A method, device and storage medium for realizing local resolution of F2FS

Abstract

The application provides a method for realizing local analysis of F2FS, comprising: starting from a first data block, traversing all data blocks to check, the checking comprising: S1, judging whether the data block is a node block with a name consistent with a target name; if yes, executing S2; otherwise, executing S4; S2, analyzing and judging whether successful; if yes, executing S3; otherwise, executing S4; S3, judging whether the analyzed content meets the directory and / or file rules; if yes, determining that the analyzed directory and / or file is the required directory and / or file, and storing the analyzed directory and / or file; otherwise, executing S4; S4, jumping to the next data block, and exiting if the data block is at the end; otherwise, returning to S1. By using the above technical scheme, in the case of data loss of a file system object, only local analysis of a certain directory and / or file can be realized, and the role of F2FS analysis in electronic forensics is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electronic forensics, and in particular to a method and device for realizing F2FS analysis and a storage medium. BACKGROUND

[0002] Flash Friendly File System (F2FS) is a file system specially designed for Flash storage devices. In the prior art, there are three schemes for F2FS file system analysis:

[0003] 1. Conventional analysis scheme: taking the root directory as the entry, first analyzing the files and subdirectories under the root directory, and then recursively analyzing the subdirectories using the same rules, finally obtaining a complete file tree. This scheme depends on the root directory, and can only output the "whole tree";

[0004] 2. Fast analysis scheme: dependent on the root directory, and can specify a single directory / file output; suitable for cases where the file system is complete and a single directory / file needs to be quickly accessed, and the analysis effect of this scheme is as shown in Figure 1

[0005] 3. Deep analysis scheme: not dependent on the root directory, traversing the file system, and outputting multiple files without directory level association, but supporting classification by file type; suitable for cases where the file system is incomplete, such as root directory data loss, and the analysis effect of this scheme is as shown in Figure 2

[0006] In actual application scenarios, especially for mobile terminal chip images, the analysis is limited by the media damage risk existing in the chip extraction process, and the extracted image may have data loss such as root directory data loss or other directory data loss.

[0007] For application scenarios where there is data loss and only partial analysis of a certain directory / file is needed, the prior art has the following shortcomings:

[0008] (1) Conventional analysis and fast analysis schemes: if the parent directory data of a certain directory / file to be analyzed in actual application is lost, the above schemes cannot realize the analysis of the directory / file;

[0009] (2) Deep analysis scheme: in actual application, a certain directory usually needs to be completely analyzed, and this scheme cannot establish the directory level association of the output files, so it cannot meet this application scenario. SUMMARY

[0010] ​​Embodiments of the present application provide a method, device and storage medium for realizing partial resolution of F2FS, so as to realize partial resolution of the directory / file actually needed in the case of data loss.

[0011] To achieve the above object, in one aspect, a method for realizing partial resolution of F2FS is provided, comprising:

[0012] Starting from the first data block of F2FS, all data blocks of F2FS are traversed, and data block checking is performed on each data block, wherein the first data block is located at the start position of the main area, and the data block checking specifically comprises the following steps:

[0013] S1, judging whether the data block is a node block with the same name as the target name; if yes, step S2 is executed; otherwise, step S4 is executed;

[0014] S2, resolving the data block and judging whether the resolution is successful; if yes, step S3 is executed; otherwise, step S4 is executed;

[0015] S3, judging whether the resolved content meets the pre-set directory and / or file rule; if yes, the resolved directory and / or file is determined as the needed directory and / or file, and the resolved directory and / or file is stored; otherwise, step S4 is executed;

[0016] S4, jumping to the next data block, and if the next data block is at the tail of the main area, the process is exited; otherwise, step S1 is entered to continue data block checking on the next data block.

[0017] Preferably, the method, wherein step S1 comprises:

[0018] S11, judging whether the data block is a legal node block; if yes, step S12 is executed; otherwise, step S4 is executed;

[0019] S12, judging whether the name of the legal node block is consistent with the target name; if yes, step S2 is executed; otherwise, step S4 is executed.

