A method for recovering a damaged file encrypted by WinRAR5

Abstract

The application discloses a recovery method of damaged files encrypted by WinRAR5, which obtains effective information of file data stream through analysis and calculation, so as to recover the damaged files encrypted by WinRAR5. The effective information includes file total length, CRC32 check storage value, byte length managed by file header, compressed data mark, compressed data check, byte length of compressed data, byte number occupied by the byte length of compressed data and the like. Through the method provided by the application, the damaged files encrypted by WinRAR5 can be effectively recovered.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of electronic forensics and data recovery, and relates to a recovery method for damaged files encrypted by WinRAR5. BACKGROUND

[0002] With the popularity of computers and the Internet, compressed / encrypted files are increasingly important in data applications. WinRAR is crucial in compressed / encrypted files, especially the application of WinRAR5 version is more popular.

[0003] WinRAR is a powerful compression package manager, which is a graphical interface of the archive tool RAR in the Windows environment. The software can be used to backup data, reduce the size of email attachments, decompress RAR, ZIP and other types of files downloaded from the Internet, and can create new RAR and ZIP format compressed files. At the same time, WinRAR is the most popular compression tool, with friendly interface and convenient use, high compression rate and fast compression speed.

[0004] At the same time, WinRAR can safely encrypt files. In addition to being used to compress files, we often use WinkAR as an encryption software. Setting a password when compressing files can achieve the purpose of protecting data.

[0005] Therefore, the scene of using WinRAR5 to compress / encrypt files is increasing, and the phenomenon of data not being able to be normally opened or lost caused by incorrect operation follows. Because the structure and data of WinRAR5 compressed / encrypted files have strict integrity judgment, if the structure of the data changes, even if the password is known, the compressed / encrypted file cannot be opened through the conventional method, so that the data cannot be normally opened or lost. In the prior art, there is no method for recovering damaged files encrypted by WinRAR5, which is convenient to operate, efficient in forensics, good in display effect, and used to recover damaged files encrypted by WinRAR5. SUMMARY

[0006] In view of the deficiencies of the prior art, the present application provides a recovery method for damaged files encrypted by WinRAR5: by analyzing and calculating to obtain the effective information of the file data stream, such as the total length of the file, the CRC32 check storage value, the byte length managed by the file header, the compressed data mark, the compressed data check, the byte length of the compressed data, and the number of bytes occupied by the byte length of the compressed data, so as to recover the damaged files encrypted by WinRAR5.

[0007] The method provided by the present application comprises the following steps:

[0008] 001: obtaining the file data stream of the damaged file and obtaining the total length of the file, the file data stream further comprising a CRC32 check storage value, a file header managed byte length, a compressed data flag, a compressed data check, a byte length of compressed data, and a byte number occupied by the byte length of compressed data;

[0009] setting initial values of each variable, including setting the index, the temporary index start address, and the temporary index end address to zero respectively;

[0010] 002: judging whether the current index is less than the total length of the file, if yes, executing step 003, otherwise, ending the process;

[0011] 003: obtaining the CRC32 check storage value: according to the data structure of the file data stream compressed by WinRAR5, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the content of 4 bytes, assigning the content of the currently read 4 bytes to the CRC32 check storage value, and setting the index = index + 4;

[0012] 004: obtaining the file header managed byte length and calculating the temporary index start address and the temporary index end address: according to the data structure of the file data stream compressed by WinRAR5, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the content of each byte until the first byte with the highest bit of zero is read, calculating the number of read bytes as the variable length byte number, assigning the variable length byte number to the file header managed byte length, assigning the current index to the temporary index start address, assigning the sum of index + file header managed byte length + current variable length byte number to the temporary index end address, and assigning the sum of index + current variable length byte number to the index;

[0013] 005: obtaining the first temporary value: according to the data structure of the file data stream compressed by WinRAR5, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the byte content, the byte length of the byte content being the current variable length byte number, and assigning the sum of index + current variable length byte number to the index;

[0014] according to the data structure of the file data stream compressed by WinRAR5, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the byte content as the first temporary value, the byte length of the byte content being the current variable length byte number, and assigning the sum of index + current variable length byte number to the index;

[0015] 006: Obtain a second temporary value: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as a starting address, take the current index as an offset address, address the current offset address and sequentially read byte content as the second temporary value, the byte length of the byte content is the current variable byte number, and the sum of the index and the current variable byte number is assigned to the index;

