A method and device for deep extraction of residual area data based on UBI image format

Abstract

This application proposes a method for deep extraction of residual area data based on the UBI image format. This method obtains normal UBIFS file system-level image data through UBI image reorganization, thereby separating the remaining residual UBI image data. Combined with the structural characteristics of UBI erase blocks and the characteristics of UBIFS file system nodes, it deeply extracts residual data during system operation, providing a basis for further data analysis and having important significance in the field of IoT forensics.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things forensics, and in particular to a method and device for deep extraction of residual area data based on the UBI image format. Background Art

[0002] As an embedded image format, UBI is also a Flash storage management system running on the MTD subsystem. It shields some Flash storage features (such as bad block management and load wear balancing) from upper layers and provides the concept of UBI volumes. It is widely used in smartphones, smart homes, embedded vehicle systems, building control systems, and other fields. With the development and popularization of Internet of Things technology, deep data extraction and recovery technology in embedded devices will continue to attract attention. Due to the characteristics of UBI's bad block management, load balancing, and garbage collection mechanisms, not all data can be fully retrieved at the file system level. Historical node information is stored in the residual area of ​​UBI, making it difficult to extract and analyze node information in the residual area of ​​UBI. Summary of the Invention

[0003] In response to the above technical problems, this application proposes a method and device for deep extraction of residual area data based on the UBI image format.

[0004] In the first aspect, the present application proposes a method for deep data extraction of residual area in UBI image format, comprising the following steps:

[0005] S1: Extract the UBI image file from the FLASH storage medium;

[0006] S2: Divide the UBI image file into multiple physical erase blocks according to the FLASH block size to form a set of PEs;

[0007] S3: Extract the 64-byte EC header and VID header data from the set PE to form a set EV;

[0008] S4: extract the latest logical erase block from the set EV to form a set LE;

[0009] S5: Sort the logical erase blocks in the set LE according to the size of the logical numbers to complete the mirror reorganization and form the set RU;

[0010] S6: Perform file system analysis on the set RU to extract relevant directory node information to form a set NF;

[0011] S7: Combine the set PE and the set LE to separate the remaining physical erase blocks that are not mapped to the set RU to form the set NPE;

[0012] S8: The set NPE is cut into pieces according to the size of a physical erase block, and then the relevant data node information is extracted according to the node characteristic parameters of the UBIFS to form the set UN;

[0013] S9: Using the relevant directory node information in the set NF, a file directory structure is constructed for the relevant data node information in the UN. The fragmented data to be parsed is extracted from the constructed file directory structure based on the data features involved in the application parsing. Preferably, the EC header and VID header data include the number of logical erase blocks (ec), the offset of the VID header (vid_hdr_offset), and the offset position of the user data LEB (data_offset).

[0014] Preferably, the main fields of the VID header include the logical erase block number lnum, the number of bytes contained in the logical erase block data_size, the CRC check data_crc of the data stored in the logical erase block, and the globally unique serial number sqnum of the logical erase block.

[0015] Preferably, the step S4 specifically includes: extracting the latest logical erase block according to the parameters extracted from the set EV according to specific rules to form a set LE, wherein the specific rules are specifically:

[0016] If there are multiple identical lnum numbers, the selection criteria for the LEB logical erase block are as follows: if the logical erase block with the larger sqnum is selected and data_crc is correct, then select the logical erase block with the larger sqnum, otherwise look for the logical erase block with the smaller sqnum.

[0017] Preferably, the relevant directory node information in S6 includes the file directory name and parent-child ID node information.

[0018] Preferably, the node characteristic parameters of the UBIFS in S8 include the node Magic value and node type of the UBIFS.

[0019] Preferably, the relevant data node information in S8 includes file directory nodes and file data nodes.

[0020] Preferably, the S9 specifically includes:

[0021] S91: Use the file directory names and parent-child node IDs in the set NF to construct the file directory structure of the relevant data node information in the set UN to form a set CF;

[0022] S92: For set CF, based on the application analysis of the set NF file directory data, the required fragmented data is further extracted from the constructed file directory structure according to the data features involved in the application analysis. The data features involved in the analysis include file directory name, keyword matching and specific data structure features.

