A method for recovering a damaged file compressed by WinRAR5

Abstract

The application discloses a recovery method of damaged files compressed by WinRAR5, which obtains effective information of file data stream through analysis and calculation, so as to recover the damaged files compressed by WinRAR5. The effective information includes file total length, CRC32 check storage value, byte length managed by file header, compressed data mark, compressed data check, byte length of compressed data, byte number occupied by the byte length of compressed data and the like. Through the method provided by the application, the damaged files compressed by WinRAR5 can be effectively recovered.

Description

Technical Field

[0001] This invention belongs to the field of electronic forensics and data recovery, and relates to a method for recovering compressed and damaged files, and more particularly to a method for recovering compressed and damaged files using WinRAR5. Background Technology

[0002] With the widespread use of computers and the internet, compressed files have become increasingly important in data applications. WinRAR plays a crucial role in compressed files, especially the WinRAR 5 version, which is widely used.

[0003] WinRAR is a powerful archive manager, a graphical interface for the RAR archive utility in the Windows environment. This software can be used to back up data, reduce the size of email attachments, decompress RAR, ZIP, and other file types downloaded from the Internet, and create new RAR and ZIP archives. WinRAR is also one of the most popular compression tools, with a user-friendly interface, ease of use, high compression ratio, and fast compression speed.

[0004] Therefore, the use of WinRAR5 for file compression is increasing, leading to data loss or inability to be opened due to incorrect operation. Because WinRAR5 compressed files have strict integrity checks on their structure and data, if the data structure changes, even with the password, the compressed file cannot be opened using conventional methods, resulting in data loss or inability to be opened. Currently, there is no convenient, efficient, or effective method for recovering files damaged after compression with WinRAR5. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for recovering damaged files compressed using WinRAR5: by analyzing and calculating to obtain valid information about the file data stream, such as the total file length, CRC32 checksum storage value, byte length managed by the file header, compressed data markers, compressed data verification, byte length of compressed data, and the number of bytes occupied by the byte length of compressed data, thereby recovering damaged files compressed using WinRAR5.

[0006] The method provided by this invention includes the following steps:

[0007] 001: Obtain the file data stream of the corrupted file and obtain the total file length. The file data stream also includes the CRC32 check value, the byte length managed by the file header, the compressed data marker, the compressed data check, the byte length of the compressed data, and the number of bytes occupied by the byte length of the compressed data.

[0008] Set the initial values ​​for each variable, including setting the index, the start address of the temporary index, and the end address of the temporary index to each of the initial values ​​of zero;

[0009] 002: Determine if the current index is less than the total file length. If yes, proceed to step 003; otherwise, end the process.

[0010] 003: Obtain the CRC32 checksum storage value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, and the current index is used as the offset address. The current offset address is addressed and 4 bytes of content are read sequentially. The content of the 4 bytes read is assigned to the CRC32 checksum storage value, and the index = index + 4.

[0011] 004: Obtain the byte length managed by the file header, and calculate the start and end addresses of the temporary index: Based on the data structure of the file data stream after WinRAR5 compression, use the first address of the file data stream as the starting address, use the current index as the offset address, address the current offset address and read the contents of each byte sequentially until the first byte with the highest bit being zero is read, calculate the number of bytes read and use it as the variable-length byte count, assign the current variable-length byte count to the byte length managed by the file header, assign the current index to the start address of the temporary index, assign the sum of the index + the byte length managed by the file header + the current variable-length byte count to the end address of the temporary index, and assign the sum of the index + the current variable-length byte count to the index;

[0012] 005: Obtain the first temporary value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0013] Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the first temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0014] 006: Obtain the second temporary value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the second temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0015] 007: Determine whether the first temporary value is equal to the sum of the second temporary value and the current number of variable-length bytes. If yes, proceed to step 009; otherwise, proceed to step 008.

[0016] 008: Index = Temporary index start address - 4 + 1, execute step 002;

[0017] 009: Perform CRC32 check and obtain temporary CRC32 check value: According to the data structure of the file data stream after WinRAR5 compression, take the starting address of the file data stream as the starting address, the starting address of the temporary index as the starting address, and the ending address of the temporary index as the ending address. Read the byte content between the starting address of the temporary index and the ending address of the temporary index and perform CRC32 check on the read byte content. The result of the check is used as the temporary CRC32 check value.

[0018] 00A: Determine whether the CRC32 checksum stored value is equal to the temporary CRC32 checksum value. If yes, it means that the checked byte content is correct data, and proceed to step 00C. Otherwise, it means that the checked byte content is incorrect data, and proceed to step 00B.