[0016] 007: Determine whether the second temporary value is equal to the encryption information length, if yes, execute step 009, otherwise, execute step 008;

[0017] 008: index = temporary index starting address - 4 + 1, execute step 002;

[0018] 009: Perform CRC32 check and obtain a temporary CRC32 check value: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as a starting address, take the temporary index starting address as a starting address, take the temporary index ending address as an ending address, read the byte content between the temporary index starting address and the temporary index ending address and perform CRC32 check on the read byte content, and the result of the check is taken as the temporary CRC32 check value;

[0019] 00A: Determine whether the CRC32 check storage value is equal to the temporary CRC32 check value, if yes, it indicates that the checked byte content is correct data, execute step 00C, otherwise, it indicates that the checked byte content is error data, execute step 00B;

[0020] 00B: index = temporary index starting address - 4 + 1, execute step 002;

[0021] 00C: assign the temporary index ending address to the index, obtain the encryption password and decrypt the compressed data;

[0022] 00D: obtain the byte number occupied by the compressed data marker, the compressed data check and the byte length of the compressed data, and determine whether the byte number occupied by the byte length of the compressed data is equal to 3;

[0023] 00E: index = temporary index starting address - 4 + 1, execute step 002;

[0024] 00F: obtain the temporary byte length and calculate the compressed data check, and determine whether the byte number occupied by the byte length of the compressed data is equal to 0;

[0025] 010: obtain the temporary byte length and calculate the compressed data check, and determine whether the byte number occupied by the byte length of the compressed data is greater than 0;

[0026] 011: get temporary byte length, calculate compressed data check sum and byte length of compressed data;

[0027] 012: judge if the compressed data check sum is equal to the check mark, if yes, execute step 014, otherwise, execute step 013;

[0028] 013: index = index + byte length of compressed data, execute step 002;

[0029] 014: index = index + temporary index end address, execute step 002.

[0030] Preferably, step 00D comprises:

[0031] 00D1: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as the start address, take the current index as the offset address, address the current offset address and read 1 byte content as the compressed data mark, index = index + 1;

[0032] 00D2: take the first address of the file data stream as the start address, take the current index as the offset address, address the current offset address and read 1 byte content as the compressed data check sum, index = index + 1;

[0033] 00D3: the result of the compressed data mark XOR the compressed data check sum is assigned to the compressed data check sum, the result of the binary bit of the compressed data mark right shifted by 3 bits is ANDed with 0x03, and the result is taken as the byte length occupied by the compressed data;

[0034] 00D4: judge if the byte length occupied by the compressed data is equal to 3, if yes, execute step 00E, otherwise, execute step 00F.

[0035] Preferably, step 00F comprises:

[0036] 00F1: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as the start address, take the current index as the offset address, address the current offset address and read 1 byte content as the temporary byte length, index = index + 1;

[0037] 00F2: the result of the temporary byte length XOR the compressed data check sum is assigned to the compressed data check sum, the value of the temporary byte length is assigned to the byte length of the compressed data;

[0038] 00F3: judge if the byte length occupied by the compressed data is equal to 0, if yes, execute step 012, otherwise, execute step 010.

[0039] Preferably, step 010 comprises:

[0040] 0101: According to the data structure of the WinRAR5 compressed file data stream, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and index=index+1.

[0041] 0102: The result of the temporary byte length XORing the compressed data check is assigned to the compressed data check, the result of the binary bit of the temporary byte length being left shifted by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0042] 0103: It is judged whether the byte length of the compressed data occupies more than 0 bytes, if yes, step 011 is executed, otherwise, step 012 is executed.

[0043] Preferably, step 011 comprises:

[0044] 0111: According to the data structure of the WinRAR5 compressed file data stream, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and index=index+1.

[0045] 0112: The result of the temporary byte length XORing the compressed data check is assigned to the compressed data check, the result of the binary bit of the temporary byte length being left shifted by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0046] Preferably, the check mark is 0x5A.

[0047] Preferably, the encrypted information length is 0x30.

