Multi-format file restoration system and implementation method thereof

Abstract

The invention discloses a multi-format file restoration system and an implementation method thereof. The system comprises a file capture module which monitors a network data flow in real time, identifies data packets of multiple protocols by using a preset protocol feature library, and extracts file data packets by analyzing the structures of the data packets; the file analysis module analyzes the captured file data packet into a recognizable file format; and the file format classification and restoration module further analyzes file format characteristics in the file type identification result, and calls a corresponding restoration algorithm according to the file type. According to the method and the device, different types of files are accurately restored, and the integrity and compatibility of various file formats such as executable files, script files, document files, picture files and package files are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a multi-format file restoration system and an implementation method thereof. Background Art

[0002] With the development of information technology, files are transmitted through a variety of protocols and methods. Especially in a network environment, files may be exchanged through protocols such as HTTP, email, FTP, SMB, etc. However, in some cases, these transmitted files must be restored for information security analysis, data recovery or forensics purposes. The existing technology is insufficient in the comprehensiveness and compatibility of file restoration, especially when faced with files in multiple file formats, transmission methods and different operating system environments, the restoration capability is relatively limited. Therefore, a comprehensive restoration system that can support multi-protocol and multi-format file transmission is needed to cope with complex network environments and various types of files.

[0003] In the prior art, file restoration usually depends on specific transmission protocols and file formats. For example, some tools may only support file restoration under the HTTP protocol, while other tools may only support file restoration under the mail protocol. In addition, the prior art often requires the use of different tools or plug-ins when processing multiple file formats, resulting in complex operations and low efficiency.

[0004] The closest implementations include:

[0005] Single-protocol file restoration tools: For example, some HTTP file restoration tools only support file restoration under the HTTP protocol.

[0006] Specific format file restoration tools: For example, some PDF file restoration tools only support restoration of files in PDF format.

[0007] Multi-protocol file restore tools: Like some comprehensive tools, they support multiple protocols, but the file format support is limited.

[0008] However, the prior art has the following disadvantages:

[0009] Limited protocol support: Existing tools usually only support a single or a few transmission protocols and cannot comprehensively cover multiple protocols.

[0010] Limited file format support: Existing tools often require the use of different tools or plug-ins when processing multiple file formats, which is complex and inefficient.

[0011] Poor compatibility: Existing tools have poor compatibility in different operating system environments and cannot guarantee the integrity and accuracy of file restoration. Summary of the invention

[0012] Based on this, the embodiment of the present application provides a multi-format file restoration system and its implementation method, which can accurately restore different types of files from files transmitted by various methods such as HTTP, email (such as SMTP, POP3, IMAP), FTP, SMB, NFS, instant messaging, network disk, etc., and ensure the integrity and compatibility of various file formats such as executable files, script files, document files, image files, compressed package files, etc.

[0013] In a first aspect, a multi-format file restoration system is provided, the system comprising:

[0014] The file capture module is used to monitor the network data flow in real time, identify the data packets of multiple protocols by using the preset protocol feature library, and extract the file data packets by analyzing the data packet structure; the multiple protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS protocols;

[0015] The file parsing module is used to parse the captured file data packets into recognizable file formats; wherein, by analyzing the header information and transmission content of the data packet file, the file type is identified and the consistency and integrity of the file content is ensured;

[0016] The file format classification and restoration module is used to further analyze the file format features in the file type recognition results and call the corresponding restoration algorithm according to the file type.

[0017] Optionally, using a preset protocol feature library to identify data packets of multiple protocols, and extracting file data packets by analyzing the data packet structure specifically includes:

[0018] Build a library containing multiple protocol features to identify and distinguish different protocols in data streams; protocol features include protocol identification fields, typical data packet structures, port information, and protocol header formats;

[0019] Analyze the contents of data packets through deep packet inspection technology and reassemble the data packets; wherein, the reassembly includes rebuilding the original data stream of the file according to the session state to make it complete;

[0020] Based on the protocol feature library, the corresponding parsing rules and file capture methods are loaded to support the capture of file streams of different protocols.