[0019] 00B: Index = Temporary index start address - 4 + 1, execute step 002;

[0020] 00C: Assign the end address of the temporary index to the index;

[0021] 00D: Obtain the compressed data marker, compressed data verification, and the number of bytes occupied by the compressed data, and determine whether the number of bytes occupied by the compressed data is equal to 3;

[0022] 00E: Index = Temporary index start address - 4 + 1, execute step 002;

[0023] 00F: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data is equal to 0;

[0024] 010: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data length is greater than 0;

[0025] 011: Obtain the temporary byte length, calculate the compressed data verification and compressed data byte length;

[0026] 012: Determine if the compressed data verification is equal to the verification mark. If yes, proceed to step 014; otherwise, proceed to step 013.

[0027] 013: Index = Index + Byte length of compressed data, proceed to step 002;

[0028] 014: Index = Index + Temporary Index End Address, Execute Step 002.

[0029] Preferably, step 00D includes:

[0030] 00D1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the compressed data marker, and the index = index + 1;

[0031] 00D2: Using the starting address of the file data stream as the starting address, using the current index as the offset address, addressing the current offset address and reading 1 byte of content as compressed data verification, index = index + 1;

[0032] 00D3: The result of XORing the compressed data flag with the compressed data check is assigned to the compressed data check. The result of right-shifting the binary bits of the compressed data flag by 3 bits is ANDed with 0x03, and the result is used as the number of bytes occupied by the compressed data.

[0033] 00D4: Determine if the number of bytes occupied by the compressed data is equal to 3. If yes, proceed to step 00E; otherwise, proceed to step 00F.

[0034] Preferably, step 00F includes:

[0035] 00F1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0036] 00F2: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification, and the value of the temporary byte length is assigned to the byte length of the compressed data;

[0037] 00F3: Determine if the number of bytes occupied by the byte length of the compressed data is equal to 0. If yes, proceed to step 012; otherwise, proceed to step 010.

[0038] Preferably, step 010 includes:

[0039] 0101: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0040] 0102: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0041] 0103: Determine if the number of bytes occupied by the byte length of the compressed data is greater than 0. If yes, proceed to step 011; otherwise, proceed to step 012.

[0042] Preferably, step 011 includes:

[0043] 0111: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0044] 0112: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0045] Preferably, the verification mark is 0x5A.

[0046] The beneficial effect of this invention is that it can effectively recover damaged files compressed by WinRAR5. Attached Figure Description

[0047] Figure 1 A flowchart of the method provided by the present invention. Detailed Implementation

[0048] Figure 1 A flowchart of the method provided by this invention is shown. Figure 1 As shown, the method of the present invention includes the following steps:

[0049] 001: Obtain the file data stream of the corrupted file and the total file length. The file data stream also includes the CRC32 checksum storage value, the byte length managed by the file header, the compressed data marker, the compressed data checksum, the byte length of the compressed data, and the number of bytes occupied by the byte length of the compressed data.

[0050] Set the initial values ​​for each variable, including setting the index, the start address of the temporary index, and the end address of the temporary index to each of the initial values ​​of zero;

[0051] 002: Determine if the current index is less than the total file length. If yes, proceed to step 003; otherwise, end the process.

[0052] 003: Obtain the CRC32 checksum storage value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, and the current index is used as the offset address. The current offset address is addressed and 4 bytes of content are read sequentially. The content of the 4 bytes read is assigned to the CRC32 checksum storage value, and the index = index + 4.

[0053] 004: Obtain the byte length managed by the file header, calculate the start address and end address of the temporary index: Based on the data structure of the file data stream after WinRAR5 compression, use the first address of the file data stream as the starting address, use the current index as the offset address, address the current offset address and read the contents of each byte sequentially until the first byte with the highest bit being zero is read, calculate the number of bytes read and use it as the variable-length byte count, assign the current variable-length byte count to the byte length managed by the file header, assign the current index to the start address of the temporary index, assign the sum of the index + the byte length managed by the file header + the current variable-length byte count to the end address of the temporary index, and assign the sum of the index + the current variable-length byte count to the index;

[0054] 005: Get the first temporary value: Based on the data structure of the file data stream after WinRAR5 compression, use the starting address of the file data stream as the starting address, use the current index as the offset address, address the current offset address and read the byte content sequentially. The byte length of the byte content is the current variable length byte number. Assign the sum of the index and the current variable length byte number to the index.

