A method and system for deep parsing image files

Abstract

The application discloses a kind of deep analysis method and system for mirror file, including according to the type of mirror file Configuration parsing plug-in, utilize the file node of parsing plug-in to parse the file system directory structure of mirror file;File system tree is constructed based on the file node parsed;In response to the file node to be parsed existing in file system tree, the file node to be parsed is nested mirror file, and parsing plug-in reads data according to the offset of nested mirror file in its host file to parse;File system tree and mirror file analysis configuration are stored, and target file is located according to search string, and target file is read and exported.The application can be used in electronic data forensics product or file search product, and deep analysis and nested file search can be realized.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to a method and system for deep parsing of image files. Background Technology

[0002] An image file is a file storage format that can create an image of multiple files. There are many types of image files, each with its own specific format. Common image file formats include Advanced Forensic Format (.aff), Raw Image File (.dd.001.raw.bin), DMG Image File (.dmg), Encase Image File (.e01.ex01), GHOSTE Image File (.gho), Clone CD Image File (.img.dvd), and CD / DVD Image File (.iso). Additionally, commonly used compressed archives and compound documents like Office documents can also contain internal files, just like image files. Dedicated tools can be used to create image files and read files stored within them. For example, WinRAR can be used to create and decompress common compressed files, and FTK Imager can be used to parse various types of image files. However, these tools can only parse the specified image file and do not support further parsing of other image files contained within the image file. In real-world scenarios, image files often contain image files, compressed archives, and compound documents; therefore, a method for deep parsing of image files is needed.

[0003] In existing technologies, image file parsing is based on a specific image type and cannot parse other image files nested within an existing image file. Therefore, existing technologies have the following problems:

[0004] 1. Based on specific image file types, data parsing capabilities are limited;

[0005] 2. Parsing is based on a single image file; nested image files, compressed packages, and complex documents cannot be parsed in depth.

[0006] 3. The image file types are diverse, and support for newly added image file types cannot be extended;

[0007] 4. Because the nested image files were not deeply parsed, the embedded data could not be found in the parsing results. Summary of the Invention

[0008] To address the technical problem that existing image file parsing methods are based on specific image types and cannot parse other image files nested within an image file, this invention proposes a deep parsing method and system for image files to solve the aforementioned technical problem.

[0009] According to one aspect of the present invention, a method for deep parsing of image files is proposed, comprising:

[0010] S1: Configure the parsing plugin according to the type of the image file, and use the parsing plugin to parse the file nodes of the file system directory structure of the image file;

[0011] S2: Construct a file system tree based on the parsed file nodes;

[0012] S3: In response to the existence of a file node to be parsed in the file system tree, where the file node to be parsed is a nested image file, the parsing plugin reads data and parses it based on the offset of the nested image file in its host file.

[0013] S4: Stores file system tree and image file parsing configuration, locates target files based on search strings, reads and exports target files.

[0014] In some specific embodiments, the content of a file node includes the file name, parent node pointer, file time attribute, file type, list of child node pointers, the resolution handle of the image containing the file, file size, file position in the image, or the ID of the exported file corresponding to the file.

[0015] In some specific embodiments, if the location of a file cannot be located in the image, the file in the image file is extracted to a temporary directory, a mapping table between file nodes and temporary files is established, and the ID in the mapping table is recorded in the ID field of the exported file in the file node.

[0016] In some specific embodiments, file nodes are stored by dynamically allocating memory blocks. Multiple file nodes are stored in one memory block, and the next memory block is allocated when the current block is full. This allocation method reduces the number of memory allocations and improves the speed of file node searching.

[0017] In some specific embodiments, S2 specifically involves constructing a file system tree based on the list of parent node pointers and child node pointers of the parsed file nodes.

[0018] In some specific embodiments, in S3, for nested image files that cannot be directly parsed, they are extracted to a temporary directory, parsed using a parsing plugin, and the parsed file nodes are mounted to the file nodes of the nested image file in the file system tree.