[0023] In a second aspect, the present application also proposes a device for deep extraction of residual area data based on the UBI image format, characterized in that the device comprises:

[0024] a logical erase block extraction module configured to extract a UBI image file from a FLASH storage medium, divide the UBI image file into multiple physical erase blocks according to the block size of the FLASH to form a set PE, extract 64-byte EC header and VID header data from the set PE to form a set EV, and extract the latest logical erase block from the set EV to form a set LE;

[0025] A logical erase block directory information extraction module is configured to sort the logical erase blocks in the set LE according to the size of the logical number to complete the mirror reorganization to form a set RU, perform file system analysis on the set RU to extract relevant directory node information to form a set NF;

[0026] The residual logical block node information extraction module is configured to separate the remaining physical erase blocks that are not mapped to the set RU by combining the set PE and the set LE to form the set NPE, cut the set NPE according to the size of a physical erase block, and then extract the relevant data node information based on the node characteristic parameters of the UBIFS to form the set UN;

[0027] The fragment data parsing module is configured to construct a file directory structure of relevant data node information in the UN using the relevant directory node information in the set NF, and extract the fragment data that needs to be parsed from the constructed file directory structure according to the data features involved in the application analysis.

[0028] In a third aspect, the present application further proposes a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in the first aspect.

[0029] This application proposes a method for deep extraction of residual area data based on the UBI image format. This method obtains normal UBIFS file system-level image data through UBI image reorganization, thereby separating the remaining residual UBI image data. Combined with the structural characteristics of UBI erase blocks and the characteristics of UBIFS file system nodes, it deeply extracts residual data during system operation, providing a basis for further data analysis and having important significance in the field of IoT forensics. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present application. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0031] Figure 1 This is a flowchart of a method for deep extraction of residual area data based on the UBI image format in this application.

[0032] Figure 2 This is a schematic diagram of the UBI mirroring related structure in one embodiment of the present application.

[0033] Figure 3 It is a schematic diagram of the PEB and LEB mapping structure in one embodiment of the present application.

[0034] Figure 4 It is a schematic diagram of the PEB structure in one embodiment of the present application.

[0035] Figure 5 This is a schematic diagram of the UBIFS disk structure in one embodiment of the present application.

[0036] Figure 6 This is a schematic diagram of the LEB structure in one embodiment of the present application.

[0037] Figure 7 This is a schematic diagram of the data extraction principle in one embodiment of the present application.

[0038] Figure 8 This is a schematic diagram of the file directory structure and parsing data extraction in one embodiment of the present application.

[0039] Figure 9 It is a schematic diagram of a specific embodiment of a method for deep extraction of residual area data based on the UBI image format that can be applied to the present application.

[0040] Figure 10 This is a schematic diagram of the module structure of a device for deep extraction of residual area data based on the UBI image format in one embodiment of the present application.

[0041] Figure 11 It is a structural diagram of a computer system suitable for implementing the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0042] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0043] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0044] Figure 1 The flowchart of the present invention is a method for deep extraction of residual area data based on UBI image format, referring to Figure 1 , the method specifically comprises the following steps:

[0045] S1: Extract the UBI image file from the FLASH storage medium;

[0046] S2: Divide the UBI image file into multiple physical erase blocks according to the FLASH block size to form a set PE;

[0047] S3: Extract the 64-byte EC header and VID header data from the set PE to form a set EV;

[0048] The EC header and VID header data include the number of times the logical erase block has been erased (ec), the VID header offset (vid_hdr_offset), and the offset position (data_offset) of the user data LEB. The main fields of the VID header include the logical erase block number (lnum), the number of bytes in the logical erase block (data_size), the CRC checksum (data_crc) of the data stored in the logical erase block, and the globally unique sequence number (sqnum) of the logical erase block.

[0049] S4: extract the latest logical erase block from the set EV to form a set LE;

[0050] The S4 specifically includes: extracting the latest logical erase block according to the parameters extracted from the set EV according to specific rules to form a set LE, wherein the specific rules are specifically:

[0051] If there are multiple identical lnum numbers, the selection criteria for the LEB logical erase block are: if the logical erase block with the larger sqnum is selected and data_crc is correct, then the logical erase block with the larger sqnum is selected; otherwise,

[0052] Then look for the logical erase block with the smaller sqnum.

[0053] S5: Sort the logical erase blocks in the set LE according to the size of the logical numbers to complete the mirror reorganization and form the set RU;

[0054] S6: Perform file system analysis on the set RU to extract relevant directory node information to form a set NF;

[0055] The relevant directory node information in S6 includes the file directory name and parent-child ID node information.