[0055] Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the first temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0056] 006: Obtain the second temporary value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the second temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index;

[0057] 007: Determine whether the first temporary value is equal to the sum of the second temporary value and the current number of variable-length bytes. If yes, proceed to step 009; otherwise, proceed to step 008.

[0058] 008: Index = Temporary index start address - 4 + 1, execute step 002;

[0059] 009: Perform CRC32 check and obtain temporary CRC32 check value: Based on the data structure of the file data stream after WinRAR5 compression, use the starting address of the file data stream as the starting address, the starting address of the temporary index as the starting address, and the ending address of the temporary index as the ending address. Read the byte content between the starting address of the temporary index and the ending address of the temporary index and perform CRC32 check on the read byte content. The result of the check is used as the temporary CRC32 check value.

[0060] 00A: Determine whether the CRC32 checksum stored value is equal to the temporary CRC32 checksum value. If yes, it means that the checked byte content is correct data, and proceed to step 00C. Otherwise, it means that the checked byte content is incorrect data, and proceed to step 00B.

[0061] 00B: Index = Temporary index start address - 4 + 1, execute step 002;

[0062] 00C: Assign the end address of the temporary index to the index;

[0063] 00D: Get the compressed data marker, compressed data verification, and the number of bytes occupied by the compressed data, and determine whether the number of bytes occupied by the compressed data is equal to 3.

[0064] Step 00D includes:

[0065] 00D1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the compressed data marker, and the index = index + 1;

[0066] 00D2: Uses the starting address of the file data stream as the starting address, uses the current index as the offset address, addresses the current offset address and reads 1 byte of content as compressed data verification, and the index = index + 1;

[0067] 00D3: The result of XORing the compressed data flag with the compressed data check is assigned to the compressed data check. The result of right-shifting the binary bits of the compressed data flag by 3 bits is ANDed with 0x03, and the result is used as the number of bytes occupied by the compressed data.

[0068] 00D4: Determine if the number of bytes occupied by the compressed data is equal to 3. If yes, proceed to step 00E; otherwise, proceed to step 00F.

[0069] 00F: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data byte length is equal to 0.

[0070] Step 00F includes:

[0071] 00F1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0072] 00F2: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification, and the value of the temporary byte length is assigned to the byte length of the compressed data;

[0073] 00F3: Determine if the number of bytes occupied by the byte length of the compressed data is equal to 0. If yes, proceed to step 012; otherwise, proceed to step 010.

[0074] 010: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data byte length is greater than 0.

[0075] Step 010 includes:

[0076] 0101: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0077] 0102: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0078] 0103: Determine if the number of bytes occupied by the byte length of the compressed data is greater than 0. If yes, proceed to step 011; otherwise, proceed to step 012.

[0079] 011: Get the length of the temporary bytes, calculate the verification of compressed data and the byte length of compressed data.

[0080] Step 011 includes:

[0081] 0111: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1;

[0082] 0112: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

[0083] 012: Determine if the compressed data verification is equal to the verification flag 0x5A. If yes, proceed to step 014; otherwise, proceed to step 013.

[0084] 013: Index = Index + Byte length of compressed data, proceed to step 002;

[0085] 014: Index = Index + Temporary Index End Address, Execute Step 002.

[0086] The method provided in this invention application can effectively recover damaged files compressed with WinRAR5.

