where larger FSn values ​​are newer and smaller FSn values ​​are older; for Banks with the same FSn, sort by PSn, where larger PSn values ​​are newer and smaller PSn values ​​are older.

[0146] Step 407. Calculate the number of elements Cnt in set XB. Then the file has Cnt historical edit records. Each Bank in the record maps to the rollback state of the data written to disk for one historical modification record of the file Di.

[0147] Step 408. Based on the different historical edit records selected by the user, replace all LBAs in the Bank to which the record belongs in the file with the LBA data in the historical records.

[0148] Step 409. At this point, the file history recovery method based on the file system and SSD mapping table is complete.

[0149] Figure 5This is a diagram illustrating the effect of data and history recovery according to a specific embodiment of the present invention. Some files are placed on an SSD, then edited and modified. The data is then recovered using the process method proposed in this patent. The effect is as follows. Figure 5 As shown, the solution of the present invention can not only realize data recovery, but also recover file editing records through mapping records.

[0150] It should be recognized that with the introduction of the TRIM command to SSDs, the mapping information between LBA and PBA is erased using the TRIM command, making it impossible for commercially available data recovery software to recover data from SSDs. Based on research into the mapping principle of SSDs and extensive experiments, this application proposes a method and apparatus for recovering deleted data and file history based on SSD mapping tables. This method can successfully recover not only file data erased by the TRIM command but also file editing records. Testing has shown that this solution can be used not only for file history recovery but also for recovering history of special data such as file system metadata and RAW source data. The results for SSD formatting recovery, file system data recovery, and even FAT file system recovery are superior to traditional data recovery methods, opening up new possibilities for data recovery.

[0151] Figure 6 A framework diagram of a data deletion and history recovery device based on an SSD mapping table according to an embodiment of the present invention is shown. The system includes a disk data reading module 601, a mapping record acquisition module 602, a data reconstruction module 603, and a history edit record recovery module 604.

[0152] In a specific embodiment, the disk data reading module 601 is configured to read all Flash blocks on the SSD used to store mapping tables, record the Flash blocks as mapping table blocks, and sort the mapping table blocks in order;

[0153] The mapping record acquisition module 602 is configured to retrieve all mapping records of all logical addresses (LBAs) on each Bank from the oldest to the newest according to the sorting order of the mapping table, thereby obtaining the mapping records of all Banks from the oldest to the newest.

[0154] The data reconstruction module 603 is configured to retrieve the latest mapping record from each Bank, reconstruct the SSD hard disk data, and use one historical mapping record from each Bank as a rollback state.

[0155] The history edit record recovery module 604 is configured to analyze the file's sector map to calculate the Bank blocks where all LBAs of the file are located when recovering the history edit records of a file. It then extracts all the Banks where the file is located and sorts the mapping records of all Bank blocks. Each mapping record corresponds to a rollback state, and the user selects the history edit record to be recovered in the rollback state.

[0156] This device reconstructs the SSD mapping table information and mapping records deleted by TRIM by analyzing the historical records of the SSD secondary mapping table. It can not only recover data, but also recover file editing records through the mapping records.

[0157] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing electronic devices according to embodiments of the present application. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0158] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0159] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a liquid crystal display (LCD) and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card and a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 710 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0160] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0161] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0162] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0163] The modules described in the embodiments of this application can be implemented in software or hardware. The described units can also be located in a processor, and the names of these units do not necessarily limit the unit itself.

[0164] Embodiments of the present invention also relate to a computer-readable storage medium storing a computer program that, when executed by a computer processor, performs the methods described above. The computer program includes program code for performing the methods shown in the flowchart. It should be noted that the computer-readable medium of this application may be a computer-readable signal medium, a computer-readable medium, or any combination of the two.

[0165] This invention reads all Flash blocks on an SSD used to store mapping tables, designating these Flash blocks as mapping table blocks, and sorts them sequentially. For each sorted mapping table block, it retrieves the mapping record stored in the latest logical address of the corresponding mapping table in the sorted order, and reconstructs the mapping table that was not erased by the TRIM instruction based on the retrieved mapping records. Deleted data is then recovered using the reconstructed mapping table. The SSD disk is rescanned to obtain the latest mapping records based on the reconstructed latest mapping table. Each obtained mapping record is recorded as one of the file's historical editing records and written to the disk data rollback state. When recovering the file's historical editing records, the user selects the desired historical editing record from the rollback state. This solution not only enables data recovery but also allows recovery of file editing records from mapping records.

