Data mirroring method, device, equipment, medium and program product

Abstract

The invention discloses a data mirroring method, device and equipment, a medium and a program product, and relates to the technical field of data processing. The method comprises the following steps: detecting the chip type of the computer in a shutdown off-line state of the computer; acquiring magnetic disk attribute information and corresponding original magnetic disk data by adopting a magnetic disk read-only access mode corresponding to the chip type; screening a target mirror image format from alternative mirror image formats corresponding to the chip type; and mirroring the original disk data according to the disk attribute information and the target mirroring format to obtain mirrored disk data of the computer disk. According to the technical scheme, the integrity and accuracy of the mirror image data can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data mirroring method, device, equipment, medium and program product. Background Art

[0002] With the development of technology, computer and network crimes are increasing, such as network intrusion, intellectual property theft and network fraud. Computer forensics, as a special technical means, aims to collect, preserve, analyze and present evidence related to computer crimes, providing key support for combating these crimes. The purpose of computer forensics is to extract the "traces" left by criminals in the computer and provide these traces as effective litigation evidence to the court. These evidences play a vital role in the trial and conviction of the case and help bring the suspects to justice. As the number of computer users continues to rise, the number of cyber crimes related to them is also increasing. Therefore, the demand for computer forensics is also gradually increasing. Research and development of computer forensics technology is of great significance to meet this challenge.

[0003] The existing evidence collection method is to fix the disk data when the computer is turned on and online to obtain the disk data and realize evidence collection. However, when the computer is turned on and online, it is inevitable that files will be occupied, resulting in the loss of the obtained disk data, and even destroying the accuracy of the source data, which has a certain degree of impact on evidence collection. Summary of the invention

[0004] The present invention provides a data mirroring method, device, equipment, medium and program product, which can improve the integrity and accuracy of mirrored data.

[0005] According to one aspect of the present invention, a data mirroring method is provided, the method comprising:

[0006] When the computer is turned off and offline, detect the chip type of the computer;

[0007] Using the disk read-only access method corresponding to the chip type, obtaining disk attribute information and corresponding original disk data;

[0008] Selecting a target image format from the candidate image formats corresponding to the chip type;

[0009] The original disk data is mirrored according to the disk attribute information and the target mirroring format to obtain the mirrored disk data of the computer disk.

[0010] According to another aspect of the present invention, there is provided a data mirroring device, the device comprising:

[0011] The chip type detection module is used to detect the chip type of the computer when the computer is turned off and offline;

[0012] The original disk data acquisition module uses the disk read-only access mode corresponding to the chip type to acquire disk attribute information and corresponding original disk data;

[0013] A target image format screening module, used to screen a target image format from the candidate image formats corresponding to the chip type;

[0014] The mirror disk data generation module is used to mirror the original disk data according to the disk attribute information and the target mirror format to obtain the mirror disk data of the computer disk.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data mirroring method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data mirroring method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the data mirroring method according to any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention detects the chip type of the computer when the computer is turned off and offline, adopts the disk read-only access method corresponding to the chip type, obtains disk attribute information and corresponding original disk data, selects the target image format among the alternative image formats corresponding to the chip type, and mirrors the original disk data according to the disk attribute information and the target image format to obtain the mirror disk data of the computer disk, thereby avoiding file occupation of the computer disk, realizing data mirroring when the computer is turned off and offline, and improving the integrity and accuracy of the mirror data of the computer disk, thereby improving the integrity of evidence collection.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a data mirroring method provided according to Embodiment 1 of the present invention;

[0025] Figure 2 is a flow chart of a data mirroring method provided according to Embodiment 2 of the present invention;

[0026] Figure 3 is a flow chart of a data mirroring method provided according to Embodiment 2 of the present invention;

[0027] Figure 4 is a flow chart of a data mirroring method of a first chip type provided in accordance with a second embodiment of the present invention;

[0028] Figure 5 is a flow chart of a data mirroring method for a second chip type provided in accordance with the second embodiment of the present invention;

[0029] Figure 6 is a structural schematic diagram of a data mirroring device provided according to Embodiment 3 of the present invention;

[0030] Figure 7 It is a structural schematic diagram of an electronic device for implementing the data mirroring method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 This is a flow chart of a data mirroring method provided in the first embodiment of the present invention. The embodiment of the present invention is applicable to the case where disk data is mirrored without booting the computer. The method can be executed by a data mirroring device, which can be implemented in the form of hardware and / or software. The data mirroring device can be configured in an electronic device that carries the data mirroring function, such as a client or a server. Figure 1 The data mirroring method shown includes:

[0035] S110. When the computer is turned off and offline, detect the chip type of the computer.

[0036] The computer shutdown offline state can keep the computer in a shutdown state. In the actual evidence collection process, when the suspect is caught, if the suspect's computer is not turned on, it is usually not allowed to turn on the suspect's computer, that is, the computer must be kept in a shutdown state. Moreover, if the computer is turned on, there will be files occupied on the computer. At this time, mirroring the computer will cause the acquired disk data to be missing and the integrity of the disk data to be insufficient. Therefore, when the computer is shut down and offline, mirroring the computer's disk data can ensure the integrity and accuracy of the disk data. The chip type can be used to distinguish different read-only access methods of the computer disk. It can be understood that different chip types have different read-only access methods for computer disks. Exemplarily, the computer is a laptop.

[0037] Specifically, when the computer is turned off and offline, a chip type identification method can be used to identify the chip type of the computer and determine the chip type of the computer. The chip type identification method may include a method for identifying the chip type identifier of the computer and a recovery mode identification method.

[0038] S120 , using a disk read-only access method corresponding to the chip type to obtain disk attribute information and corresponding original disk data.

[0039] The disk read-only access mode can be used to read-only access the computer's disk data. The disk read-only access mode can obtain the disk data, but will not modify the disk data, thereby ensuring the accuracy of the disk data. Exemplarily, the disk read-only access mode can include an external device read-only access mode and a recovery mode read-only access mode.