[0020] Preferably, the method, wherein step S11 comprises:

[0021] S111, judging whether the value of the first two bytes of the data block meets the value range of the node block in F2FS; if yes, the data block is determined as a node block, and step S112 is continued to be executed; otherwise, step S4 is executed;

[0022] S112, determining whether the length of the directory name or file name recorded at the node block offset 0x58-0x5B exceeds the maximum length of the directory name or file name defined by F2FS; if yes, turning to step S4; otherwise, executing step S113;

[0023] S113, determining whether the creation time T1, the last access time T2 and the last modification time T3 stored at the node block offset 0x20-0x27, 0x28-0x2F, 0x30-0x37 are before the current time T0; if yes, determining that the data block is a legal node block; otherwise, determining that the data block is an illegal node block.

[0024] Preferably, the method, wherein in step S113, if it is determined that T1, T2 and T3 are before T0, the method further comprises:

[0025] S114, determining whether the node block is "0" at the specified one or more positions; if yes, determining that the node block is a legal node block; otherwise, determining that the node block is an illegal node block.

[0026] Preferably, the method, wherein the step of determining whether the node block is "0" at the specified one or more positions comprises:

[0027] Pre-setting a set LZ={lz1, lz2, lz3…lz n}, wherein lz1, lz2, lz3…lz n represent n elements in the set LZ, wherein each element in the set records the number of consecutive 0s at the pre-selected positions;

[0028] Determining whether the data in the node block satisfies the set LZ; if yes, determining that the node block is a legal node block; otherwise, determining that the node block is an illegal node block.

[0029] Preferably, the method, wherein the directory rule is set by setting a directory parameter, and the directory parameter comprises one or more of the following:

[0030] The number of subdirectories and / or files required to meet the requirements;

[0031] The corresponding directory and / or file name;

[0032] A regular expression recording the directory and / or file naming rule.

[0033] Preferably, the method, wherein the file rule is set by setting a file parameter, and the file parameter comprises one or more of the following:

[0034] The file size;

[0035] File modification time;

[0036] The header signature of the file.

[0037] Preferably, in the method, after determining that the parsed directory and / or file is the desired directory or file in step S3, the method further includes:

[0038] Rename the parsed directories and / or files;

[0039] Store the renamed directories and / or files.

[0040] On the other hand, an apparatus for implementing local parsing of F2FS is provided, including a memory and a processor, the memory storing at least one program, the at least one program being executed by the processor to implement any of the methods described above.

[0041] In another aspect, a computer-readable storage medium is provided, wherein at least one program is stored therein, the at least one program being executed by a processor to implement any of the methods described above.

[0042] The above technical solution has the following technical effects:

[0043] The technical solution of this invention can bypass the root directory or parent directory and determine the required node blocks only according to the actual directory and / or file name to be parsed and preset rules, thereby realizing the local parsing of directories and / or files.

[0044] The technical solution of this invention can be used when file system objects suffer data loss, such as when root directory data is lost or other directory data is lost. It enables partial parsing of only a specific directory / file that is needed. Furthermore, the technical solution of this invention has been successfully applied to the parsing of chip images in mobile terminals that have suffered data loss, thereby improving the role of F2FS parsing in electronic forensics. Attached Figure Description

[0045] Figure 1 This is a schematic diagram illustrating the analytical effect of a fast analytical solution using existing technologies.

[0046] Figure 2 This is a schematic diagram illustrating the analytical effect of existing deep analysis solutions.

[0047] Figure 3 This is a schematic diagram of the system area of ​​the existing F2FS technology;

[0048] Figure 4 This is a flowchart illustrating a method for implementing local parsing in F2FS according to an embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram illustrating the result of an exemplary application of the method in an embodiment of the present invention;

[0050] Figure 6 This is a schematic diagram of the device for implementing local parsing of F2FS according to an embodiment of the present invention. Detailed Implementation

[0051] To further illustrate the various embodiments, the present invention provides accompanying drawings. These drawings are part of the disclosure of the present invention, primarily used to illustrate the embodiments and to explain the operating principles of the embodiments in conjunction with the relevant descriptions in the specification. With reference to these drawings, those skilled in the art should be able to understand other possible implementations and the advantages of the present invention. Components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0052] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0053] Preparation before parsing: Read file system objects of type F2FS; file system objects can be physical storage media existing in mobile or computer terminals or image files generated by extracting storage media.