[0166] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for recovering deleted data and historical records based on an SSD mapping table, characterized in that, Includes the following steps: S1: Read all Flash blocks on the SSD used to store the mapping table, and denote the Flash blocks as mapping table blocks. Sort the mapping table blocks in order, specifically including block sorting rules and page sorting rules within the same block. The block sorting rules include sorting the mapping table blocks according to the block allocation order, with larger block allocation order blocks placed first and smaller block allocation order blocks placed last. The page sorting rules within the same block include sorting the pages within the same mapping table block according to their page numbers, with larger page numbers placed first and smaller page numbers placed last. S2: According to the mapping table sorting order from old to new, retrieve all mapping records of all logical addresses (LBAs) on each Bank in the Bank, and obtain the mapping records of all Banks from old to new; S3: Take the latest mapping record from each of the Banks, reassemble the SSD hard disk data to complete the SSD hard disk data recovery, and take one historical mapping record of each of the Banks as a rollback state; S4: When restoring the historical editing records of a file, the sector map of the file is analyzed to calculate the Bank blocks where all LBAs of the file are located, all historical mapping records of all Banks where the file is located are extracted and sorted. Each mapping record corresponds to a rollback state. The user selects the historical editing record to be restored in the rollback state. S2 specifically includes: S21: Place all mapping table blocks on the SSD into set F, and read the allocation order in OOB of each mapping table block and put it into its corresponding mapping table block allocation order FSn. Sort the set F according to the block sorting rules. S22: Take out the latest unprocessed block Fi from the set F, put the mapping tables of all Banks on the latest unprocessed block Fi into the set M, and read the starting page number of each Bank mapping table in the set M and store a certain file on the disk, and sort the set M according to the page sorting rules within the same block; S23: Take out the latest unprocessed Bank mapping table from the set M and put it at the end of the mapping record of its corresponding Bank mapping table set; S24: Repeat S23 until all Bank mapping tables in set M have been processed. Repeat S22 until all mapping table blocks in set Fi have been processed. All Bank mapping records are arranged in the order of mapping and placed into the set B of all Bank mapping table mapping records. Step S3, which involves retrieving the latest mapping record from each of the Banks and reconstructing the SSD hard drive data, specifically includes: S31: Take out the unprocessed block LBA with the smallest address from the set of all LBAs of the SSD, calculate the Bank in which it belongs, and take out the set of mapping records Bi of the Bank from the set B; S32: Take the latest unprocessed mapping relationship of the unprocessed block LBA with the smallest address from the set Bi, and in response to the latest unprocessed mapping relationship being mapped to a valid physical address PBA, write the latest unprocessed mapping relationship into the reassembled mapping table; S33: Fill the physical address PBA into the logical address LBA according to the reconstructed mapping table; S34: Scan the latest data area of ​​the SSD disk, obtain the storage area set of all files, and for any file storage area LBA set in the storage area set, obtain the corresponding PBA set in the reorganized mapping table for the startoffset and length elements, and fill the PBA data into the file according to the corresponding LBA order; S4 specifically includes: S41: Take an unprocessed element from the LBA set of the file storage area, and calculate the Bank number of the element based on the startoffset and length; S42: Take out the mapping record of the Bank where the LBA of the storage area where a certain file is stored on the disk exists from set B, store it in set XB, sort set XB, and calculate the number of elements in set XB. The number of elements is the number of historical editing records of the file. Each Bank mapping in the record corresponds to a modification record of the file and writes the rollback status of the disk data. S43: Based on the different historical edit records selected by the user, replace all LBAs in the Bank to which the record belongs in the file with LBA data from the historical records.

2. The method according to claim 1, characterized in that, S42 further includes, in response to the Bank number not existing in the Bank mapping record set XB of the storage area where the LBA of a certain file is stored on the disk, taking all mapping records of the Bank number from the set Bi and putting them into the set XB; repeating S41 until all elements in the LBA set of the file storage area have been processed.

