Method for acquiring secondary decoding table by adopting data of 190 modules

Abstract

The invention discloses a method for acquiring a secondary decoding table by adopting data of 190 modules. The method is characterized by comprising the following steps: S100, acquiring the secondary decoding table by adopting three-level information storage of a western digital hard disk; s200, judging whether the obtained secondary decoding table is complete or not, if yes, ending the process, and if not, executing the step S400; s300, acquiring data of a 190 module; s400, obtaining three-level information storage in the 190 module; s500, analyzing the obtained third-level information storage, and obtaining a temporary dynamic array and an output buffer area; and S600, obtaining a secondary decoding table in the 190 module data.

Description

Technical Field

[0001] The invention belongs to the field of electronic data and data recovery and evidence collection, and relates to a method for obtaining a secondary decoding table by using data from a 190 module. Background Art

[0002] Western Digital (WD), full name Western Digital, is a hard disk product produced by Western Digital Corp., an American company. Western Digital is one of the world's leading hard disk manufacturers. It was founded in 1970 and began to design and produce hard disks in 1988. The company is headquartered in Lake Forest, California, USA. It is one of the oldest hard disk manufacturers and one of the founders of the IDE interface.

[0003] Western Digital's hard drive product line covers enterprise servers, desktop IDE hard drives, mobile storage applications, AV fields, etc. According to statistics, the global mechanical hard drive shipments and market share in the first quarter of 2024 are:

[0004] Global mechanical hard drive shipments: In the first quarter of 2024, global mechanical hard drive shipments reached 29.7 million units, a 3% increase from the previous quarter.

[0005] Western Digital (WD) market share: Based on shipments, Western Digital accounted for 39.5% of the entire market in the first quarter, ranking first.

[0006] The failure rate of Western Digital hard drives is relatively low, which is mainly due to its good manufacturing process, high-quality product design and technological innovation. However, when a Western Digital hard drive fails, how to recover the data of the Western Digital hard drive is a long-term technical problem. Among them, obtaining the TIS (Tertiary Information Store) of the Western Digital hard drive and obtaining the secondary decoding table is one of the important methods to recover the data of the Western Digital hard drive.

[0007] Because the secondary decoding table (T2 for short) is used to record the physical location (head, cylinder, sector) corresponding to the LBA (logical block address), that is, to achieve the conversion between logical address and physical address. This module plays a key role in the hard disk, because the hard disk needs to know the actual physical location corresponding to the logical address when reading and writing data.

[0008] However, in the prior art, when obtaining the secondary decoding table (i.e., module 190) through TIS (Tertiary Information Store), there are many deficiencies and technical problems, which are reflected in:

[0009] 1. Complexity of TIS data access

[0010] 2. Difficulties in analyzing TIS data

[0011] 3. Complexity of the secondary decoding table (190 modules)

[0012] 4. Limitations of Technology and Tools

[0013] 5. Cost issues caused by paid software

[0014] The invention application entitled "A method for obtaining a secondary decoding table through three-level information storage", application number 202410728504.9, and application date June 6, 2024 discloses a method of using instructions to read a secondary decoding table and using three-level information storage to obtain a secondary decoding table, which solves the above technical problems. However, in some cases, the invention application still cannot obtain a complete secondary decoding table, resulting in the inability to recover the data of the Western Digital hard drive. Summary of the invention

[0015] The present invention aims at the deficiencies of the prior art and provides a method for obtaining a secondary decoding table using data from a 190 module: by obtaining data from the 190 module and obtaining the third-level information storage in the 190 module; further fully and efficiently obtaining the secondary decoding table with low cost, high accuracy and sustainability to achieve data recovery of a Western Digital hard disk, including the following steps:

[0016] S100: using the third-level information storage of the Western Digital hard disk to obtain the second-level decoding table;

[0017] S200: Determine whether the obtained secondary decoding table is complete, if yes, end the process, otherwise, execute step S400;

[0018] S300: Obtain data of module 190;

[0019] S400: Acquire the third-level information storage in the 190 module;

[0020] S500: parsing the acquired three-level information storage, acquiring a temporary dynamic array and an output buffer;

[0021] S600: Obtain the secondary decoding table in the 190 module data.