[0048] The application has the beneficial effect that the WinRAR5 encrypted damaged file can be effectively recovered. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 The flowchart of the method provided by the application is shown. DETAILED DESCRIPTION

[0050] Figure 1 The flowchart of the method provided by the application is shown. As shown in Figure 1 the method of the application comprises the following steps:

[0051] 001: Obtain the file data stream of the damaged file and obtain the total length of the file, the file data stream also includes a CRC32 check storage value, a file header managed byte length, a compressed data flag, a compressed data check, a byte length of the compressed data, and a byte number occupied by the byte length of the compressed data;

[0052] Set initial values of various variables, including assigning initial values of zero to the index, the temporary index start address, and the temporary index end address respectively;

[0053] 002: Determine whether the current index is less than the total length of the file. If yes, execute step 003, otherwise, end the process;

[0054] 003: Obtain the CRC32 check storage value: according to the data structure of the file data stream of the WinRAR5 compressed file, use the start address of the file data stream as the start address, use the current index as the offset address, address the current offset address and sequentially read the contents of 4 bytes, assign the contents of the currently read 4 bytes to the CRC32 check storage value, and index=index+4;

[0055] 004: Obtain the file header managed byte length, calculate the temporary index start address and the temporary index end address: according to the data structure of the file data stream of the WinRAR5 compressed file, use the start address of the file data stream as the start address, use the current index as the offset address, address the current offset address and sequentially read the contents of each byte until the first byte with the highest bit of zero is read, calculate the number of read bytes and use it as the variable length byte number, assign the current variable length byte number to the file header managed byte length, assign the current index to the temporary index start address, assign the sum of index+file header managed byte length+current variable length byte number to the temporary index end address, and assign the sum of index+current variable length byte number to the index;

[0056] 005: Obtain the first temporary value: according to the data structure of the file data stream of the WinRAR5 compressed file, use the start address of the file data stream as the start address, use the current index as the offset address, address the current offset address and sequentially read the byte contents, the byte length of the byte contents is the current variable length byte number, and the sum of index+current variable length byte number is assigned to the index;

[0057] According to the data structure of the file data stream of the WinRAR5 compressed file, use the start address of the file data stream as the start address, use the current index as the offset address, address the current offset address and sequentially read the byte contents as the first temporary value, the byte length of the byte contents is the current variable length byte number, and the sum of index+current variable length byte number is assigned to the index;

[0058] 006: Obtain a second temporary value: according to the data structure of the WinRAR5 compressed file data stream, the first address of the file data stream is used as a starting address, the current index is used as an offset address, the byte content at the current offset address is sequentially read as the second temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0059] 007: Determine whether the second temporary value is equal to the encryption information length 0x30. If yes, execute step 009; otherwise, execute step 008;

[0060] 008: index = temporary index starting address - 4 + 1, execute step 002;

[0061] 009: Perform CRC32 verification and obtain a temporary CRC32 verification value: according to the data structure of the WinRAR5 compressed file data stream, the first address of the file data stream is used as a starting address, the temporary index starting address is used as a starting address, and the temporary index ending address is used as an ending address, the byte content between the temporary index starting address and the temporary index ending address is read and CRC32 verification is performed on the read byte content, and the verification result is used as the temporary CRC32 verification value;

[0062] 00A: Determine whether the CRC32 verification storage value is equal to the temporary CRC32 verification value. If yes, it indicates that the verified byte content is correct data, and step 00C is executed; otherwise, it indicates that the verified byte content is error data, and step 00B is executed;

[0063] 00B: index = temporary index starting address - 4 + 1, execute step 002;

[0064] 00C: Assign the temporary index ending address to the index, obtain the encryption password, and decrypt the compressed data;

[0065] 00D: Obtain the byte number occupied by the compressed data marker, the compressed data verification, and the byte length of the compressed data, and determine whether the byte number occupied by the byte length of the compressed data is equal to 3.

[0066] Step 00D includes:

[0067] 00D1: According to the data structure of the WinRAR5 compressed file data stream, the first address of the file data stream is used as a starting address, the current index is used as an offset address, the byte content at the current offset address is read as a compressed data marker, and index = index + 1;

[0068] 00D2: using the first address of the file data stream as the start address, using the current index as the offset address, addressing the current offset address and reading 1 byte content as the compressed data check, index = index + 1;

[0069] 00D3: the result of the compressed data mark exclusive or the compressed data check is assigned to the compressed data check, the result of the binary bit of the compressed data mark right shifting 3 bits is anded with 0x03, and the result is used as the byte number occupied by the byte length of the compressed data;

[0070] 00D4: whether the byte number occupied by the byte length of the compressed data is equal to 3 is judged, if yes, step 00E is executed, otherwise, step 00F is executed.