[0040] Disk attribute information can be used to characterize the disk attributes of a computer. Optionally, the disk attribute information can include a disk identifier, a disk capacity, and a mapping relationship between a disk and a system disk, etc. Among them, a computer can include at least one disk. The disk identifier can be used to uniquely identify the disk in the computer. Exemplarily, the disk identifier can be a disk serial number or a disk identifier, etc. The disk capacity can be used to characterize the storage space capacity occupied by the disk. Exemplarily, the disk capacity can be a disk size. The mapping relationship between the disk and the system disk can be used to characterize the corresponding relationship between the disk and the system disk. It can be understood that when mirroring the disk data of a computer, all disk data or part of the disk data may need to be mirrored. When mirroring part of the disk data, the identifier of the system disk is usually given, such as the D disk, but when accessing the disk, the disk corresponding to the system disk and the specific partition corresponding to the disk cannot be directly perceived. Therefore, it is necessary to determine the disk and partition corresponding to the system disk of the desired image through the mapping relationship between the disk and the system disk. Alternatively, the container and specific volume of the desired image are determined based on the disk letter subscript. Exemplarily, the mapping relationship between the disk and the system disk can be the disk letter subscript.

[0041] The original disk data can be used to represent the disk data to be mirrored in the computer. The original disk data can be all the disk data or part of the disk data of the computer.

[0042] Specifically, the disk read-only access method corresponding to the chip type can be used to access the computer disk to obtain the disk attribute information and the corresponding original disk data.

[0043] S130: Filter a target image format from candidate image formats corresponding to the chip type.

[0044] The candidate image format may be an image format corresponding to the chip type. The candidate image format may be used to filter the target image format. The target image format may be an image format of the image disk data.

[0045] Optionally, the image format selected by the data image demander may be obtained, and the target image format may be filtered out from the candidate image formats corresponding to the chip type.

[0046] S140, mirroring the original disk data according to the disk attribute information and the target mirroring format to obtain mirrored disk data of the computer disk.

[0047] The mirror disk data may be the mirror data of the computer disk. Optionally, the mirror disk data may be completely identical to the original disk data; the mirror disk data may also be the data after the redundant data of the original disk data is removed. The mirror disk data may include the mirror disk file and the data in the mirror disk file.

[0048] Specifically, the partition (or container volume) of the image disk data can be determined according to the disk attribute information. The original disk data can be mirrored in the target image format to obtain the image disk data in the target image format. The image disk data can be mirrored to the corresponding partition (or container volume) to obtain the image disk data of the computer disk.

[0049] In an optional embodiment of the present invention, the chip type includes a second chip type; the disk read-only access mode is an external device read-only access mode; the alternative image formats include an original image format and a compressed image format; accordingly, according to the disk attribute information and the target image format, the original disk data is mirrored to obtain the image disk data of the computer disk, including: using a target image tool corresponding to the target image format, according to the disk attribute information, the original disk data is mirrored to obtain the image disk data of the computer disk; wherein the target image tool includes an original image tool or a compressed image tool.

[0050] The chip type is the second chip type. Among them, the second chip type can be a chip type that uses an external device read-only access method to access the computer disk. Exemplarily, the second chip type can be an Intel chip. The disk read-only access method can be an external device read-only access method. The external device read-only access method can be a method of using an external device to read-only access the computer disk of the second chip type, for example, an external USB flash drive or hard disk loaded with Win PE (Windows Preinstallation Environment). The external device method in the prior art is usually used when the computer corresponding to the Windows system cannot be started normally, such as when the computer is damaged or stolen, the external device method is used to reinstall the computer system. The external device method in this solution is used to access and obtain disk data on the computer disk.

[0051] Alternative image formats include raw image formats and compressed image formats. Among them, the raw image (RAW Image, dd) format can be a data format that is completely consistent with the original disk data content and size. The compressed image (CompressedImage, E01) format can be a data format that is completely consistent with the original disk data content and has a certain compression in data size. The raw image tool can be used to mirror the raw disk data to obtain the image disk data in the raw image format. Exemplarily, the raw image tool can be a dd (command line) tool. The compressed image tool can be used to mirror the raw disk data to obtain the image disk data in the compressed image format. Exemplarily, the compressed image tool can be an ewfacquire (electronic evidence acquisition) tool.

[0052] Specifically, when the target image format is the original image format, the original disk data is mirrored according to the disk attribute information using the original image tool to obtain the image disk data of the computer disk. When the target image format is the compressed image format, the compressed image tool is used to mirror the original disk data according to the disk attribute information to obtain the image disk data of the computer disk.

[0053] This solution implements read-only access to the computer disk when the computer is turned off and offline by concretizing the chip type as the second chip type and the disk read-only access mode as the external device read-only access mode. By concretizing the alternative image format as the original image format and the compressed image format, the format selection of the image disk data of the second chip type is implemented, and the flexibility and accuracy of the image disk data are improved. Accordingly, by adopting the target image tool corresponding to the target image format, the original disk data is mirrored according to the disk attribute information to obtain the mirror disk data of the computer disk, the data mirroring of the computer disk of the second chip type can be implemented, and the integrity and accuracy of the data mirroring of the second chip type are improved, thereby improving the convenience and accuracy of the computer forensics process of the second chip type.

[0054] The technical solution of the embodiment of the present invention detects the chip type of the computer when the computer is turned off and offline, adopts the disk read-only access method corresponding to the chip type, obtains disk attribute information and corresponding original disk data, selects the target image format among the alternative image formats corresponding to the chip type, and mirrors the original disk data according to the disk attribute information and the target image format to obtain the mirror disk data of the computer disk, thereby avoiding file occupation of the computer disk, realizing data mirroring when the computer is turned off and offline, and improving the integrity and accuracy of the mirror data of the computer disk, thereby improving the integrity of evidence collection.