[0022] Preferably, step S400 includes the following steps:

[0023] S401: traverse all sectors of the 190 module in units of sectors, and determine whether the first 4 bytes of each sector are 0x534954. If yes, execute step S402. Otherwise, repeat step S401 and traverse the next sector.

[0024] S402: multiply the current sector value by the sector size and save the product as an offset to the first item of data in the first dynamic array;

[0025] S403: Determine whether the number of sub-item data in the first dynamic array is 0, if yes, end the process, otherwise, execute step S404;

[0026] S404: Obtaining the offset of the third-level information stored in the data of the 190 module: obtaining the offset stored in the first item of the first dynamic array as the offset of the third-level information stored in the data of the 190 module;

[0027] S405: Obtain the byte length of the third-level information storage: take the first address of the data in module 190 as the starting address, take the sum of the offset of the third-level information storage in the data in module 190 plus 0x200 as the offset, address and obtain the content of continuous 0x28 bytes as the metadata header;

[0028] Read the value of the block number field in the metadata header, multiply it by 0xC, and add the sum of 0x228 as the byte length of the third-level information storage;

[0029] S406: Using the first address of the 190 module data as the starting address and the offset of the third-level information stored in the 190 module data as the offset, address and obtain the byte content as the third-level information storage, wherein the byte length of the obtained byte is the byte length of the third-level information storage.

[0030] Preferably, step S600 includes the following steps:

[0031] S601: The number of sub-item data is initialized to 0;

[0032] S602: Determine whether the current number of sub-item data is less than the number of sub-item data in the temporary dynamic array, if yes, execute step S603, otherwise, execute step S606;

[0033] S603: Taking the current number of sub-item data as an index, fetching the sub-item data of the B-tree mapping item corresponding to the index from the temporary dynamic array;

[0034] S604: Obtain the secondary decoding table in the 190 module data according to the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index;

[0035] S605: the number of sub-item data is incremented by 1, and step S602 is executed;

[0036] S606: Obtain data in the output buffer as a secondary decoding table.

[0037] Preferably, step S604 includes the following steps:

[0038] S6041: Determine whether the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index is not equal to 0 and is less than the number of sectors of the 190 module data. If so, execute step S6042; otherwise, execute step S605;

[0039] S6042: Get the secondary decoding table: take the first address of the 190 module data as the starting address, take the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index multiplied by 0x200 as the offset, address and obtain the content of consecutive bytes, wherein the byte length of the obtained byte content is equal to the value of the block size field in the metadata header, the obtained byte content is saved to the output buffer, and the saved address is the product of the value of the block size field in the metadata header multiplied by the number of sub-item data.

[0040] The beneficial effects of the present invention are: in addition to solving the technical problems in the prior art such as the complexity of TIS data access, the difficulty of TIS data parsing, the complexity of the secondary decoding table (190 modules), the limitations of technology and tools, and the cost issues caused by paid software, it also solves the technical problem that the technical solution provided in the invention application entitled "A method for obtaining a secondary decoding table through three-level information storage", application number 202410728504.9, and application date June 6, 2024 cannot obtain a complete secondary decoding table in some cases. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is the overall flow chart of the present invention;

[0042] Figure 2 A flowchart for obtaining the three-level information storage in module 190 in an embodiment of the present invention;

[0043] Figure 3 It is a flowchart of obtaining the secondary decoding table in the 190 module data in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The terms that may be used in the present invention are as follows:

[0045] 190 module of Western Digital hard disk: It contains the data of the secondary decoding table (T2 for short), which is used to record the physical location (head, cylinder, sector) corresponding to the LBA (logical block address), that is, to realize the conversion between logical address and physical address. This module plays a key role in the hard disk, because when the hard disk reads and writes data, it needs to know the actual physical location corresponding to the logical address.

[0046] T2 (secondary decoding table) of 190 module in Western Digital hard disk:

[0047] Its main function is to record the physical location (head, cylinder, sector) corresponding to the LBA (logical block address), that is, to realize the conversion between logical address and physical address.

[0048] SCT Commands:

[0049] It is the abbreviation of SMART Command Transport and is used in combination with ATA standard commands to communicate with devices.