[0054] Introduction to F2FS

[0055] Basic concepts of F2FS

[0056] (1) Sector: The sector size is an integer multiple of 512 bytes; the minimum is 512 bytes, the maximum is 4096 bytes, and the default is 512 bytes.

[0057] (2) Block: The block size is a fixed 4096 bytes. A block contains one or more sectors.

[0058] (3) Segment: A segment is a continuous set of blocks, and the size of a segment is a fixed value of 2M.

[0059] (4) Node: Nodes store file metadata, including directory / file attribute information and content block number, etc.

[0060] F2FS overall structure

[0061] F2FS divides the entire file system into six regions: Super Block (SB), Checkpoint (CP), Segment Info Table (SIT), Node Address Table (NAT), Segment Summary Area (SSA), and Main Area, as detailed below. Figure 3 As shown.

[0062] (1) Super block: Occupies one segment and is located at offset 1024 bytes in the file system. The super block mainly records the size of the sector, block, segment, etc., the root directory node number (fixed value is 3), the location and size of CP, SIT, NAT, SSA, and Main Area, etc.

[0063] (2) NAT: A table recording the block addresses of all nodes in the Main Area. Each entry in the NAT is called a nat_entry, and each nat_entry contains a node number ino and the block number blo of that node in the file system. F2FS contains two copies of NAT, only one of which is currently up-to-date, denoted as NAT1, and the other as NAT2.

[0064] Conceptual assumptions

[0065] Suppose the set SD = {sd1, sd2, sd3, ..., sd...} n} represents a set of parsed directories and / or files. The set elements record: the attribute information of the directories and / or files, including the directory and / or file name, size, creation and modification time, etc.; and the content storage location information; the directory information also includes the information of subdirectories.

[0066] Traditional F2FS parsing methods require finding the root directory first; if the root directory or its critical data is missing, parsing fails. The method for partial F2FS parsing in this embodiment of the invention does not require finding the root directory. Instead, it starts from the first data block of the F2FS and traverses all data blocks, performing data block verification on each block to determine if it is a node block whose name matches the target name, thereby finding all matching targets, such as directories and / or files. The first data block is located at the beginning of the main region. This traversal bypasses the root directory and can correctly parse even with missing critical data. The target name can be a directory name or a file name, depending on the specific application scenario. The data block verification for each data block specifically includes the following steps:

[0067] S1. Determine if the data block is a node block whose name matches the target name; if so, proceed to step S2; otherwise, proceed to step S4.

[0068] S2, parse the data block and determine whether the parsing was successful; if so, proceed to step S3, otherwise proceed to step S4.

[0069] S3, determine whether the parsed content meets the pre-defined directory and / or file rules; if so, determine that the parsed directory and / or file is the required directory and / or file, and store the parsed directory and / or file; otherwise, proceed to step S4;

[0070] S4, jump to the next data block. If the next data block is at the end of the main area, exit the process; otherwise, go to step S1 and continue to perform data block verification on the next data block.

[0071] For example, storing the parsed directories and / or files as described above may be, for instance, adding the parsed directories and / or files to an SD card.

[0072] After traversing all data blocks in the main region, all parsed directories and / or files that are identified as the required directories and / or files can be displayed.

[0073] Preferably, step S1 includes:

[0074] S11, Determine if the data block is a valid node block; if so, proceed to step S12; otherwise, proceed to step S4.

[0075] S12, determine whether the name of the valid node block is consistent with the target name; if so, proceed to step S2; otherwise, proceed to step S4.

[0076] In the case of a directory that needs to be parsed, the process involves verifying whether the data block is a valid directory node block. The conditions for determining a valid node block are described exemplarily in the following specific embodiments.

[0077] Implementation 1:

[0078] Figure 4 This is a flowchart illustrating a method for implementing local parsing in F2FS according to an embodiment of the present invention. Figure 4 The method in this embodiment includes the following steps:

[0079] 1. Jump to the first data block: This data block is located at the beginning of the Main Area. See the description in the superblock for the specific block number.