[0019] In some specific embodiments, S4 specifically includes starting multiple search threads based on the number of CPU cores, with each search thread searching for file names one by one in the memory blocks of the file nodes until all memory blocks have been searched; and reading and exporting the target file based on the image file parsing handle stored in the target file node and the file's position in the image file.

[0020] In some specific embodiments, if the target file is exported to a temporary directory, the exported temporary file is located according to the ID of the exported file, and the temporary file data is read to export and read the target file.

[0021] According to a second aspect of the present invention, a computer-readable storage medium storing one or more computer programs thereon, characterized in that the one or more computer programs, when executed by a computer processor, implement the above-described method.

[0022] According to a third aspect of the present invention, a deep parsing system for image files is proposed, the system comprising:

[0023] File node acquisition unit: Configured to configure the parsing plugin according to the type of the image file, and use the parsing plugin to parse the file nodes of the file system directory structure of the image file;

[0024] File system tree building unit: Configured to construct a file system tree based on the resolved file nodes;

[0025] Nested Image Parsing Unit: Configured to respond to the existence of a file node to be parsed in the file system tree, where the file node to be parsed is a nested image file, the parsing plugin reads data and parses it according to the offset of the nested image file in its host file;

[0026] Target file export unit: This unit is configured to store file system tree and image file parsing configurations, locate the target file based on the search string, and read and export the target file.

[0027] This invention provides a method and system for deep parsing image files, supporting the parsing of multiple image file types, nested parsing of image files, and mounting the parsing results of all image files into the same file system tree, achieving the effect of deep data parsing. This application can perform deep parsing on nested image files, compressed packages, and compound documents; it can extend support for newly added data source types; and it also supports deep parsing of non-image type compound documents. This invention can search for embedded data within the same file system tree; in some electronic data forensics products and file search products, it can perform deep parsing and searching of nested files. Attached Figure Description

[0028] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Elements in the drawings are not necessarily to scale. The same reference numerals refer to corresponding similar parts.

[0029] Figure 1 This is a flowchart of a deep parsing method for image files according to an embodiment of this application;

[0030] Figure 2 This is a flowchart of a deep parsing method for image files according to a specific embodiment of this application;

[0031] Figure 3 This is a structural diagram of each file node in a file system tree according to a specific embodiment of this application;

[0032] Figure 4 This is a schematic diagram of the deep analysis result of an image file of a specific embodiment of this application;

[0033] Figure 5 This is a framework diagram of a deep parsing system for image files according to an embodiment of this application.

[0034] Figure 6 This is a framework diagram of a multi-data source file system for deep parsing of image files, which is a specific embodiment of this application;

[0035] Figure 7 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Detailed Implementation

[0036] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0037] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0038] Figure 1 A flowchart of a deep parsing method for image files according to an embodiment of this application is shown, as follows: Figure 1 As shown, the method includes the following steps:

[0039] S101: Configure the parsing plugin according to the type of the image file, and use the parsing plugin to parse the file nodes of the file system directory structure of the image file. The content of the file node includes the file name, parent node pointer, file time attribute, file type, list of child node pointers, parsing handle of the image containing the file, file size, file position in the image or ID of the exported file corresponding to the file.

[0040] In a specific embodiment, if the location of a file cannot be located in the image, the file in the image file is extracted to a temporary directory, a mapping table between file nodes and temporary files is established, and the ID in the mapping table is recorded in the ID field of the exported file in the file node.

[0041] In a specific embodiment, file nodes are stored by dynamically allocating memory blocks. Multiple file nodes are stored in one memory block, and the next memory block is allocated when the memory block is full.

[0042] S102: Construct a file system tree based on the parsed file nodes. The file system tree is constructed based on the list of parent node pointers and child node pointers of the parsed file nodes.

[0043] S103: In response to the existence of a file node to be parsed in the file system tree, where the file node to be parsed is a nested image file, the parsing plugin reads data and parses it based on the offset of the nested image file in its host file.