[0050] TIS: Tertiary Information Store, usually refers to the different levels in the storage system, used to solve the contradiction between storage speed, capacity and price.

[0051] This application incorporates the entire contents of the invention application entitled "A method for obtaining a secondary decoding table through three-level information storage", application number 202410728504.9, and application date June 6, 2024 into this invention application by reference.

[0052] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0053] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0054] S100: using the tertiary information storage (TIS) of the Western Digital hard disk to obtain the secondary decoding table (T2);

[0055] S200: Determine whether the obtained secondary decoding table (T2) is complete, if so, end the process, otherwise, execute step S400;

[0056] S300: Obtain data of module 190;

[0057] S400: Acquire the tertiary information storage (TIS) in the 190 module.

[0058] Figure 2 FIG. 1 shows a flow chart of obtaining the tertiary information storage (TIS) in the 190 module in an embodiment of the present invention. Figure 2 As shown, step S400 includes the following steps:

[0059] S401: traverse all sectors of the 190 module in units of sectors, and determine whether the first 4 bytes of each sector are 0x534954. If yes, execute step S402. Otherwise, repeat step S401 and traverse the next sector.

[0060] S402: multiply the current sector value by the sector size and save the product as an offset to the first item of data in the first dynamic array;

[0061] S403: Determine whether the number of sub-item data in the first dynamic array is 0, if yes, end the process, otherwise, execute step S404;

[0062] S404: Obtaining the offset of the tertiary information storage (TIS) in the data of the 190 module: obtaining the offset stored in the first item of data of the first dynamic array as the offset of the tertiary information storage (TIS) in the data of the 190 module;

[0063] S405: Get the byte length of the tertiary information storage (TIS): take the first address of the data of module 190 as the starting address, take the offset of the tertiary information storage (TIS) in the data of module 190 plus 0x200 as the offset, address and get the content of continuous 0x28 bytes as the metadata header (MetaHeader);

[0064] Read the value of the NumClients field in the MetaHeader, multiply it by 0xC, and add it to 0x228 as the byte length of the Tier 3 Information Store (TIS);

[0065] S406: Using the first address of the 190 module data as the starting address and the offset of the tertiary information storage (TIS) in the 190 module data as the offset, address and obtain the byte content as the tertiary information storage (TIS), wherein the byte length of the obtained byte is the byte length of the tertiary information storage (TIS).

[0066] S500: parsing the acquired tertiary information storage (TIS), acquiring a temporary dynamic array and an output buffer;

[0067] S600: Obtain the secondary decoding table (T2) in the 190 module data.

[0068] Figure 3 A flow chart of obtaining the secondary decoding table (T2) in the 190 module data in an embodiment of the present invention is shown.

[0069] like Figure 3 As shown, step S600 includes the following steps:

[0070] S601: The number of sub-item data is initialized to 0;

[0071] S602: Determine whether the current number of sub-item data is less than the number of sub-item data in the temporary dynamic array, if yes, execute step S603, otherwise, execute step S606;

[0072] S603: Taking the current number of sub-item data as an index, taking out the sub-item data of the BtreeMapItem corresponding to the index from the temporary dynamic array;

[0073] S604: According to the value of the sector offset (SecOffset) field in the sub-item data of the B-tree mapping item (BtreeMapItem) corresponding to the index, obtain the secondary decoding table (T2) in the 190 module data; step S604 includes the following steps:

[0074] S6041: Determine whether the value of the sector offset (SecOffset) field in the sub-item data of the B-tree map item (BtreeMapItem) corresponding to the index is not equal to 0 and is less than the number of sectors of the 190 module data. If so, execute step S6042; otherwise, execute step S605;

[0075] S6042: Get the secondary decoding table (T2): take the first address of the 190 module data as the starting address, take the value of the sector offset (SecOffset) field in the sub-item data of the B-tree mapping item (BtreeMapItem) corresponding to the index multiplied by 0x200 as the offset, address and obtain the content of consecutive bytes, wherein the byte length of the obtained byte content is equal to the value of the block size field in the metadata header (MetaHeader), the obtained byte content is saved to the output buffer, and the saved address is the product of the value of the block size field in the metadata header (MetaHeader) multiplied by the number of sub-item data.