[0055] In an optional embodiment of the present invention, after obtaining the mirror disk data of the computer disk, it also includes: obtaining a target hash format; calculating the mirror disk data according to the target hash format to obtain a mirror hash value; sending the mirror hash value and the mirror disk data to the data mirror demander, so that the data mirror demander can perform anti-tampering verification on the mirror disk data according to the mirror hash value.

[0056] The target hash format may be a data format for calculating the hash value of the mirror disk data. Different target hash formats correspond to different hash algorithms. Exemplarily, the hash algorithm corresponding to the target hash format may include the MD50 (Message Digest Algorithm 50, encrypted hash function) algorithm or the RCE256 (Rivest Cipher 5 with a256-bit key, standard hash) algorithm, etc. Optionally, the target hash format may be set and adjusted by the data mirroring demander. The mirror hash value is the hash value of the mirror disk data. The mirror hash value is used to perform tamper-proof verification on the mirror disk data. The data mirroring demander may be the party that requires data mirroring, or the party that requires evidence collection.

[0057] Specifically, the target hash format selected by the data mirror demander can be obtained, and the hash algorithm corresponding to the target hash format can be used to perform hash calculation on the mirror disk data to obtain the mirror hash value. The mirror hash value and the mirror disk data are sent to the data mirror demander. When the data mirror demander receives the mirror hash value and the mirror disk data, the hash algorithm corresponding to the target hash format can be used to perform hash calculation on the original disk data to obtain the original hash value. The original hash value and the mirror hash value can be checked for consistency. When the original hash value and the mirror hash value are consistent, the anti-tampering check of the mirror disk data passes; otherwise, the anti-tampering check of the mirror disk data fails.

[0058] This solution introduces the image hash value of the image disk data and sends the image hash value to the data image demander, so that the data image demander can perform tamper-proof verification on the image disk data according to the image hash value, thereby ensuring the accuracy of the image disk data obtained by the image data demander.

[0059] Embodiment 2

[0060] Figure 2A flow chart of a data mirroring method provided for the second embodiment of the present invention. In the embodiment of the present invention, based on the above-mentioned embodiments, the "chip type" is concretized as the "first chip type"; the "disk read-only access mode" is concretized as the "recovery mode read-only access mode"; the "alternative mirroring format" is concretized as the "disk image mirroring format and sparse mirroring format"; accordingly, "mirroring the original disk data according to the disk attribute information and the target mirroring format to obtain the mirrored disk data of the computer disk" is concretized as "creating a blank mirroring file in the target mirroring format; according to the disk attribute information, using the target mirroring mode corresponding to the target mirroring format, mirroring the original disk data in the blank mirroring file to obtain the mirrored disk data of the computer disk", thereby realizing read-only access to the computer disk when the computer is turned off and offline, realizing format selection of the mirrored disk data of the first chip type, improving the flexibility and accuracy of the mirrored disk data, realizing data mirroring of the computer disk of the first chip type, improving the integrity and accuracy of the data mirroring of the first chip type, and thus improving the convenience and accuracy of the computer forensics process of the first chip type. It should be noted that for the parts not described in detail in the embodiments of the present invention, please refer to the description of other embodiments. See. Figure 2 The data mirroring method shown includes:

[0061] S210. When the computer is turned off and offline, detect the chip type of the computer.

[0062] The chip type may be a first chip type. The first chip type is a chip type that can access a computer disk in a recovery mode read-only access manner. Exemplarily, the first chip type may be an M2 chip (M2 chip, a system-level chip based on an ARM architecture) or an M3 chip (M2 chip, a system-level chip based on a GPU architecture), etc.

[0063] S220: Use a disk read-only access method corresponding to the chip type to obtain disk attribute information and corresponding original disk data.

[0064] The disk read-only access method is a recovery mode read-only access method. The recovery mode read-only access method can be a method of using the recovery mode to read-only access the computer disk of the first chip type. The recovery mode in the prior art is usually used to erase disk data to erase all data on the disk. The recovery mode in this solution is used to access and obtain the computer disk data.

[0065] S230: Filter a target image format from the candidate image formats corresponding to the chip type.

[0066] The alternative image formats include disk image image format and sparse image format. Among them, the disk image image (DiskImage, DMG) format is a complete Ext4 (Ext4 Partition Image, the fourth generation extended file system) partition image format of the original disk data. The disk image image format requires the image file size to be determined in advance and the computer disk to be imaged. The sparse image format is a data format for dynamically generating image files. The sparse image format is a file format that sparsely describes the original disk data. In comparison, the image disk data of the disk image image format contains a large number of all-zero invalid fill areas, and its volume is relatively large. The image disk data of the sparse image format only calculates the data of the actual files in the original disk data, and does not contain the all-zero invalid fill area, so its size is relatively small. Therefore, using the sparse image method can significantly reduce the volume of the image disk data, thereby saving time and space occupation, and improving the storage efficiency and transmission efficiency of the image disk data. Among them, the all-zero invalid fill area can be a blank area in the computer disk. It can be understood that there is actually no file in the all-zero invalid fill area, but it also occupies disk storage space. For example, if the original disk data is 100G, the actual storage space occupied by the file may be 20G, and the rest of the area is an invalid fill area filled with all zeros.

[0067] Specifically, the image format required by the data image demander may be obtained, and the target image format may be selected from the disk image format and the sparse image format corresponding to the chip type.

[0068] S240: Create a blank image file in the target image format.

[0069] A blank image file can be used to store image disk data. Optionally, the size of the blank image file can include 0k or a specified size.

[0070] Optionally, a blank image file in the target image format is created according to the target image format. In this case, the size of the blank image file can be 0k. Accordingly, in the process of mirroring the original disk data, the size of the blank image file is dynamically adjusted based on the mirror disk data, thereby avoiding the occupation of the image storage space by the all-zero invalid fill area in the original image file, significantly reducing the occupation of the storage space by the mirror disk data, thereby saving the time of data mirroring and improving the storage and transmission efficiency of the mirror disk data.