[0044] S104: Stores the file system tree and image file parsing configuration, locates the target file based on the search string, and reads and exports the target file. Multiple search threads are started based on the number of CPU cores. Each search thread searches for the file name one by one, in memory blocks of the file node, until all memory blocks have been searched. The target file is read and exported based on the image file parsing handle stored in the target file node and the file's position within the image file.

[0045] In a specific embodiment, if the target file is exported to a temporary directory, the exported temporary file is located according to the ID of the exported file, and the temporary file data is read to export and read the target file.

[0046] Figure 2 A flowchart of a deep parsing method for image files according to a specific embodiment of this application is shown, such as... Figure 2 As shown, the method specifically includes the following steps:

[0047] Step 1: Configure the image file types to be parsed. This configuration includes specifying the image file types to be parsed and the required parsing plugins. The image file type is the file extension of the image file. In this step, select the image file to be parsed.

[0048] Step 2: Determine if the image file has been parsed. Based on the image parsing records generated in subsequent steps, determine if the image file has been parsed. If it has not been parsed, proceed to Step 3; otherwise, proceed to Step 8.

[0049] Step 3: Parse the image file. Use the corresponding parsing plugin to parse the image file to be parsed, and save the plugin's parsing handle for subsequent steps. The plugin parses the file system directory structure, where the contents of file nodes are as follows: Figure 3 The structure diagram of each file node in the file system tree according to a specific embodiment of this application is shown below, including file name, parent node pointer, file time attribute, file type, list of child node pointers, parsing handle of the image containing the file, file size, file position in the image, or ID of the exported file corresponding to the file. For some image file types with complex internal file structures, where the file position cannot be easily located in the image, the files in the image file are extracted to a temporary directory, and a mapping table between file nodes and temporary files is established. The IDs in the mapping table are recorded in the ID field of the exported file in the file node. Subsequent steps accessing the file nodes with the established mapping relationship are performed by reading the exported temporary files. For example, when parsing embedded images in a PDF, the images can first be released to a temporary directory, and subsequent reading of embedded images in the PDF is redirected to the images in the temporary directory.

[0050] Step 4: Construct the system file tree. A file system tree is constructed for the parsed file nodes (including those from steps 3 and 6). File nodes are stored using dynamically allocated memory blocks, with each block storing N file nodes. The next memory block is allocated only when a block is full. This allocation method reduces the number of memory allocations and improves the speed of file node searches. A file node includes the file name, file attributes, and the file's position in the image, as well as a pointer to the parent node, a queue of pointers to child nodes, and a handle to the image file used for reading the file. A file system tree is constructed for each parsed file node based on the parent-child structure. If the parsed file belongs to the image type set in step 1, the image file node is saved to the parsing queue. For example... Figure 4 The diagram shows the deep parsing result of an image file according to a specific embodiment of this application. After parsing "image file 1.iso", two embedded image files, "image file 2.dmg" and "image file 3.docx", are detected in the constructed file system tree. Therefore, these two file nodes need to be saved to the parsing queue for subsequent processing.

[0051] Step 5: Determine if the image file to be parsed exists in the file system tree. If the image file to be parsed exists as determined in Step 4, proceed to Step 6 to parse the file. If the file to be parsed does not exist, the parsing process is complete.

[0052] Step 6: Parse nested image files. The parsing plugin reads and parses data based on the offset of the nested image file within its host file. For nested image files that cannot be directly parsed, the image file can be extracted to a temporary directory, and then the parsing plugin can be used to parse the temporary file. The parsed file nodes are mounted to the file nodes of the nested image file in the file system tree via Step 4. For example... Figure 4 As shown in the example, the nested image file "image file 2.dmg" is directly mounted into the file system tree of its host file after parsing.

[0053] Step 7: Store the file system tree and image file parsing configuration. After deep parsing the image file, the file system tree in memory, the configuration information for parsing the image file in Step 1, the mapping information of the exported temporary files, and the record of the image file parsed this time are persistently saved in the save file. This allows the parsing results of the image file to be loaded directly next time, without having to parse the image file again.

[0054] Step 8: Load the file system tree and image file parsing configuration. Read the file system data stored on disk. Allocate memory blocks to store file nodes. Set the parent and child pointers in the file nodes to construct the file system tree in memory.