[0056] S7: Combine the set PE and the set LE to separate the remaining physical erase blocks that are not mapped to the set RU to form the set NPE;

[0057] S8: The set NPE is cut into pieces according to the size of a physical erase block, and then the relevant data node information is extracted according to the node characteristic parameters of the UBIFS to form the set UN;

[0058] The node characteristic parameters of the UBIFS in S8 include the UBIFS node Magic value and node type. The relevant data node information in S8 includes the file directory node and the file data node.

[0059] S9: Use the relevant directory node information in the set NF to construct a file directory structure of the relevant data node information in the UN, and extract the fragmented data that needs to be parsed from the constructed file directory structure according to the data features involved in the application analysis.

[0060] The S9 specifically includes:

[0061] S91: Use the file directory names and parent-child node IDs in the set NF to construct the file directory structure of the relevant data node information in the set UN to form a set CF;

[0062] S92: For set CF, based on the application analysis of the set NF file directory data, the required fragmented data is further extracted from the constructed file directory structure according to the data features involved in the application analysis. The data features involved in the analysis include file directory name, keyword matching and specific data structure features.

[0063] In a specific embodiment, the method for deep extraction of residual area data based on the UBI image format disclosed in this application will be described in detail below.

[0064] Figure 2 The following figure shows a schematic diagram of the UBI image structure in one embodiment of the present application, which consists of a series of physical erase blocks called PEBs, which are blocks in real physical devices; UBIFS is the file system layer running on UBI, which consists of a series of logical erase blocks called LEBs.

[0065] like Figure 3 The figure shows the mapping structure between PEB and LEB. Due to UBI's bad block management, load balancing related to storage erase lifespan, and data deletion and garbage collection mechanisms, the mapping relationship between the UBI layer PEB and the UBIFS layer LEB is not one-to-one. The PEB is out of order relative to the LEB. For unmapped PEB blocks, historical UBIFS node data may be stored due to bad block management, garbage collection mechanisms, and load balancing.

[0066] like Figure 4 The PEB structure shown in the figure consists of a 64-byte EC header, a 64-byte VID header, and LEB data. The EC header's main fields include: the number of times the logical block has been erased (ec), the VID header's offset (vid_hdr_offset), and the user data LEB's offset (data_offset). The VID header's main fields include the LEB's logical block number (lnum), the number of bytes in the logical block (data_size), the CRC checksum (data_crc) for the data stored in the logical block, and the logical block's globally unique sequence number (sqnum). For LEBs with the same lnum, if the block with the larger sqnum and a correct data_crc, the block with the larger sqnum is selected; otherwise, the block with the smaller sqnum is selected.

[0067] like Figure 5 This is the UBIFS disk structure diagram. The UBIFS file system runs on the UBI system and is divided into six parts based on the LEB logical erase block. They are divided into superblock area, master area, journal area, LEB property tree area, orphan area, and mainarea. The superblock size is the first 4096 bytes of LEB0 (logical erase block 0), which stores parameters such as the LEB size and the hash type of the key. The master node area and backup master node area are located in LEB1 and LEB2 respectively, mainly storing the root directory location and fan-out number of the mainarea area. The mainarea stores the file system type node information and file data.

[0068] like Figure 6The following figure shows the LEB structure. Data in the UBIFS file system is stored in the LEB as nodes. UBIFS node types include ubifs_ino_node, ubifs_data_node, ubifs_dent_node, ubifs_xent_node, and ubifs_trun_node. Its structure mainly consists of a common node header structure (ubifs_ch), a node key, and other data. The common node header structure contains information such as Magic (fixed value: 0x06101831), CRC checksum, node serial number (sqnum), node length (len), and node type (node_type). The node KEY value is composed of different node types. For directory nodes (ubifs_dent_node) and file data nodes (ubifs_data_node), in addition to the node ID number of the node, the key value also stores the parent node ID (parent node ID | node type | directory name hash value). For attribute nodes and data nodes, in addition to storing attribute information and file data, the key value also stores the ID number of the file node to which they belong (file ID | node type | block number).