[0071] In an optional embodiment of the present invention, creating a blank image file in a target image format includes: determining the original storage capacity of the original disk file occupied by the original disk data according to the disk attribute information; and creating a blank image file in the target image format according to the original storage capacity.

[0072] The original disk file is used to store the original disk data. The original storage capacity may be the capacity of the original disk file. It can be understood that the original storage capacity is used to represent the size of the original disk file.

[0073] Specifically, the original storage capacity of the original disk file occupied by the original disk data is determined according to the disk capacity in the disk attribute information, the storage capacity of the blank image file is specified according to the original storage capacity, and a blank image file of the target image format is created.

[0074] In the process of creating a blank image file, this solution introduces the original storage capacity of the original disk file, thereby improving the efficiency of creating the blank image file.

[0075] S250. According to the disk attribute information, the target image format is used to mirror the original disk data in the blank image file to obtain the mirror disk data of the computer disk.

[0076] Since the mirror disk data of different target mirror formats are generated, the target mirroring mode of the original disk data for data mirroring is different. The target mirroring mode can be a mode for generating the mirror disk data of the target mirror format. Exemplarily, the target mirroring mode can be a disk image mirroring mode or a sparse mirroring mode.

[0077] Optionally, the original disk data can be mirrored according to the disk attribute information using the target mirroring method corresponding to the target mirroring format to obtain the mirrored disk data in the target mirroring format. The mirrored disk data in the target mirroring format can be dynamically filled in the blank mirroring file to obtain the mirrored disk data of the computer disk.

[0078] Optionally, after creating a blank image file in the target image format according to the original storage capacity, the original disk data can be mirrored using the target image method corresponding to the target image format to obtain the mirror disk data in the target image format. In the blank image file, the mirror disk data in the target image format can be divided according to the disk identifier contained in the disk attribute information and the mapping relationship between the disk and the system disk, and filled into the blank image file to obtain the mirror disk data of the computer disk.

[0079] In an optional embodiment of the present invention, a disk read-only access method corresponding to the chip type is used to obtain disk attribute information and corresponding original disk data, including: using the disk read-only access method corresponding to the chip type to obtain disk attribute information; using a lock query command line to query the disk lock status according to the disk identifier contained in the disk attribute information; when the disk is unlocked, using a mount query command line to query the disk mount status according to the disk identifier contained in the disk attribute information; when the disk is mounted, obtaining the disk mount point, and using the recovery mode read-only access method to access the disk mount point to obtain the disk attribute information and corresponding original disk data.

[0080] The disk identification can be used to uniquely identify the disk. Exemplarily, the disk identification can be a disk serial number, a disk ID (Identity) or a disk identifier.

[0081] The disk lock state can be used to characterize whether the disk can be used for access and query. Exemplarily, the disk lock state can include disk unlocked and disk unlocked. Among them, the disk unlocked can mean that the computer disk has been unlocked and data mirroring can be performed. The disk unlocked can mean that the computer disk has not been unlocked and needs to be unlocked for data mirroring.

[0082] The lock query command line can be used to query the disk lock status. Exemplarily, the lock query command line can be "diskutil info$DEVICE_ID|grep"Locked:"|grep"No"> / dev / null". Wherein, $DEVICE_ID is the disk ID, such as disk3s1; diskutil info$DEVICE_ID can be used to query the disk corresponding to the disk ID $DEVICE_ID; grep"Locked:" can be used to filter the disk lock state machine; grep"No" can output "No" when the disk is not locked; conversely, it outputs "Yes" when the disk is locked.

[0083] Optionally, when the disk is locked, you can use an unlock command line to unlock the computer disk. For example, the unlock command line can be "diskutil apfs unlockVolume$DEVICE_ID-passphrase$DEVICE_PASSWD> / dev / null". Among them, $DEVICE_ID is the disk ID; $DEVICE_PASSWD is the unlock key.

[0084] The disk mount status can be used to characterize whether the disk can be used to retrieve data. Exemplarily, the disk mount status may include the disk mounted and the disk not mounted. Among them, the disk mounted means that the disk can be used to retrieve data. The disk not mounted means that the disk cannot be used to retrieve data and data needs to be retrieved after mounting. The mount query command line can be used to query the disk mount status. Exemplarily, the mount query command line can be "diskutil info$DEVICE_ID|grep"Mounted:"|grep"No"> / dev / null". Among them, $DEVICE_ID is the disk identifier; diskutil info$DEVICE_ID can be used to query the disk corresponding to the disk identifier $DEVICE_ID; grep"Mounted:" can be used to filter the disk mount state machine; grep"No" can be used to output "No" when the disk is not mounted; conversely, it can be used to output "Yes" when the disk is mounted.

[0085] Optionally, if it is detected that the disk is not mounted, a mount command line is used to mount the disk. Exemplarily, the mount command line may be "diskutil mount / dev / $DEVICE_ID> / dev / null". Where $DEVICE_ID is the disk ID.

[0086] The disk mount point can be a mount point of a computer disk. The disk mount point can be used to mount raw disk data. For example, the mount point acquisition command line can be "diskutil info$DEVICE_ID|grep"MountPoint:"|awk-F':"{print$2}'". Where $DEVICE_ID is the disk ID; Mount Point is the mount point.

[0087] Specifically, the disk attribute information can be obtained by using the disk read-only access method corresponding to the first chip type. The disk lock status can be queried using a lock query command line according to the disk identifier contained in the disk attribute information. When it is detected that the disk is unlocked, the disk mount status can be queried using a mount query command line according to the disk identifier contained in the disk attribute information. When it is detected that the disk is mounted, a mount point acquisition command line can be used to obtain the disk mount point, and the recovery mode read-only access method can be used to access the disk mount point to obtain the disk attribute information and the corresponding original disk data.