[0087] It should be understood that the present invention is not limited to the examples described above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for recovering damaged files compressed using WinRAR5, characterized in that... Includes the following steps: 001: Obtain the file data stream of the corrupted file and obtain the total file length. The file data stream also includes the CRC32 check value, the byte length managed by the file header, the compressed data marker, the compressed data check, the byte length of the compressed data, and the number of bytes occupied by the byte length of the compressed data. Set the initial values ​​for each variable, including setting the index, the start address of the temporary index, and the end address of the temporary index to each of the initial values ​​of zero; 002: Determine if the current index is less than the total file length. If yes, proceed to step 003; otherwise, end the process. 003: Obtain the CRC32 checksum storage value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, and the current index is used as the offset address. The current offset address is addressed and 4 bytes of content are read sequentially. The content of the 4 bytes read is assigned to the CRC32 checksum storage value, and the index = index + 4. 004: Obtain the byte length managed by the file header, and calculate the start and end addresses of the temporary index: Based on the data structure of the file data stream after WinRAR5 compression, use the first address of the file data stream as the starting address, use the current index as the offset address, address the current offset address and read the contents of each byte sequentially until the first byte with the highest bit being zero is read, calculate the number of bytes read and use it as the variable-length byte count, assign the current variable-length byte count to the byte length managed by the file header, assign the current index to the start address of the temporary index, assign the sum of the index + the byte length managed by the file header + the current variable-length byte count to the end address of the temporary index, and assign the sum of the index + the current variable-length byte count to the index; 005: Obtain the first temporary value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index; Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the first temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index; 006: Obtain the second temporary value: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and the byte content is read sequentially as the second temporary value, the byte length of the byte content is the current variable length byte number, and the sum of the index and the current variable length byte number is assigned to the index; 007: Determine whether the first temporary value is equal to the sum of the second temporary value and the current number of variable-length bytes. If yes, proceed to step 009; otherwise, proceed to step 008. 008: Index = Temporary index start address - 4 + 1, execute step 002; 009: Perform CRC32 check and obtain temporary CRC32 check value: According to the data structure of the file data stream after WinRAR5 compression, take the starting address of the file data stream as the starting address, the starting address of the temporary index as the starting address, and the ending address of the temporary index as the ending address. Read the byte content between the starting address of the temporary index and the ending address of the temporary index and perform CRC32 check on the read byte content. The result of the check is used as the temporary CRC32 check value. 00A: Determine whether the CRC32 checksum stored value is equal to the temporary CRC32 checksum value. If yes, it means that the checked byte content is correct data, and proceed to step 00C. Otherwise, it means that the checked byte content is incorrect data, and proceed to step 00B. 00B: Index = Temporary index start address - 4 + 1, execute step 002; 00C: Assign the end address of the temporary index to the index; 00D: Obtain the compressed data marker, compressed data verification, and the number of bytes occupied by the compressed data, and determine whether the number of bytes occupied by the compressed data is equal to 3; 00E: Index = Temporary index start address - 4 + 1, execute step 002; 00F: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data is equal to 0; 010: Obtain the temporary byte length and calculate the compressed data checksum, and determine whether the number of bytes occupied by the compressed data length is greater than 0; 011: Obtain the temporary byte length, calculate the compressed data verification and compressed data byte length; 012: Determine if the compressed data verification is equal to the verification mark. If yes, proceed to step 014; otherwise, proceed to step 013. 013: Index = Index + Byte length of compressed data, proceed to step 002; 014: Index = Index + Temporary Index End Address, Execute Step 002.

2. The method for recovering damaged files compressed using WinRAR5 according to claim 1, characterized in that, The step 00D includes: 00D1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the compressed data marker, and the index = index + 1; 00D2: Using the starting address of the file data stream as the starting address, using the current index as the offset address, addressing the current offset address and reading 1 byte of content as compressed data verification, index = index + 1; 00D3: The result of XORing the compressed data flag with the compressed data check is assigned to the compressed data check. The result of right-shifting the binary bits of the compressed data flag by 3 bits is ANDed with 0x03, and the result is used as the number of bytes occupied by the compressed data. 00D4: Determine if the number of bytes occupied by the compressed data is equal to 3. If yes, proceed to step 00E; otherwise, proceed to step 00F.

3. The method for recovering damaged files compressed using WinRAR5 according to claim 1, characterized in that, The step 00F includes: 00F1: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1; 00F2: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification, and the value of the temporary byte length is assigned to the byte length of the compressed data; 00F3: Determine if the number of bytes occupied by the byte length of the compressed data is equal to 0. If yes, proceed to step 012; otherwise, proceed to step 010.

4. The method for recovering damaged files compressed using WinRAR5 according to claim 1, characterized in that, Step 010 includes: 0101: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1; 0102: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data. 0103: Determine if the number of bytes occupied by the byte length of the compressed data is greater than 0. If yes, proceed to step 011; otherwise, proceed to step 012.

5. The method for recovering damaged files compressed using WinRAR5 according to claim 1, characterized in that, Step 011 includes: 0111: Based on the data structure of the file data stream after WinRAR5 compression, the starting address of the file data stream is used as the starting address, the current index is used as the offset address, the current offset address is addressed and 1 byte of content is read as the temporary byte length, and the index = index + 1; 0112: The result of XORing the temporary byte length with the compressed data verification is assigned to the compressed data verification. The result of shifting the binary bits of the temporary byte length left by 8 bits is added to the byte length of the compressed data, and the sum is assigned to the byte length of the compressed data.

6. The method for recovering damaged files compressed using WinRAR5 according to claim 1, characterized in that, The verification mark is 0x5A.

Images