[0080] 2. Verify data blocks: such asFigure 4 The specific steps for verifying a data block include determining whether it belongs to a node block and whether the name of the node block matches the target name; if so, proceed to step 3 below; otherwise, proceed to step 4 and jump to the next data block; the process for determining whether a data block belongs to a node module will be described later.

[0081] In this step, if it is known that the target is a directory, it can be determined whether the data block belongs to a directory node block and whether the name of the directory node block is the same as the target name; if so, proceed to step 3; otherwise, proceed to step 4.

[0082] 3. Parse data blocks to obtain directories and / or files.

[0083] In this step, the standard file system parsing process is followed. If the parsing is successful, it is necessary to further determine whether the parsed directories and / or files conform to the pre-defined directory and / or file rules.

[0084] The rules are set to more accurately locate target directories and / or files. Embodiments of this invention set two sets of parameters for directories and files respectively. Directory parameters are used to set rules for directories. Directory parameters include one or more of the following: the number of subdirectories and / or files that must meet the requirements; the corresponding directory and / or filenames; and a regular expression recording the naming rules for directories and / or files. An example directory rule uses the following directory parameters: 3, "abc", "123", "%[0-9A-Za-z]{10}", where parameter 3 indicates that three subdirectories or filenames must conform to the following three parameter rules. Specifically, these three parameter rules refer to: subdirectories or filenames being "abc" or "123", or subdirectories or filenames containing 10 characters, where these 10 characters can be the numbers 0-9, uppercase letters AZ, or lowercase letters az. File rules can be preset by setting file parameters. File parameters include one or more of the following: file size; file modification time; file header signature, etc. Leaving any parameter in the directory or file parameters blank indicates that no judgment is made. For WeChat directories, an exemplary directory parameter is: 1, "MicroMsg", which means that a subdirectory named MicroMsg must exist. The above example of rule setting is merely illustrative. Those skilled in the art need to set the directory parameters and / or file parameters according to the characteristics of the directories and / or files that need to be parsed, and then construct directory rules or file rules.

[0085] After successful parsing, the directory and / or file will be renamed and stored, for example, the renamed directory and / or file will be added to the SD card. The reason for renaming is that multiple directories and / or files with the same name may exist in the file system, making simultaneous display impossible. There are many ways to rename them, the goal being to ensure that the parsed directory and / or file names are different. If parsing fails in this step, no action is taken, and the process proceeds to step 4.

[0086] 4. Jump to the next data block; if the file system has reached the end of the main area at this time, the process ends, that is, all data blocks in this main area have been traversed.

[0087] 5. Skip to step 2 and continue to verify the next data block that has been entered above.

[0088] The following section provides a detailed description of the principles and processes for determining whether a data block belongs to a node block.

[0089] In F2FS, the first two bytes of a node block have a corresponding value range, which can be found in the relevant F2FS documentation. This value range is denoted as set C, where C = {c1, c2, c3…cn}. For directory node blocks, the value range of the first two bytes corresponds to a subset of C, denoted as N. Offsets 0x58 to 0x5B record the length of the directory or filename, denoted as L. The maximum length of a directory or filename defined by F2FS is denoted as L_MAX, which defaults to 255. Offsets 0x20 to 0x27, 0x28 to 0x2F, and 0x30 to 0x37 store three time values: creation time, last access time, and last modification time. These three time values ​​can be denoted as T1, T2, and T3, respectively, with the current time denoted as T0. Therefore, the inventors of this invention have discovered that a node block must satisfy the following three basic conditions:

[0090] 1. The value of the first two bytes belongs to the element of set C; if it is to determine whether a data block belongs to a directory node block, the condition is that the value of the first two bytes of the data block must belong to N;

[0091] 2. L does not exceed L_MAX;

[0092] 3. T1, T2, and T3 come before T0.

[0093] Based on these three basic conditions, some illegal node blocks can be removed.

[0094] Furthermore, in a preferred embodiment of the present invention, in order to make the judgment more accurate, after the node block or directory node block meets the above three basic conditions, a judgment can be added on whether the node block or directory node block is "0" in one or more specified positions, thereby more accurately determining the legal node block or directory node block.