[0088] This solution introduces a lock query command line and a mount query command line, which can improve the efficiency of obtaining disk attribute information and corresponding original disk data, thereby improving the comprehensiveness and accuracy of the data image of the first chip type.

[0089] The technical solution of the embodiment of the present invention realizes read-only access to the computer disk when the computer is turned off and offline by concretizing the chip type as the first chip type and the disk read-only access mode as the recovery mode read-only access mode. By concretizing the alternative image format as the disk image image format and the sparse image format, the format selection of the image disk data of the first chip type is realized, and the flexibility and accuracy of the image disk data are improved. Accordingly, by creating a blank image file of the target image format, according to the disk attribute information, the target image mode corresponding to the target image format is adopted, and the original disk data is mirrored in the blank image file to obtain the mirror disk data of the computer disk, thereby realizing data mirroring of the computer disk of the first chip type, and improving the integrity and accuracy of the data mirroring of the first chip type, thereby improving the convenience and accuracy of the computer forensics process of the first chip type.

[0090] Figure 3 is a flow chart of a data mirroring method. Based on the above embodiment, Figure 3 This is a preferred embodiment of the present invention. Figure 3 The data mirroring method shown includes:

[0091] S310. Detect the chip type of the computer.

[0092] The reason for detecting the chip type of the computer is to determine whether the computer can be accessed through the read-only access mode of an external device, that is, whether it can be accessed through an external USB flash drive or hard disk loaded with Win PE in an offline state (i.e., shutdown and offline state). Specifically, if it is a computer of the second chip type, it is allowed to access through the read-only access mode of an external device; if it is a computer of the first chip type, it is not allowed to access through the read-only access mode of an external device, but it can be accessed through the read-only access mode of the recovery mode.

[0093] Optionally, you can check the chip type of the computer on the laptop shell. If the computer can be turned on, you can check the chip type of the computer in the upper left corner. If the computer cannot be turned on, you can enter recovery mode and check the chip type of the computer in the upper left corner.

[0094] S320. When it is detected that the chip type of the computer is the first chip type, a recovery mode read-only access method is used to obtain disk attribute information and corresponding original disk data, and the original disk data is mirrored according to the mirror format corresponding to the first chip type to obtain mirror disk data of the computer disk.

[0095] If the chip type is the first chip type, such as an M2 chip or an M3 chip, the computer's recovery mode can be entered, that is, the disk attribute information of the computer disk and the corresponding original disk data are accessed using the recovery mode read-only access method. In the recovery mode, the computer is not in the boot-up online state, but a powerful tool that comes with the Mac OS (graphical desktop operating system) computer, which is usually used to repair computer problems, such as erasing the computer's disk data, reinstalling the system, repairing startup failure problems, scanning disks, and repairing disks. The recovery mode of this solution is not used to repair computer problems, but uses a command line to access the original disk data of the computer disk itself, mirror the original disk data, and obtain mirror disk data. Because the computer is not booted online in the recovery mode, there will be no file occupation when it is booted online, and no data loss will occur. It should be noted that when the chip type of the computer is the first chip type, the mirror disk data of the computer disk obtained is a logical mirror of the computer disk. Among them, the logical mirror is a collection of disk files, does not contain system data, and is not a 1:1 replica of the computer disk.

[0096] Figure 4 is a flow chart of a data mirroring method for a first chip type. Figure 4 The data mirroring method of the first chip type shown includes:

[0097] S321. After entering the recovery mode of the computer, obtain disk attribute information.

[0098] Among them, the disk attribute information includes a disk identifier and a mapping relationship between the disk and the system disk. Among them, the disk identifier can be used to uniquely identify the disk; the mapping relationship between the disk and the system disk can be a disk drive letter subscript. The disk drive letter subscript can include the overall hierarchical information of the disk. Specifically, the disk drive letter subscript includes a container identifier and a volume identifier. For computers of the second chip type, there is no concept of partitions. The computer disk includes a container and a volume. Among them, the container can be used to represent the first-level partition of the computer disk of the second chip type; the volume can be used to represent a further subdivision of the container. Exemplarily, when obtaining the disk attribute information, a volume of a container in the computer disk and the volume size can be obtained.

[0099] S322. Detect whether the disk is in a disk lock state through the disk identifier. If the disk is in a disk lock state, unlock it through an unlock command.

[0100] Exemplarily, the lock query command line may be "diskutil info$DEVICE_ID|grep"Locked:"|grep"No"> / dev / null". Wherein, $DEVICE_ID is the disk ID, such as disk3s1; diskutil info$DEVICE_ID may be used to query the disk corresponding to the disk ID $DEVICE_ID; grep"Locked:" may be used to filter the disk lock state machine; grep"No" may output "No" when the disk is not locked; conversely, output "Yes" when the disk is locked.

[0101] Optionally, when the disk is locked, you can use an unlock command line to unlock the computer disk. For example, the unlock command line can be "diskutil apfs unlockVolume$DEVICE_ID-passphrase$DEVICE_PASSWD> / dev / null". Among them, $DEVICE_ID is the disk ID; $DEVICE_PASSWD is the unlock key.

[0102] S323. Detect whether the disk is in a disk mount state through a disk identifier. If the disk is not in a disk mount state, mount the disk through a mount command line, obtain a disk mount point after mounting, and obtain original disk data through the disk mount point.

[0103] Exemplarily, the mount query command line may be "diskutil info$DEVICE_ID|grep"Mounted:"|grep"No"> / dev / null". Wherein, $DEVICE_ID is the disk ID; diskutil info$DEVICE_ID may be used to query the disk corresponding to the disk ID $DEVICE_ID; grep"Mounted:" may be used to filter the disk mount state machine; grep"No" may output "No" when the disk is not mounted; conversely, output "Yes" when the disk is mounted.

[0104] For example, the mount command line may be “diskutil mount / dev / $DEVICE_ID> / dev / null”, where $DEVICE_ID is the disk ID.