[0021] Optionally, the file format classification and restoration module specifically includes: through the file head and tail recognition function, intelligently further parsing the file format features in the file type recognition results to achieve the restoration of executable files, script files, document files, image files, compressed package files, and email files.

[0022] Optionally, in the file head and tail identification function, the file tail identification specifically includes:

[0023] Extract the tail features of the file format from the feature library and search step by step in the data stream or file content; wherein, through the pattern matching algorithm, find out whether there is a byte sequence that meets the tail features in the data stream; the pattern matching algorithm specifically adopts regular expression matching technology;

[0024] In addition, by verifying the standard length and segmentation of the file, it is ensured that the location of the file tail identifier is reasonable, thereby determining whether the file is complete.

[0025] Optionally, the system further comprises an executable file restoration module, which is used to restore executable files in PE format and ELF format, identify binary data in the file and restore it to a complete executable file.

[0026] Optionally, the system further comprises a script file restoration module for ensuring that the restored script can accurately restore the code content in the original file by analyzing the text content of the script file, thereby avoiding data loss or code damage.

[0027] Optionally, the system further comprises a document file restoration module for restoring the document format of the office software so that the document format can be opened and edited by the office software; wherein the document formats include wps, doc, xls, and pdf.

[0028] The system also includes a picture file restoration module, which is used to restore the transmitted picture file by parsing the picture file format.

[0029] Optionally, the system further comprises a compressed package file restoration module, which automatically decompresses and extracts files in the compressed package for compressed files being transmitted, and supports decompression and file extraction of multi-layer compressed packages.

[0030] Optionally, the system further comprises an email file restoration module, which is used to restore the email body and attachment content according to the email transmitted via the email protocol; wherein, the restoration of email formats such as eml is supported.

[0031] In a second aspect, a method for implementing the multi-format file restoration system according to any one of the first aspects is provided, the method comprising:

[0032] Monitor network data flow in real time, use the preset protocol feature library to identify data packets of multiple protocols, and extract file data packets by analyzing the data packet structure; the multiple protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS protocols;

[0033] Parse the captured file data packets into recognizable file formats; identify the file type by analyzing the data packet file header information and transmission content, and ensure the consistency and integrity of the file content;

[0034] The file format features are further analyzed in the file type identification results, and the corresponding restoration algorithm is called according to the file type.

[0035] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0036] Comprehensiveness: Supports multiple transmission protocols and file formats, and can fully cover complex network environments and various types of files.

[0037] Compatibility: The integrity and accuracy of file restoration can be guaranteed in different operating system environments.

[0038] Efficiency: Through intelligent parsing and efficient restoration algorithms, it ensures fast and accurate restoration of file contents.

[0039] Ease of use: The system is easy to operate and users can complete file restoration tasks without using multiple tools or plug-ins. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0041] Figure 1 A multi-format file restoration system architecture diagram provided in an embodiment of the present application;

[0042] Figure 2 A file restoration flow chart provided for an embodiment of the present application;

[0043] Figure 3 HTTP data packet structure diagram provided for the embodiment of the present application;

[0044] Figure 4 SMTP data packet structure diagram provided for the embodiment of the present application;

[0045] Figure 5 This is a diagram of the FTP data packet structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] In the description of the present invention, the terms "comprises", "has" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units added based on further optimization schemes conceived by the present invention.

[0048] The purpose of the present invention is to provide a multi-protocol, multi-file format file restoration system that can accurately restore different types of files from files transmitted in various ways such as HTTP, email (such as SMTP, POP3, IMAP), FTP, SMB, NFS, instant messaging, network disk, etc., and ensure the integrity and compatibility of multiple file formats such as executable files, script files, document files, image files, compressed package files, etc. For details, please refer to Figure 1 , which shows a multi-format file restoration system architecture diagram. The present invention proposes a multi-protocol, multi-file format file restoration system, which mainly includes the following modules:

[0049] The file capture module is used to monitor network data flow in real time and identify and extract file data packets in multiple protocols through traffic analysis technology.