[0071] 00F: the temporary byte length is obtained and the compressed data check is calculated, whether the byte number occupied by the byte length of the compressed data is equal to 0 is judged.

[0072] Step 00F includes:

[0073] 00F1: according to the data structure of the file data stream compressed by WinRAR5, the first address of the file data stream is used as the start address, the current index is used as the offset address, the current offset address is addressed and 1 byte content is read as the temporary byte length, index = index + 1;

[0074] 00F2: the result of the temporary byte length exclusive or the compressed data check is assigned to the compressed data check, and the value of the temporary byte length is assigned to the byte length of the compressed data;

[0075] 00F3: whether the byte number occupied by the byte length of the compressed data is equal to 0 is judged, if yes, step 012 is executed, otherwise, step 010 is executed.

[0076] 010: the temporary byte length is obtained and the compressed data check is calculated, whether the byte number occupied by the byte length of the compressed data is greater than 0 is judged.

[0077] Step 010 includes:

[0078] 0101: according to the data structure of the file data stream compressed by WinRAR5, the first address of the file data stream is used as the start address, the current index is used as the offset address, the current offset address is addressed and 1 byte content is read as the temporary byte length, index = index + 1;

[0079] 0102: the result of the temporary byte length exclusive or the compressed data check is assigned to the compressed data check, and the result of the binary bit of the temporary byte length left shifting 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data;

[0080] 0103: judge whether the byte length of the compressed data is greater than 0, if yes, execute step 011, otherwise, execute step 012.

[0081] 011: obtain the temporary byte length, calculate the compressed data check and the byte length of the compressed data.

[0082] Step 011 includes:

[0083] 0111: according to the data structure of the WinRAR5 compressed file data stream, use the first address of the file data stream as the starting address, use the current index as the offset address, address the current offset address and read 1 byte content as the temporary byte length, index = index + 1;

[0084] 0112: the result of the temporary byte length XOR the compressed data check is assigned to the compressed data check, the result of the temporary byte length left shifting 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0085] 012: judge whether the compressed data check is equal to the check mark 0x5A, if yes, execute step 014, otherwise, execute step 013;

[0086] 013: index = index + byte length of the compressed data, execute step 002;

[0087] 014: index = index + temporary index end address, execute step 002.

[0088] Through the method provided in the application, the damaged WinRAR5 compressed file can be effectively recovered.

[0089] It should be understood that the application is not limited to the above examples, and those skilled in the art can improve or change according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the application.