[0105] Specifically, the mount point acquisition command line may be used to obtain the disk mount point. For example, the mount point acquisition command line may be "diskutil info$DEVICE_ID|grep"Mount Point:"|awk-F':"{print$2}'". Where $DEVICE_ID is the disk ID; and Mount Point is the mount point.

[0106] S324: confirm the target image format to be generated, and based on the target image format, mirror the original disk data to generate mirror disk data.

[0107] The candidate image formats may include a disk image format and a sparse image format.

[0108] Specifically, if the target image format is a disk image image format, a blank image file in the disk image image format is created, and the size of the blank image file (such as the original storage capacity) needs to be entered. This is because the disk image image format can specify the size when it is created. The disk image image format is a disk image file format under the Mac OS system, which is mainly used to install the Mac OS operating system and applications, and can be used on computers of the second chip type. The disk image image format can contain multiple files and folders and supports encryption and compression. The disk image image format is actually a disk image that can combine multiple files and folders into a single file. This containerization method makes it more convenient to transfer and distribute files while maintaining the integrity and structure of the files. On a computer of the second chip type, you can directly double-click the image disk file in the disk image image format to mount it as a virtual disk, and you can browse the files and folders in it like accessing a normal disk.

[0109] Specifically, if the target image format is a sparse image format, a blank image file in the sparse image format is created. No blank image file size is required, and a blank image file of size 0k (i.e., the initial blank image file) is directly generated. The sparse image format can dynamically change size with the content of the written image disk data.

[0110] Specifically, a disk image image command line may be used to create image disk data in a disk image image format. For example, the disk image image command line may be "hdiutil create-type UDIF-volname "${DEVICEID_TIME}"-size${DMG_SIZE}${DEVICEID_TIME} / ${DEVICEID_TIME}.dmg> / dev / null". UDIF is the disk image image format; DEVICEID_TIME is the image name, which usually uses the time as the image name; and DMG_SIZE is the size of a blank image file in the disk image image format.

[0111] Specifically, you can use the sparse mirror command line to create mirror disk data in the sparse mirror format. For example, the sparse mirror command line can be "hdiutil create-type SPARSE-volname "${DEVICEID_TIME}"${DEVICEID_TIME} / ${DEVICEID_TIME}> / dev / null". SPARSE is the sparse mirror format; DEVICEID_TIME is the mirror name, and time is usually used as the mirror name.

[0112] S325. After creating the blank image file, mount the blank image file and obtain a disk mount point.

[0113] S326, copying the original disk data to the mirror mount point of the newly created mirror through the disk mount point, and after the copying is completed, unmounting the mirror disk data to obtain the mirror disk data in the target mirror format.

[0114] Specifically, the image mount command line may be used to copy the original disk data to the image mount point of the newly created image. For example, the image mount command line may be "hdiutil attach${DEVICEID_TIME} / ${DEVICEID_TIME}.dmg> / dev / null". DEVICEID_TIME is the image name, and time is usually used as the image name.

[0115] S330. When it is detected that the chip type of the computer is the second chip type, the disk attribute information and the corresponding original disk data are obtained by adopting the read-only access mode of the external device, and the original disk data is mirrored according to the mirror format corresponding to the second chip type to obtain the mirror disk data of the computer disk.

[0116] If the chip type is the second chip type, such as an Intel chip, it can be accessed under the Windows (Windows operating) system. The computer can be accessed from an external device through read-only access, such as an external USB flash drive or hard disk with Win PE. This access method can be offline, and the computer can be read-only online in Win PE. Therefore, the computer itself is not turned on and its disk is read-only access, and no modification can be made to the computer, ensuring the accuracy and authenticity of the mirror disk data. Because the computer is not turned on, there will be no situation where files are occupied. It should be noted that when the chip type of the computer is the second chip type, the mirror disk data of the computer disk obtained is the physical mirror of the computer disk. It can be understood that the physical mirror is equivalent to the disk data and system data are all on the computer disk. The physical mirror can replicate the computer disk 1:1, that is, the physical mirror is the disk content of the original disk, which can be subsequently simulated. In comparison, the logical mirror only contains a collection of files and data; the physical mirror not only includes a collection of files and data, but also contains disk parameters and system data of the disk on the system.

[0117] And generally speaking, when a suspect is caught, if the suspect's computer is not turned on, it is generally not allowed to turn on the computer and it must be kept turned off. However, when the computer is turned off, the data in the computer cannot be obtained. Therefore, the original disk data of the computer can be accessed by using an external USB flash drive or hard disk loaded with Win PE, and the original disk data of the computer can be converted into mirror disk data, and then the mirror disk data can be analyzed. In this way, the Win PE system can be deployed on the USB flash drive or hard disk when the original computer is not turned on, and some original disk data in the original computer disk can be read through the Win PE system. In fact, Win PE is equivalent to installing the Windows system on a USB flash drive or hard disk. When the computer corresponding to the Windows system cannot be started normally, such as when the computer is damaged or stolen, the computer system can be reinstalled by using an external USB flash drive or hard disk loaded with Win PE. However, this solution is to use an external USB flash drive or hard disk loaded with Win PE to enter the computer system and access the original disk data of the computer. In other words, the purpose of this solution using the read-only access method of the external device is not to say that the computer cannot be turned on, and a system is deployed for the computer mirror to enable the computer to start up; but rather, the read-only access method of the external device is used to obtain the original disk data of the computer without turning on the computer.

[0118] Specifically, Figure 5 is a flow chart of a data mirroring method for a second chip type. Figure 5 The data mirroring method of the second chip type shown includes:

[0119] S331, using an external device read-only access method to obtain disk attribute information.

[0120] The disk attribute information includes the disk ID, disk capacity, and the mapping relationship between the disk and the system disk. The disk capacity may be the disk size. The disk ID may be the disk serial number. The mapping relationship between the disk and the system disk may be the disk letter subscript.