3. The method according to claim 1, characterized in that, The specific steps of sorting the set XB in S42 include: first, sorting according to the mapping table block allocation order FSn, where the larger the mapping table block allocation order FSn, the newer the block; and for Banks with the same mapping table block allocation order FSn, sorting according to the page number of the starting page where the Bank mapping table is located, where the larger page number is the newer the block, the smaller page number is the older the block.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a computer processor, the computer program performs the method according to any one of claims 1 to 3.

5. A device for recovering deleted data and historical records based on an SSD mapping table, characterized in that, include: Disk data reading module: Configured to read all Flash blocks on the SSD used to store mapping tables, and denote the Flash blocks as mapping table blocks. The mapping table blocks are sorted sequentially, specifically including block sorting rules and page sorting rules within the same block. The block sorting rules include first sorting the mapping table blocks according to their block allocation order, with larger allocation order blocks listed first and smaller allocation order blocks listed last. The page sorting rules within the same block include sorting the pages within the same mapping table block according to their page numbers, with larger page numbers listed first and smaller page numbers listed last. Mapping record acquisition module: configured to retrieve all mapping records of all logical addresses (LBAs) on each Bank in order from old to new according to the mapping table sorting order, and obtain the mapping records of all Banks from old to new; Data reconstruction module: configured to retrieve the latest mapping record from each of the Banks, reconstruct the SSD hard drive data to complete the SSD hard drive data recovery, and use one historical mapping record of each of the Banks as a rollback state; Historical Editing Record Recovery Module: Configured to analyze the sector map of the file when recovering the historical editing record of a file, calculate the Bank block where all LBAs of the file are located, extract all historical mapping records of all Banks where the file is located, and sort all the mapping records of all Banks. Each mapping record corresponds to a rollback state, and the user selects the historical editing record to be recovered in the rollback state. The mapping record retrieval module is specifically configured to execute the following methods: S21: Place all mapping table blocks on the SSD into set F, and read the allocation order in OOB of each mapping table block and put it into its corresponding mapping table block allocation order FSn. Sort the set F according to the block sorting rules. S22: Take out the latest unprocessed block Fi from the set F, put the mapping tables of all Banks on the latest unprocessed block Fi into the set M, and read the starting page number of each Bank mapping table in the set M and store a certain file on the disk, and sort the set M according to the page sorting rules within the same block; S23: Take out the latest unprocessed Bank mapping table from the set M and put it at the end of the mapping record of its corresponding Bank mapping table set; S24: Repeat S23 until all Bank mapping tables in set M have been processed. Repeat S22 until all mapping table blocks in set Fi have been processed. All Bank mapping records are arranged in the order of mapping and placed into the set B of all Bank mapping table mapping records. The data reconstruction module retrieves the latest mapping record from each of the Banks, and the reconstruction of SSD hard drive data specifically includes: Take the unprocessed block LBA with the smallest address from the set of all LBAs of the SSD, calculate the Bank in which it belongs, and take the set of mapping records Bi of the Bank from the set B; Take the latest unprocessed mapping relationship of the unprocessed block LBA with the smallest address from the set Bi, and in response to the latest unprocessed mapping relationship being mapped to a valid physical address PBA, write the latest unprocessed mapping relationship into the reassembled mapping table; According to the reconstructed mapping table, the physical address PBA is filled into the logical address LBA; Scan the latest data area of ​​the SSD disk to obtain the storage area set of all files. For the startoffset and length elements in the LBA set of any file storage area in the storage area set, obtain all corresponding PBA sets in the reorganized mapping table, and fill the PBA data into the file according to the corresponding LBA order. The historical edit record recovery module is specifically configured for: Calculate the Bank number it belongs to based on the startoffset and length elements; Take out the mapping record of the LBA of the storage area where a certain file is stored on the disk from set B, store it in set XB, sort set XB, and calculate the number of elements in set XB. The number of elements is the number of historical editing records of the file. Each Bank mapping in the record corresponds to a modification record of the file and writes the rollback status of the disk data. Based on the different historical edit records selected by the user, all LBAs in the Bank to which the record belongs in the file are replaced with LBA data from the historical records.

6. The apparatus according to claim 5, characterized in that, The specific steps for sorting the set XB are as follows: First, sort according to the allocation order FSn of the mapping table blocks, where the larger the allocation order FSn, the newer the block; for Banks with the same allocation order FSn, sort according to the page number of the starting page where the Bank mapping table is located, where the larger page number, the newer the block, the smaller the page number.

Images