[0095] In the process of implementing the present invention, the inventors discovered, through derivation and verification, that the data in F2FS node blocks exhibits certain patterns, such as a pattern in the number of consecutive "0"s at certain positions. In one embodiment, a reasonable set of values ​​LZ is pre-calculated, where LZ = {lz1, lz2, lz3…lz…} n}, where lz1, lz2, lz3…lz n It represents the n elements in the set LZ, where each element records the number of consecutive 0s at a certain position, such as a pre-selected position. The specific content can include the offset address of the position and the number of consecutive "0"s at that position.

[0096] Based on the above description, in one embodiment of the method of the present invention, the step of determining whether a data block is a valid node block includes:

[0097] S111, determine whether the values ​​of the first two bytes of the data block meet the value range of the node block in F2FS; if so, determine that the data block is a node block and continue to execute step S112; otherwise, jump to the next data block for data block verification.

[0098] S112, determine whether the length of the directory name or file name recorded at the offset of the node block from 0x58 to 0x5B exceeds the maximum length of the directory name or file name defined by F2FS; if so, jump to the next data block; otherwise, execute step S113.

[0099] S113, determine whether the creation time T1, last access time T2, and last modification time T3 stored at offsets 0x20~0x27, 0x28~0x2F, and 0x30~0x37 of the node block are before the current time T0; if so, determine that the data block is a valid node block; otherwise, determine that the data block is an invalid node block.

[0100] Preferably, in step S113, if it is determined that T1, T2, and T3 occur before T0, the method further includes the following step before determining that the data block is a valid node block:

[0101] Step S114: Determine whether the node block is "0" at one or more specified positions; if so, determine that the node block is a valid node block; otherwise, determine that the node block is an invalid node block.

[0102] Figure 5 This is an exemplary application of the method in an embodiment of the present invention. In this application scenario, a user reported a physical image of a mobile terminal. Through conventional file system parsing, the crucial "data" directory was missing, causing all applications to fail to parse. However, by utilizing the partial parsing method of this embodiment, the WeChat data package directory can be quickly obtained, thus retrieving the WeChat data needed by the user. Specifically, as shown... Figure 5 The parsed WeChat directory is com.tencent.mm, which contains 4393 files; after parsing this directory, 23482 related information entries were obtained.

[0103] Figure 5 In the example shown, the F2F2 local parsing method of this embodiment of the invention is used to parse WeChat data. Based on the characteristics of the WeChat application on Android phones, WeChat data is stored in the "com.tencent.mm" directory, so the target directory to be parsed is named "com.tencent.mm". After finding the directory node block with the target directory name "com.tencent.mm", the data in the directory is parsed out, and further, it is determined whether it is the required directory according to preset directory rules. An exemplary directory rule has a directory parameter of "1, MicroMsg", that is, checking if a subdirectory named MicroMsg exists. Other directory parameters and rules can be set according to actual needs.

[0104] In this example, existing fast parsing solutions cannot parse all subdirectories and files because the intermediate directory "data" is missing; existing deep parsing solutions obtain files without directory hierarchy, which cannot meet the parsing scenarios of mobile terminal applications; while the local parsing method of F2F2 implemented in this embodiment of the invention can still effectively parse files with directory hierarchy even in the absence of key directories, thus meeting the customer's needs.

[0105] Example 2:

[0106] The present invention also provides an apparatus for implementing local parsing of F2FS, such as... Figure 6 As shown, the device includes a processor 601, a memory 602, a bus 603, and a computer program stored in the memory 602 and executable on the processor 601. The processor 601 includes one or more processing cores. The memory 602 is connected to the processor 601 via the bus 603. The memory 602 is used to store program instructions. When the processor executes the computer program, it implements the steps in the above-described method embodiment of Embodiment 1 of the present invention.

[0107] Furthermore, as an executable solution, the device for implementing F2FS local resolution can be a computer unit, which can be a desktop computer, laptop, handheld computer, cloud server, or other computing device. The computer unit may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above-described structure of the computer unit is merely an example and does not constitute a limitation on the computer unit. It may include more or fewer components, or combine certain components, or use different components. For example, the computer unit may also include input / output devices, network access devices, buses, etc., and this embodiment of the invention does not limit this.