[0121] S332. Determine the target image format and target hash format to be generated, mirror the original disk data according to the image format corresponding to the second chip type, and obtain the image disk data of the computer disk; calculate the image disk data according to the target hash format to obtain the image hash value, and feed back the image hash value to the data mirroring demander.

[0122] The candidate image formats include original image format and compressed image format.

[0123] Specifically, if the target image format is the original image format, the image disk data in the original image format is generated by the original image tool. Among them, the image disk data in the original image format is proportional to the original disk data. Therefore, the content and size that are completely consistent with the original disk data will be obtained. For example, the original disk data is 100G, and the image disk data generated by the original image tool is also 100G; however, the image disk data generated by the compressed image tool may be 80G or 75G. Exemplarily, the original image tool is used to determine the storage space size (i.e., the original storage capacity) required for the image disk data according to the disk size. According to the disk drive letter subscript, the data location and data partition of the original disk data to be mirrored are determined, and based on the data location and data partition of the original disk data, the corresponding original disk data of the computer disk is mirrored. For example, the disk size and the disk drive letter subscript are obtained; according to the disk size, an image in the original image format of the same size is generated; based on the disk drive letter subscript, the location of the original disk data in the computer disk is determined, and the original disk data is mirrored. For example, there are two partitions on disk 0 corresponding to disk C and disk D; there is one partition on disk 1 corresponding to disk F. If the original disk data to be mirrored is disk D data, and the disk size is 100G, you can determine the specific partition of disk D data in disk 0 based on the disk letter subscript of disk 0. Determine the storage reduction size required for mirroring disk data based on the disk size, and then mirror the data on disk D.

[0124] Specifically, if the target image format is a compressed image format, the image disk data in the compressed image format is generated by the compressed image tool. The image disk data in the compressed image format is compressed to a certain extent, and smaller image disk data can be obtained while ensuring data integrity. Exemplarily, a preset compression method can be obtained through the compressed image tool; wherein the preset compression method may include faster compression and higher quality compression. Based on the target image format and the preset compression method, the image disk data in the target image format corresponding to the original disk data is generated. Different preset compression methods have different compression speeds and compression qualities. For example, a higher quality compression method takes longer, such as 1 hour, and the generated image disk data is 80G; if it is compressed at a faster speed, such as 50 minutes, the generated image disk data is 75G. However, the quality of the image disk data obtained by the higher quality compression method is higher than that by the faster compression method.

[0125] Optionally, in the process of generating the mirror disk data, a segmented mirroring method can be adopted to output at least one unit of mirror disk data respectively. For example, for the mirror disk data in the original mirror format, the original disk data is 100G, and the generated mirror disk data can be a single 100G; or 10 10G. In this way, the reasonable utilization of computing resources in the data mirroring process can be improved.

[0126] Optionally, after the original disk data is mirrored, mirroring completion information may be output, wherein the mirroring completion information may include the disk serial number and the mirroring path.

[0127] Optionally, after mirroring the original disk data of the computer disk of the second chip type, simulation may be performed based on the mirrored disk data.

[0128] This solution can be applied to computers with different types of chips, and can improve the versatility of data mirroring. Moreover, by performing data mirroring in a powered-off offline state rather than an online state, there will be no file occupation and no loss of mirrored disk data. At the same time, because the computer is not turned on, the accuracy and integrity of the original disk data will not be damaged. Furthermore, different data mirroring methods are used according to different chip types. If the computer is of the first chip type, a logical mirror can be obtained without occupying files, thereby ensuring the integrity and accuracy of the mirrored disk data. If the computer is of the second chip type, a physical mirror of the entire computer disk can be printed out, and simulation can be performed based on the physical mirror, thereby improving the application scope of data mirroring of computer disks of the second chip type.

[0129] Embodiment 3

[0130] Figure 6A schematic diagram of the structure of a data mirroring device provided in Embodiment 3 of the present invention. The embodiment of the present invention can be applied to the case where disk data is mirrored without booting the computer. The device can execute a data mirroring method. The device can be implemented in the form of hardware and / or software. The device can be configured in an electronic device that carries a data mirroring function, such as a client or a server.

[0131] See also Figure 6 The data mirroring device shown includes: a chip type detection module 610, an original disk data acquisition module 620, a target image format screening module 630 and an image disk data generation module 640. The chip type detection module 610 is used to detect the chip type of the computer when the computer is turned off and offline; the original disk data acquisition module 620 uses the disk read-only access method corresponding to the chip type to obtain disk attribute information and corresponding original disk data; the target image format screening module 630 is used to screen the target image format from the candidate image formats corresponding to the chip type; the image disk data generation module 640 is used to mirror the original disk data according to the disk attribute information and the target image format to obtain the image disk data of the computer disk.

[0132] The technical solution of the embodiment of the present invention detects the chip type of the computer when the computer is turned off and offline, adopts the disk read-only access method corresponding to the chip type, obtains disk attribute information and corresponding original disk data, selects the target image format among the alternative image formats corresponding to the chip type, and mirrors the original disk data according to the disk attribute information and the target image format to obtain the mirror disk data of the computer disk, thereby avoiding file occupation of the computer disk, realizing data mirroring when the computer is turned off and offline, and improving the integrity and accuracy of the mirror data of the computer disk, thereby improving the integrity of evidence collection.

[0133] In an optional embodiment of the present invention, the chip type includes a first chip type; the disk read-only access mode is a recovery mode read-only access mode; the alternative image format includes a disk image image format and a sparse image format; accordingly, the image disk data generation module includes: a blank image file creation unit, used to create a blank image file in the target image format; a first image disk data generation unit, used to mirror the original disk data in the blank image file according to the disk attribute information and using the target image mode corresponding to the target image format to obtain the image disk data of the computer disk.

[0134] In an optional embodiment of the present invention, the blank image file creation unit includes: an original storage capacity determination subunit, used to determine the original storage capacity of the original disk file occupied by the original disk data according to the disk attribute information; a blank image file creation subunit, used to create a blank image file in the target image format according to the original storage capacity.