[0050] The various protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS. Using the preset protocol feature library, the module can identify data packets of multiple protocols. Using network sniffing technology, it can capture data packets transmitted in the network in real time. By analyzing the data packet structure, the file content can be extracted to prepare for subsequent file parsing and restoration.

[0051] Identification and capture of file transfers using multiple protocols is usually achieved through the following technical processes:

[0052] Protocol feature library: Build a library containing multiple protocol features to identify and distinguish different protocols in data streams. These features include protocol identification fields, typical data packet structures, port information, protocol header formats, etc.

[0053] Deep Packet Inspection (DPI): In the analysis of network data flow, the content of the data packet is analyzed through deep packet inspection technology (DPI). DPI not only identifies the protocol, but also goes deep into the details of the application layer to extract specific file data packets.

[0054] Stream reassembly: Files in network data streams are usually transmitted in fragments or packets, so it is necessary to reassemble the data packets. The core of stream reassembly is to rebuild the original data stream of the file based on the session state to make it complete. Unlike the traditional method that only focuses on a single data packet, this process can ensure that the data fragments during the file transmission process are completely extracted.

[0055] Dynamic parsing: Based on the protocol feature library, the system can dynamically load appropriate parsing rules and file capture methods to support the capture of file streams of different protocols. This dynamic parsing mechanism makes the system efficient and extensible, and facilitates the support of new protocols.

[0056] The difference from the existing technology is that this multi-protocol file restoration system organically combines feature recognition, stream reassembly, and dynamic parsing, which can flexibly adapt to the data structure of multiple protocols and restore file data more accurately. Traditional traffic monitoring systems can often only detect data streams of specific protocols or can only identify limited file types, while this system achieves efficient multi-protocol file recognition and capture through feature libraries and stream reassembly technology.

[0057] The file parsing module is used to parse the captured file data packets into a recognizable file format.

[0058] Among them, by analyzing the data packet file header information and transmission content, the file type is identified and the consistency and integrity of the file content are ensured. Specifically, the first few bytes of the file stream are checked to determine the file type. Ensure that the file content has not been tampered with or damaged during transmission. According to the file header information, the file stream is restored to the corresponding file format.

[0059] The file format classification and restoration module is used to further analyze the file format features in the file type recognition results and call the corresponding restoration algorithm according to the file type.

[0060] Specifically, the specific type of the file is identified based on the file header and tail information. Based on the identified file type, the preset restoration algorithm is called. The restoration algorithm is executed to convert the file stream into a readable file format and ensure the integrity and accuracy of the content. For complex file formats, such as multi-layer compressed files, the system can parse and restore them layer by layer.

[0061] Relationship between file format and file type in this application: In this system, "file type" and "file format" have similar but slightly different meanings. File type refers to the broad category to which a file belongs (such as document, image, executable file, etc.), while file format is more specific and refers to the storage format of the file at the binary level (such as DOC, PDF, JPEG, etc.). File format is a subdivision of file type, including specific file structure characteristics.

[0062] In this application, file header and tail identification and file integrity verification: File header and tail identification is mainly used to verify the integrity and correctness of the file. Each file format usually has a fixed header (marking the start of the file) and a tail (marking the end of the file) binary identifier. For example, a JPEG image file starts with a specific marker (such as "FFD8") and ends with "FFD9". These features can be used to check whether the file is complete.

[0063] Implementation of file tail recognition function: File tail recognition is achieved by scanning the terminal characteristic bytes of the file data stream. The system first extracts the tail characteristics of the file format from the characteristic library and searches step by step in the data stream or file content. The specific method of tail recognition is as follows:

[0064] Pattern matching: Use the pattern matching algorithm to find out whether there is a byte sequence that meets the tail characteristics in the data stream. This process can use regular expressions or other string matching techniques.

[0065] Length verification: In addition to the file tail identifier, the standard length and segmentation of the file can also be verified to ensure that the location of the file tail identifier is reasonable, thereby determining whether the file is complete.