Claims

1. A method for recovering a damaged file encrypted with WinRAR 5, characterized by The method comprises the following steps: 001: obtaining the file data stream of the damaged file and obtaining the total length of the file, the file data stream further comprising a CRC32 check storage value, a file header managed byte length, a compressed data flag, a compressed data check, a byte length of the compressed data, and a byte number occupied by the byte length of the compressed data; setting initial values of each variable, including setting the index, the temporary index start address, and the temporary index end address to zero respectively; 002: judging whether the current index is less than the total length of the file, if yes, executing step 003, otherwise, ending the process; 003: obtaining the CRC32 check storage value: according to the data structure of the WinRAR5 compressed file data stream, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the contents of 4 bytes, assigning the read contents of 4 bytes to the CRC32 check storage value, and index=index+4; 004: obtaining the file header managed byte length, calculating the temporary index start address and the temporary index end address: according to the data structure of the WinRAR5 compressed file data stream, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the contents of each byte until the first byte with the highest bit of zero is read, calculating the read byte number as the variable length byte number, assigning the variable length byte number to the file header managed byte length, assigning the current index to the temporary index start address, assigning the sum of index+file header managed byte length+current variable length byte number to the temporary index end address, and assigning the sum of index+current variable length byte number to the index; 005: obtaining the first temporary value: according to the data structure of the WinRAR5 compressed file data stream, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the byte contents, the byte length of the byte contents being the current variable length byte number, and assigning the sum of index+current variable length byte number to the index; according to the data structure of the WinRAR5 compressed file data stream, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the byte contents as the first temporary value, the byte length of the byte contents being the current variable length byte number, and assigning the sum of index+current variable length byte number to the index; 006: obtaining the second temporary value: according to the data structure of the WinRAR5 compressed file data stream, using the start address of the file data stream as the start address and using the current index as the offset address, addressing the current offset address and sequentially reading the byte contents as the second temporary value, the byte length of the byte contents being the current variable length byte number, and assigning the sum of index+current variable length byte number to the index; 007: judging whether the second temporary value is equal to the encrypted information length, if yes, executing step 009, otherwise, executing step 008; 008: index = temporary index start address - 4 + 1, execute step 002; 009: perform CRC32 check and obtain temporary CRC32 check value: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as the start address, take the temporary index start address as the start address, take the temporary index end address as the end address, read the byte content between the temporary index start address and the temporary index end address and perform CRC32 check on the read byte content, and the result of the check is taken as the temporary CRC32 check value; 00A: determine whether the CRC32 check storage value is equal to the temporary CRC32 check value, if yes, it indicates that the checked byte content is correct data, execute step 00C, otherwise, it indicates that the checked byte content is error data, execute step 00B; 00B: index = temporary index start address - 4 + 1, execute step 002; 00C: assign the temporary index end address to the index, obtain the encryption password and decrypt the compressed data; 00D: obtain the compressed data mark, the compressed data check and the byte length of the compressed data, and determine whether the byte length of the compressed data is equal to 3; 00E: index = temporary index start address - 4 + 1, execute step 002; 00F: obtain the temporary byte length and calculate the compressed data check, and determine whether the byte length of the compressed data is equal to 0; 010: obtain the temporary byte length and calculate the compressed data check, and determine whether the byte length of the compressed data is greater than 0; 011: obtain the temporary byte length, calculate the compressed data check and the byte length of the compressed data; 012: determine whether the compressed data check is equal to the check mark, if yes, execute step 014, otherwise, execute step 013; 013: index = index + byte length of compressed data, execute step 002; 014: index = index + temporary index end address, execute step 002.

2. The method of claim 1, wherein the damaged file is encrypted by WinRAR 5. The step 00D includes: 00D1: according to the data structure of the file data stream compressed by WinRAR5, take the first address of the file data stream as the start address, take the current index as the offset address, address the current offset address and read 1 byte content as the compressed data mark, index = index + 1; 00D2: take the first address of the file data stream as the start address, take the current index as the offset address, address the current offset address and read 1 byte content as the compressed data check, index = index + 1; 00D3: the result of the XOR operation of the compressed data mark and the compressed data check is assigned to the compressed data check, and the result of the right shift of 3 bits of the binary bit of the compressed data mark is ANDed with 0x03, and the result is taken as the byte length of the compressed data; 00D4: determine whether the byte length of the compressed data is equal to 3, if yes, execute step 00E, otherwise, execute step 00F.

3. The method of claim 1, wherein the damaged file is encrypted by WinRAR 5. The step 00F includes: 00F1: According to the data structure of the file data stream compressed by WinRAR5, the first address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte content is read as the temporary byte length, index=index+1; 00F2: The result of the temporary byte length XOR compressed data check is assigned to the compressed data check, and the value of the temporary byte length is assigned to the byte length of the compressed data; 00F3: Determine whether the number of bytes occupied by the byte length of the compressed data is equal to 0, if yes, execute step 012, otherwise, execute step 010.

4. The method of claim 1, wherein the damaged file is encrypted by WinRAR 5. The step 010 includes: 0101: According to the data structure of the file data stream compressed by WinRAR5, the first address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte content is read as the temporary byte length, index=index+1; 0102: The result of the temporary byte length XOR compressed data check is assigned to the compressed data check, and the result of the binary bit left shift of the temporary byte length by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data; 0103: Determine whether the number of bytes occupied by the byte length of the compressed data is greater than 0, if yes, execute step 011, otherwise, execute step 012.

5. The method of recovering a damaged file encrypted with WinRAR 5 according to claim 1, wherein, The step 011 includes: 0111: According to the data structure of the file data stream compressed by WinRAR5, the first address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte content is read as the temporary byte length, index=index+1; 0112: The result of the temporary byte length XOR compressed data check is assigned to the compressed data check, and the result of the binary bit left shift of the temporary byte length by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

6. The method of recovering a damaged file encrypted with WinRAR 5 according to claim 1, wherein, The check mark is 0x5A.

7. The method of recovering a damaged file encrypted with WinRAR 5 according to claim 1, wherein, The encryption information length is 0x30.

Images