[0135] In an optional embodiment of the present invention, the original disk data acquisition module includes: a disk attribute information acquisition unit, which is used to obtain disk attribute information by adopting the disk read-only access method corresponding to the chip type; a disk lock status query unit, which is used to query the disk lock status by adopting a lock query command line according to the disk identifier contained in the disk attribute information; a disk mount status query unit, which is used to query the disk mount status by adopting a mount query command line according to the disk identifier contained in the disk attribute information when the disk is unlocked; and an original disk data acquisition unit, which is used to obtain a disk mount point when the disk is mounted, and access the disk mount point by adopting the recovery mode read-only access method to obtain the disk attribute information and the corresponding original disk data.

[0136] In an optional embodiment of the present invention, the chip type includes a second chip type; the disk read-only access mode is an external device read-only access mode; the alternative image format includes an original image format and a compressed image format; accordingly, the image disk data generation module includes: a second image disk data generation unit, which is used to use a target image tool corresponding to the target image format to mirror the original disk data according to the disk attribute information to obtain the image disk data of the computer disk; wherein the target image tool includes an original image tool or a compressed image tool.

[0137] In an optional embodiment of the present invention, the device also includes: a target hash format acquisition module, used to obtain the target hash format after obtaining the mirror disk data of the computer disk; a mirror hash value calculation unit, used to calculate the mirror disk data according to the target hash format to obtain a mirror hash value; a mirror hash value feedback unit, used to send the mirror hash value and the mirror disk data to the data mirror demander, so that the data mirror demander can perform anti-tampering verification on the mirror disk data according to the mirror hash value.

[0138] The data mirroring device provided in the embodiment of the present invention can execute the data mirroring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0139] In the technical solution of the embodiment of the present invention, the acquisition, storage and application of the disk attribute information, corresponding original disk data, disk mount point and target hash format, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0140] Embodiment 4

[0141] Figure 7 A schematic diagram of the structure of an electronic device 700 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0142] like Figure 7 As shown, the electronic device 700 includes at least one processor 701, and a memory connected to the at least one processor 701 in communication, such as a read-only memory (ROM) 702, a random access memory (RAM) 703, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 701 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 702 or the computer program loaded from the storage unit 708 to the random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The processor 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0143] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0144] The processor 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 701 performs the various methods and processes described above, such as the data mirroring method.

[0145] In some embodiments, the data mirroring method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the processor 701, one or more steps of the data mirroring method described above may be performed. Alternatively, in other embodiments, the processor 701 may be configured to perform the data mirroring method in any other appropriate manner (e.g., by means of firmware).

[0146] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0147] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0148] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0149] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0150] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0151] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS (Virtual Private Server) services.

[0152] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0153] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data mirroring method, characterized in that: The method comprises: When the computer is turned off and offline, detect the chip type of the computer; Using the disk read-only access method corresponding to the chip type, obtaining disk attribute information and corresponding original disk data; Selecting a target image format from the candidate image formats corresponding to the chip type; The original disk data is mirrored according to the disk attribute information and the target mirroring format to obtain the mirrored disk data of the computer disk.

2. The method according to claim 1, characterized in that The chip type includes a first chip type; the disk read-only access mode is a recovery mode read-only access mode; the alternative image format includes a disk image image format and a sparse image format; Correspondingly, the original disk data is mirrored according to the disk attribute information and the target mirror format to obtain the mirror disk data of the computer disk, including: Creating a blank image file in the target image format; According to the disk attribute information, the target image format corresponding to the target image format is adopted to mirror the original disk data in the blank image file to obtain the mirror disk data of the computer disk.

3. The method according to claim 2, characterized in that The step of creating a blank image file in the target image format includes: Determining the original storage capacity of the original disk file occupied by the original disk data according to the disk attribute information; A blank image file in the target image format is created according to the original storage capacity.

4. The method according to claim 2, characterized in that: The method of using the disk read-only access mode corresponding to the chip type to obtain disk attribute information and corresponding original disk data includes: Using the disk read-only access mode corresponding to the chip type to obtain disk attribute information; According to the disk identification included in the disk attribute information, a lock query command line is used to query the disk lock status; When the disk is unlocked, querying the disk mount status using a mount query command line according to the disk identifier included in the disk attribute information; When the disk is mounted, the disk mount point is obtained, and the disk mount point is accessed using the recovery mode read-only access method to obtain disk attribute information and corresponding original disk data.

5. The method according to claim 1, characterized in that The chip type includes the second chip type; the disk read-only access mode is an external device read-only access mode; the alternative image format includes an original image format and a compressed image format; Correspondingly, the original disk data is mirrored according to the disk attribute information and the target mirror format to obtain the mirror disk data of the computer disk, including: The target image tool corresponding to the target image format is used to image the original disk data according to the disk attribute information to obtain the image disk data of the computer disk; wherein the target image tool includes an original image tool or a compressed image tool.

6. The method according to claim 1, characterized in that After obtaining the image disk data of the computer disk, the method further includes: Get the target hash format; Calculating the image disk data according to the target hash format to obtain an image hash value; The image hash value and the image disk data are sent to a data image demander, so that the data image demander performs an anti-tampering check on the image disk data according to the image hash value.

7. A data mirroring device, characterized in that: The device comprises: The chip type detection module is used to detect the chip type of the computer when the computer is turned off and offline; The original disk data acquisition module adopts the disk read-only access mode corresponding to the chip type to acquire the disk attribute information and the corresponding original disk data; A target image format screening module, used to screen a target image format from the candidate image formats corresponding to the chip type; The mirror disk data generation module is used to mirror the original disk data according to the disk attribute information and the target mirror format to obtain the mirror disk data of the computer disk.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the data mirroring method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data mirroring method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the data mirroring method according to any one of claims 1 to 6.

Images