[0055] Step 9: Open the parsed image file. For file systems loaded directly from the disk, use the corresponding parsing plugin to open the image file opened in Steps 3 and 6, and set the handle of the opened image file to the corresponding file node. For example... Figure 4 As shown in the example of the deep parsing results of the image file, the DMG parsing plugin is used to open "image file 2.dmg" and the opened parsing handle is set to the child node directly parsed from "image file 2.dmg".

[0056] Step 10: Locate the target file based on the search string. Multiple search threads are launched based on the number of CPU cores in the computer. Each search thread searches for the file name one memory block at a time until all memory blocks have been searched. The search threads can use brute-force matching algorithms or fast matching algorithms to search for filenames. Fast matching algorithms can include the BNDM algorithm, KMP algorithm, BM algorithm, or improved versions of any of these algorithms. The path to the file can be determined from the parent pointer of each found file node.

[0057] Step 11: Read and export the target file. The target file is read and exported based on the image file resolution handle and the file's position within the image file, as stored in the target file node. For files exported to a temporary directory, the exported temporary file is located using the file's ID, and the target file is exported and read by reading the temporary file data.

[0058] Continue to refer to Figure 5 , Figure 5 A framework diagram of a deep parsing system for image files according to an embodiment of this application is shown, such as... Figure 5 As shown, the system includes a file node acquisition unit 501, a file system tree construction unit 502, a nested image parsing unit 503, and a target file export unit 504. The file node acquisition unit 501 is configured to configure a parsing plugin according to the type of the image file, and use the parsing plugin to parse the file nodes of the file system directory structure of the image file. The file system tree construction unit 502 is configured to construct a file system tree based on the parsed file nodes. The nested image parsing unit 503 is configured to, in response to the existence of file nodes to be parsed in the file system tree (where the file nodes to be parsed are nested image files), read data from the offset of the nested image file in its host file for parsing. The target file export unit 504 is configured to store the file system tree and the image file parsing configuration, locate the target file according to the search string, and read and export the target file.

[0059] In one specific embodiment Figure 6 This application illustrates a framework diagram of a multi-data source file system for deep parsing of image files, as shown in a specific embodiment. Figure 6As shown, this file system mainly includes an image file parsing and scheduling module, a file system construction and reading module, a storage module, and several image file parsing modules (the illustration includes ISO parsing, DMG parsing, PDF parsing, and OFFICE parsing modules). The image file parsing and scheduling module schedules parsing plugins for deep parsing of image files. The file system construction and reading module constructs an in-memory file system tree based on the parsing results from the plugins or from the parsing results stored in the storage module, and provides multi-threaded fast search and export functions for target files. The storage module stores the parsing results of image files and temporary files that need to be extracted and parsed during the parsing process. The image parsing module consists of various image file parsing plugins. These plugins implement standard interfaces and perform functions such as parsing image files, reading and exporting file data. The image parsing module can be extended with parsing plugins to support the parsing of more image files. Based on its support for parsing multiple image file types, this file system nests the parsing of image files containing other image files, compressed files, and compound documents, and mounts the parsing results of all image files into the same file system tree. Through this file system tree, target files can be searched, read, and exported, achieving a deep data parsing effect.

[0060] Compared with existing technologies, the deep parsing method and system for image files of this invention have the advantages of being able to perform deep parsing on nested image files, compressed packages, and compound documents; extending support for new data source types; supporting deep parsing of non-image type compound documents; and being able to search for embedded data within the same file system tree. It can be applied to some electronic data forensics products and file search products, enabling deep parsing and searching of nested files.

[0061] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0062] like Figure 7 As shown, the computer system includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for system operation. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0063] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a liquid crystal display (LCD) and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card and a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 710 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0064] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0065] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0066] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0067] The modules described in the embodiments of this application can be implemented in software or hardware. The described units can also be located in a processor; for example, a processor can be described as including a deployment unit, an instruction processing unit, and a file access unit. The names of these units do not necessarily limit the specific unit itself.