[0076] S605: the number of sub-item data is incremented by 1, and step S602 is executed;

[0077] S606: Obtain data in the output buffer as a secondary decoding table (T2).

[0078] After obtaining the secondary decoding table (T2), the conversion between logical address and physical address can be realized, thereby recovering the data of the Western Digital hard drive.

[0079] The method provided by the present invention solves technical problems such as the complexity of TIS data access, the difficulty of TIS data parsing, the complexity of the secondary decoding table (190 modules), the limitations of technology and tools, and the cost problems caused by paid software in the prior art. In addition, the method also solves the technical problem that the technical solution provided in the invention application entitled "A method for obtaining a secondary decoding table through three-level information storage", application number 202410728504.9, and application date June 6, 2024, cannot obtain a complete secondary decoding table in some cases.

[0080] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for obtaining a secondary decoding table using data from module 190, characterized in that The following steps are involved: S100: using the third-level information storage of the Western Digital hard disk to obtain the second-level decoding table; S200: Determine whether the obtained secondary decoding table is complete, if yes, end the process, otherwise, execute step S400; S300: Obtain data of module 190; S400: Acquire the third-level information storage in the 190 module; S5 00: parse the obtained three-level information storage, obtain the temporary dynamic array and output buffer; S600: Obtain the secondary decoding table in the 190 module data.

2. A method for obtaining a secondary decoding table using data from module 190 according to claim 1, characterized in that: Step S400 includes the following steps: S401: traverse all sectors of the 190 module in units of sectors, and determine whether the first 4 bytes of each sector are 0x534954. If yes, execute step S402. Otherwise, repeat step S401 and traverse the next sector. S402: multiply the current sector value by the sector size and save the product as an offset to the first item of data in the first dynamic array; S403: Determine whether the number of sub-item data in the first dynamic array is 0, if yes, end the process, otherwise, execute step S404; S404: Obtaining the offset of the third-level information stored in the data of the 190 module: obtaining the offset stored in the first item of the first dynamic array as the offset of the third-level information stored in the data of the 190 module; S405: Obtain the byte length of the third-level information storage: take the first address of the data in module 190 as the starting address, take the sum of the offset of the third-level information storage in the data in module 190 plus 0x200 as the offset, address and obtain the content of continuous 0x28 bytes as the metadata header; Read the value of the block number field in the metadata header, multiply it by 0xC, and add the sum of 0x228 as the byte length of the third-level information storage; S406: Using the first address of the 190 module data as the starting address and the offset of the third-level information stored in the 190 module data as the offset, address and obtain the byte content as the third-level information storage, wherein the byte length of the obtained byte is the byte length of the third-level information storage.

3. The method of obtaining a secondary decoding table using data from module 190 according to claim 1, characterized in that: Step S600 includes the following steps: S601: The number of sub-item data is initialized to 0; S602: Determine whether the current number of sub-item data is less than the number of sub-item data in the temporary dynamic array, if yes, execute step S603, otherwise, execute step S606; S603: Taking the current number of sub-item data as an index, fetching the sub-item data of the B-tree mapping item corresponding to the index from the temporary dynamic array; S604: Obtain the secondary decoding table in the 190 module data according to the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index; S605: the number of sub-item data is incremented by 1, and step S602 is executed; S606: Obtain data in the output buffer as a secondary decoding table.

4. A method for obtaining a secondary decoding table using data from module 190 according to claim 3, characterized in that: Step S604 includes the following steps: S6041: Determine whether the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index is not equal to 0 and is less than the number of sectors of the 190 module data. If so, execute step S6042; otherwise, execute step S605; S6042: Get the secondary decoding table: take the first address of the 190 module data as the starting address, take the value of the sector offset field in the sub-item data of the B-tree mapping item corresponding to the index multiplied by 0x200 as the offset, address and obtain the content of consecutive bytes, wherein the byte length of the obtained byte content is equal to the value of the block size field in the metadata header, the obtained byte content is saved to the output buffer, and the saved address is the product of the value of the block size field in the metadata header multiplied by the number of sub-item data.

Images