[0069] like Figure 7 The following is a data extraction diagram. First, the UBI image is reassembled based on parameters such as the LEB logical number lnum, the CRC checksum of the data stored on the logical block data_crc, and the globally unique serial number sqnum of the logical block. This separates the normally parsed UBIFS file system space from the remaining PEB space (not mapped to the LEB). The UBIFS file system is parsed to obtain relevant file directories, parent-child ID values, and other information. Second, based on the EC header and VID header parameter structure, the file directory node and the data node information to which the file belongs are extracted within the PEB block according to the UBIFS magic value, node type, and other parameters. Finally, a file directory is constructed in the residual PEB space based on the parent-child ID relationship between the UBIFS file directory and data node. The data nodes extracted from the residual space, which only have data nodes missing their file directory names, are further correlated with the file directory node ID and file name parameters parsed by the UBIFS file system.

[0070] like Figure 8 The figure shows a schematic diagram of the file directory structure and parsing data extraction. After the file directory node, the file data node and other node data are extracted from the PEB space that is not mapped to the LEB and combined with the file system parsing to reconstruct the file directory structure, the file directory recovered in the residual area is further deep matched and analyzed based on the file name, file content, keyword matching, specific data structure, etc. to extract the required parsing data.

[0071] The following uses a specific process for deep extraction and analysis of residual area data in the UBI image format to illustrate the solution of this application. First, the following conceptual assumptions are made:

[0072] 1) Assume that PE = {PE1, PE2, PE3, ..., PEn} represents a set of physical erase blocks PEB, where each element PEi represents a physical erase block PEB;

[0073] 2) Assume that EV = {EV1, EV2, EV3, ..., EVn} represents the set of EC headers and VID headers in the physical erase block PEB, where each EVi represents the EC header and VID header in a physical erase block, which includes the number of times the logical block has been erased ec, the offset of the vid header vid_hdr_offset, the offset position of the user data LEB data_offset, etc.; the main fields of the VID header include the logical block number lnum of the LEB, the number of bytes contained in the logical block data_size, the CRC check data_crc of the data stored in the logical block, and the globally unique serial number sqnum of the logical block, etc.;

[0074] 3) Assume that the judgment rule of CK is that if there are multiple identical logical numbers, then for the case where the lnum number is the same, the selection condition for the LEB logical block is that if the block with the larger sqnum is selected and data_crc is correct, then the block with the larger sqnum is selected; otherwise, the block with the smaller sqnum is selected.

[0075] 4) Assume that LE = {LE1, LE2, LE3, ..., LEn} represents the set of logical data blocks LEB, where each element LEi represents a logical erase block, whose content includes node data of various types in the UBIFS file system, such as ubifs_ino_node, ubifs_data_node, ubifs_dent_node, ubifs_xent_node, etc.;

[0076] 5) Assume that RU = {RU1, RU2, RU3, ..., RUn}, a set of logical erase blocks sorted from smallest to largest logical numbers;

[0077] 6) Assume that NF = {NF1, NF2, NF3, ..., NFn} represents the set of node information such as file directory, file data node information, parent and child node ID values, etc. parsed from RU;

[0078] 7) Assume that NPE = {NPE1, NPE2, NPE3, ..., NPEn} represents the set of physical erase blocks PBE separated in PE and not mapped to RU, where each NPEi represents a PBE;

[0079] 8) Assume that UN = {UN1, UN2, UN3, ..., UNn} represents the set of node information such as file directory, file data node information, parent and child node ID values ​​extracted from NPE;

[0080] 9) Assume that CF = {CF1, CF2, CF3, ..., CFn} represents the set of file directory structures reconstructed from UN;

[0081] Reference Figure 9 In a specific embodiment, the steps for deep extraction and analysis of residual area data based on the UBI image format are as follows:

[0082] Step 1: Extract the UBI image file from the FLASH storage medium, recorded as UI;

[0083] Step 2: Divide the UI image file into multiple physical erase blocks according to the FLASH block size, recorded as PE;

[0084] Step 3: Extract the 64-byte EC header and VID header data from the PE, recorded as EV;

[0085] Step 4: Extract the latest logic block according to the parameters extracted from EV and rule CK, which is recorded as LE;

[0086] Step 5: Sort the LEs by logical number to complete the image reorganization (UBIFS file system space). The reorganized image is recorded as RU.