[0068] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: configure a parsing plugin according to the type of the image file; use the parsing plugin to parse file nodes of the file system directory structure of the image file; construct a file system tree based on the parsed file nodes; in response to the existence of a file node to be parsed in the file system tree, where the file node to be parsed is a nested image file, the parsing plugin reads data and parses it according to the offset of the nested image file in its host file; store the file system tree and the image file parsing configuration; locate the target file according to a search string; and read and export the target file.

[0069] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for deep parsing of image files, characterized in that, Comprise: S1: configure a parsing plug-in according to the type of the mirror file, and parse a file node of a file system directory structure of the mirror file by using the parsing plug-in; S2: construct a file system tree based on the parsed file node; S3: in response to the existence of a file node to be parsed in the file system tree, the file node to be parsed is a nested mirror file, and a parsing plug-in reads data according to the offset of the nested mirror file in its host file for parsing; For the nested mirror file that cannot be directly parsed, the temporary directory is extracted, the temporary file mirror is parsed by using the parsing plug-in, and the parsed file node is mounted under the file node of the nested mirror file in the file system tree; S4: store the file system tree and the mirror file parsing configuration, locate the target file according to the search string, read and export the target file; According to the number of CPU cores, a plurality of search threads are started, the search threads search the file name one by one in units of file node memory blocks until all memory blocks are searched; read and export the target file according to the mirror file parsing handle saved in the target file node and the position of the file in the mirror file; If the position of the file in the mirror cannot be located, the file in the mirror file is extracted to a temporary directory, a mapping table of the file node and the temporary file is established, and the ID in the mapping table is recorded in the ID field of the exported file in the file node.

2. The method for deep parsing of a mirror file according to claim 1, wherein, The content of the file node includes file name, parent node pointer, file time attribute, file type, child node pointer list, parsing handle of the mirror file where the file is located, file size, position of the file in the mirror, or ID of the exported file corresponding to the file.

3. The method for deep parsing of a mirror file according to claim 1, wherein, The file node is stored by dynamically allocating memory blocks, one memory block stores a plurality of file nodes, and the next memory block is allocated when the memory block is full.

4. The method for deep parsing of a mirror file according to claim 2, wherein, S2 is specifically constructing a file system tree according to the parent node pointer and child node pointer list of the parsed file node.

5. The method for deep parsing of a mirror file according to claim 1, wherein, If the target file is an exported file to a temporary directory, the exported temporary file is located according to the ID of the exported file corresponding to the file, and the data of the temporary file is read to export and read the target file.

6. A computer readable storage medium having stored thereon one or more computer programs. The one or more computer programs are executed by a computer processor to implement the method of any one of claims 1-5.

7. A system for deep parsing of a mirror file, the system comprising: The system comprises: A file node acquisition unit configured to configure a parsing plug-in according to the type of the mirror file, and parse a file node of a file system directory structure of the mirror file by using the parsing plug-in; A file system tree construction unit configured to construct a file system tree based on the parsed file node; The nested mirror image analysis unit is configured to, in response to the existence of a file node to be analyzed in the file system tree, the file node to be analyzed being a nested mirror image file, reading data according to the offset of the nested mirror image file in its host file to analyze the file node; for the nested mirror image file that cannot be directly analyzed, extracting the file to a temporary directory, using the analysis plug-in to analyze the temporary file mirror image, and mounting the analyzed file node to the file node of the nested mirror image file in the file system tree; The target file export unit is configured to store the file system tree and the mirror image file analysis configuration, locate the target file according to the search string, read and export the target file; start multiple search threads according to the number of CPU cores, the search threads performing file name search in units of file node memory blocks one by one until all the memory blocks are searched; read and export the target file according to the mirror image file analysis handle saved in the target file node and the position of the file in the mirror image file; if the position of the file in the mirror image cannot be located, extract the file in the mirror image file to a temporary directory, establish a mapping table of the file node and the temporary file, and record the ID in the mapping table to the ID field of the exported file in the file node.

Images