[0108] Furthermore, as an executable solution, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The processor is the control center of the computer unit, connecting various parts of the entire computer unit via various interfaces and lines.

[0109] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the computer unit by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0110] Example 3:

[0111] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the embodiments of the present invention.

[0112] If the modules / units integrated in the computer unit are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.

[0113] Although the invention has been specifically shown and described in conjunction with preferred embodiments, those skilled in the art should understand that various changes in form and detail may be made to the invention without departing from the spirit and scope of the invention as defined in the appended claims, all of which shall be within the scope of protection of the invention.

Claims

1. A method for implementing local parsing in F2FS, characterized in that, include: Starting with the first data block in F2FS, all data blocks in F2FS are traversed, and data block verification is performed on each data block. The first data block is located at the beginning of the main region. The data block verification specifically includes the following steps: S1, determine whether the data block is a node block whose name matches the target name; if so, proceed to step S2; otherwise, proceed to step S4. S2, parse the data block and determine whether the parsing was successful; if so, proceed to step S3, otherwise proceed to step S4; S3, determine whether the parsed content meets the pre-set directory rules and / or file rules; if so, determine that the parsed directory and / or file is the required directory and / or file, and store the parsed directory and / or file; otherwise, proceed to step S4; S4, jump to the next data block. If the next data block is at the end of the main area, exit the process; otherwise, go to step S1 and continue to perform data block verification on the next data block.

2. The method according to claim 1, characterized in that, Step S1 includes: S11, determine whether the data block is a valid node block; if so, proceed to step S12; otherwise, proceed to step S4. S12, determine whether the name of the legal node block is consistent with the target name; if so, proceed to step S2; otherwise, proceed to step S4.

3. The method according to claim 2, characterized in that, Step S11 includes: S111, determine whether the values ​​of the first two bytes of the data block meet the value range of the node block in F2FS; if so, determine that the data block is a node block and continue to execute step S112; otherwise, proceed to execute step S4. S112, determine whether the length of the directory name or file name recorded at the offset of the node block 0x58~0x5B exceeds the maximum length of the directory name or file name defined by F2FS; if so, proceed to step S4; otherwise, proceed to step S113. S113, determine whether the creation time T1, last access time T2 and last modification time T3 stored at offsets 0x20~0x27, 0x28~0x2F and 0x30~0x37 of the node block are before the current time T0; if so, determine that the data block is a valid node block; otherwise, determine that the data block is an invalid node block.

4. The method according to claim 3, characterized in that, In step S113, if it is determined that T1, T2, and T3 occur before T0, the method further includes the following step before determining that the data block is a valid node block: Step S114: Determine whether the node block is "0" at one or more specified positions; if so, determine that the node block is a valid node block; otherwise, determine that the node block is an invalid node block.

5. The method according to claim 4, characterized in that, The step of determining whether the node block is "0" at one or more specified positions includes: Pre-defined set LZ = {lz1, lz2, lz3, ... lz} n }, where lz1, lz2, lz3…lz n This represents the n elements in the set LZ, where each element records the number of consecutive 0s at a pre-selected position; Determine whether the data in the node block satisfies the set LZ; if so, determine that the node block is a valid node block; otherwise, determine that the node block is an invalid node block.

6. The method according to claim 1, characterized in that, The directory rules are set by configuring directory parameters, which include one or more of the following: The required number of subdirectories and / or files must be met; The corresponding directory and / or filename; Regular expressions that record directory and / or file naming rules.

7. The method according to claim 1, characterized in that, The file rules are set by configuring file parameters, which include one or more of the following: File size; File modification time; The header signature of the file.

8. The method according to claim 1, characterized in that, In step S3, after determining that the parsed directory and / or file is the desired directory or file, the method further includes: Rename the parsed directories and / or files; Store the renamed directories and / or files.

9. An apparatus for implementing local parsing in F2FS, characterized in that, It includes a memory and a processor, the memory storing at least one program, the at least one program being executed by the processor to implement the method as claimed in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The storage medium stores at least one program segment, which is executed by a processor to implement the method as described in any one of claims 1 to 8.

Images