[0087] Step 6: Perform file system analysis on the RU to extract relevant file directories, parent-child IDs and other node information, which is recorded as NF;

[0088] Step 7: Combine PE and LE to separate the remaining PE blocks that are not mapped to RU, recorded as NPE;

[0089] Step 8: Cut the NPE according to the size of a PBE, and extract the file directory node (ubifs_dent_node:), file data node (ubifs_data_node:) and other node information based on the UBIFS node Magic value, node type and other parameters, recorded as UN;

[0090] Step 9: For UN, combine the file directory name, parent and child node IDs and other node information in NF to construct the file directory structure extracted from UN, which is recorded as CF;

[0091] Step 10: Based on the application analysis of the NF file directory data, the CF further extracts the required fragmented data from the recovered file directory for analysis according to the file directory name, keyword matching, and specific data structure features (such as compressed data, custom data blocks, etc.) involved in the application analysis.

[0092] Step 11: End the process.

[0093] This application discloses a method for deep extraction of residual area data based on the UBI image format. This method obtains normal UBIFS file system level image data through UBI image reorganization, thereby separating the remaining residual UBI image data. Combining the structural characteristics of UBI erase blocks and the characteristics of UBIFS file system nodes, this method deeply extracts residual data during system operation, providing a basis for further data analysis and playing an important role in the field of embedded IoT forensics.

[0094] Further references Figure 10 As an implementation of the above-mentioned method, the present application provides an embodiment of a device for deep extraction of residual area data based on UBI image format. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0095] refer to Figure 10 , a device for deep extraction of residual area data based on UBI image format, comprising:

[0096] The logical erase block extraction module 101 is configured to extract a UBI image file from the FLASH storage medium, divide the UBI image file into multiple physical erase blocks according to the FLASH block size to form a set PE, extract the 64-byte EC header and VID header data from the set PE to form a set EV, and extract the latest logical erase block from the set EV to form a set LE;

[0097] The logical erase block directory information extraction module 102 is configured to sort the logical erase blocks in the set LE according to the size of the logical numbers to complete the mirroring and reorganize the logical erase blocks to form a set RU, perform file system analysis on the set RU to extract relevant directory node information to form a set NF;

[0098] The residual logical block node information extraction module 103 is configured to separate the remaining physical erase blocks that are not mapped to the set RU by combining the set PE and the set LE to form the set NPE, cut the set NPE according to the size of a physical erase block, and then extract relevant data node information based on the node characteristic parameters of the UBIFS to form the set UN;

[0099] The fragmented data parsing module 104 is configured to construct a file directory structure of relevant data node information in the UN using relevant directory node information in the set NF, and extract fragmented data that needs to be parsed from the constructed file directory structure according to data features involved in application parsing.

[0100] Reference below Figure 11 , which shows a structural diagram of a computer system 200 suitable for implementing an electronic device of an embodiment of the present application. Figure 11 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0101] like Figure 11 As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage unit 208 into a random access memory (RAM) 203. Various programs and data required for the operation of the system 200 are also stored in the RAM 203. The CPU 201, ROM 202, and RAM 203 are connected to each other via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0102] The following components are connected to the I / O interface 205: an input section 206 including a keyboard, a mouse, and the like; an output section 207 including a liquid crystal display (LCD) and speakers; a storage section 208 including a hard disk; and a communication section 209 including a network interface card such as a LAN card or a modem. The communication section 209 performs communication processing via a network such as the Internet. A drive 220 is also connected to the I / O interface 205 as needed. A removable medium 211, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 220 as needed, so that a computer program read therefrom can be installed in the storage section 208 as needed.

[0103] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 209, and / or installed from a removable medium 211. When the computer program is executed by the central processing unit (CPU) 201, the above-mentioned functions defined in the method of the present application are performed.

[0104] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed by the electronic device, the electronic device implements the following when executing. Figure 1 The method shown in .

[0105] It should be noted that the computer-readable storage medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, or any suitable combination thereof.

[0106] Computer program code for performing the operations of the present application can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0107] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0108] The above describes the specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0109] In the description of this application, it should be understood that the terms "upper", "lower", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limiting this application. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The simple fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used for improvement. Any reference signs in the claims should not be interpreted as limiting the scope.

Claims

1. A method for deep data extraction from residual areas of UBI image format, characterized by: The method comprises the following steps: S1: Extract the UBI image file from the FLASH storage medium; S2: Divide the UBI image file into multiple physical erase blocks according to the FLASH block size to form a set PE; S3: Extract the 64-byte EC header and VID header data from the set PE to form a set EV; wherein the main fields of the VID header include the logical erase block number lnum, the number of bytes contained in the logical erase block data_size, the CRC check data_crc of the data stored in the logical erase block, and the globally unique serial number sqnum of the logical erase block; S4: Extract the latest logical erase block according to the parameters extracted from the set EV and specific rules to form a set LE. The specific rule is as follows: if there are multiple identical lnum numbers, then the selection condition for the LEB logical erase block with the same lnum number is: if it is a logical erase block with the larger sqnum and data_crc is correct, then select sqnum If the sqnum is smaller, the erase block will be searched. S5: Sort the logical erase blocks in the set LE according to the size of the logical numbers to complete the mirror reorganization and form the set RU; S6: Perform file system analysis on the set RU to extract relevant directory node information to form a set NF; S7: Combine the set PE and the set LE to separate the remaining physical erase blocks that are not mapped to the set RU to form the set NPE; S8: The set NPE is cut into pieces according to the size of a physical erase block, and then the relevant data node information is extracted according to the node characteristic parameters of the UBIFS to form the set UN; S9: Use the relevant directory node information in the set NF to construct a file directory structure of the relevant data node information in the UN, and extract the fragmented data that needs to be parsed from the constructed file directory structure according to the data features involved in the application analysis.

2. The method for deep data extraction based on the residual area of ​​the UBI image format according to claim 1 is characterized in that: The EC header and VID header data include the number of times the logical erase block has been erased ec, the offset vid_hdr_offset of the VID header, and the offset position data_offset of the user data LEB.

3. The method for deep data extraction based on the residual area of ​​the UBI image format according to claim 1 is characterized in that: The relevant directory node information in S6 includes the file directory name and parent-child ID node information.

4. The method for deep data extraction based on the residual area of ​​the UBI image format according to claim 1 is characterized in that: The node characteristic parameters of the UBIFS in S8 include the UBIFS node Magic value and the node type.

5. The method for deep data extraction based on the residual area of ​​the UBI image format according to claim 1 is characterized in that: The relevant data node information in S8 includes file directory nodes and file data nodes.

6. The method for deep data extraction based on the residual area of ​​the UBI image format according to claim 1 is characterized in that: The S9 specifically includes: S91: Use the file directory names and parent-child node IDs in the set NF to construct the file directory structure of the relevant data node information in the set UN to form a set CF; S92: For set CF, based on the application analysis of the set NF file directory data, the required fragmented data is further extracted from the constructed file directory structure according to the data features involved in the application analysis. The data features involved in the analysis include file directory name, keyword matching and specific data structure features.

7. A device for deep extraction of residual area data based on UBI image format, characterized by: The device comprises: A logical erase block extraction module is configured to extract a UBI image file from a FLASH storage medium, divide the UBI image file into multiple physical erase blocks according to the block size of the FLASH to form a set PE, extract 64-byte EC header and VID header data from the set PE to form a set EV; wherein the main fields of the VID header include the logical erase block number lnum, the number of bytes contained in the logical erase block data_size, the CRC check data_crc of the data stored in the logical erase block, and the globally unique serial number sqnum of the logical erase block; and extract the latest logical erase block according to specific rules based on the parameters extracted from the set EV to form a set LE, wherein the specific rule is specifically: if there are multiple identical lnum numbers, then the selection condition for the LEB logical erase block when the lnum number is the same is: if it is a logical erase block with a larger sqnum and data_crc is correct, then select the logical erase block with a larger sqnum; otherwise, search for the logical erase block with a smaller sqnum; A logical erase block directory information extraction module is configured to sort the logical erase blocks in the set LE according to the size of the logical number to complete the mirror reorganization to form a set RU, perform file system analysis on the set RU to extract relevant directory node information to form a set NF; The residual logical block node information extraction module is configured to separate the remaining physical erase blocks that are not mapped to the set RU by combining the set PE and the set LE to form the set NPE, cut the set NPE according to the size of a physical erase block, and then extract the relevant data node information based on the node characteristic parameters of the UBIFS to form the set UN; The fragment data parsing module is configured to construct a file directory structure of relevant data node information in the UN using the relevant directory node information in the set NF, and extract the fragment data that needs to be parsed from the constructed file directory structure according to the data features involved in the application analysis.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images