[0066] Integrity check: The system can combine the characteristics of the file header and footer, as well as other specific fields in the file format (such as checksums) to verify the integrity and correctness of the file.

[0067] In summary, the file header and tail recognition function ensures the integrity of file data by analyzing the file format features, preventing incomplete data packets from being mistakenly identified as legitimate files.

[0068] In an optional embodiment of the present application, the system further includes:

[0069] Executable file restoration module, which is responsible for restoring executable files in PE and ELF formats, identifying binary data in the file and restoring it to a complete executable file. Figure 2 A file restoration flow chart is given;

[0070] Specifically, it identifies executable files in PE and ELF formats through file header information. It analyzes binary data to extract key execution code and resource information. It reorganizes the file structure according to the PE or ELF file format specifications to ensure the correctness and integrity of the executable file. It performs security checks during the restoration process to ensure that no malicious code is implanted.

[0071] The script file restoration module analyzes the text content of the script file to ensure that the restored script can accurately restore the code content in the original file to avoid data loss or code damage.

[0072] Specifically, the script file is parsed line by line to identify the code structure and logic. Based on the parsing results, the code is reorganized to ensure logical coherence and code integrity. Ensure that the script can be executed normally in the corresponding environment. By comparing the differences between the original script and the restored script, possible restoration errors can be corrected.

[0073] The document file restoration module supports the document formats of common office software, such as wps, doc, xls, pdf, etc., ensuring that the file content can be opened and edited by regular office software after restoration.

[0074] Specifically identify the formats of different documents and call the corresponding parser for processing. Extract text, images, tables and other elements in the document and maintain the original layout and format. Reconstruct the document structure based on the extracted content and format information. Handle compatibility issues between different versions to ensure that the document can be opened in different versions of office software.

[0075] The picture file restoration module restores the transmitted picture files by analyzing the picture file format and ensures the image quality.

[0076] Identify the image file format, such as JPEG, PNG, etc. Parse the image file and extract the image data. Apply image processing techniques during the restoration process to maintain or restore image quality. Recover image metadata information, such as EXIF ​​data.

[0077] Compressed package file restoration module, for compressed files in transmission, the system will automatically decompress and extract the files in the compressed package, and supports decompression and file extraction of multi-layer compressed packages.

[0078] Specifically identify different compression formats, such as ZIP, RAR, etc. Automatically decompress compressed files and extract internal files and folders. For multi-layer compressed files, recursively decompress until all files are extracted. Perform file integrity check during the decompression process to ensure that the file is not damaged.

[0079] The mail file restoration module can restore the mail body and attachments of mails transmitted via SMTP, POP3 and other mail protocols, and supports the recovery of mail formats such as eml.

[0080] Specifically parse SMTP, POP3 and other mail protocols to extract mail data. Extract mail body, attachments and header information. Organize and restore the extracted content according to eml and other mail formats. Identify and restore attachments in mails to ensure the integrity and availability of attachment content.

[0081] In an optional embodiment of the present application, the code representation of each of the above modules is given below:

[0082] 1. File crawling module

[0083] By monitoring network data of multiple transmission protocols, capturing transmitted data packets, and extracting files from them through traffic analysis technology, it supports identifying and capturing file transfer processes of HTTP, SMTP, POP3, IMAP, FTP, SMB, NFS and other protocols.

[0084]

[0085] 2. File parsing module

[0086] According to the file transfer methods of different protocols, the extracted file stream is parsed and restored to the complete file format. Based on the file header information and the transmission content, this module identifies the file type and ensures the consistency and integrity of the file content.

[0087]

[0088]

[0089] 3. File format classification and restoration module

[0090] For captured files, different file restoration algorithms are called according to the file type (executable files, script files, document files, image files, compressed files, email files, etc.) to ensure the restoration of file contents. The system has the function of identifying the head and tail of files and can perform intelligent analysis based on the file format characteristics.

[0091]

[0092] 4. Executable file restoration

[0093] This module supports the restoration of executable files in PE and ELF formats. It can identify binary data in the file and restore it to a complete executable file.

[0094] 5. Script file restoration

[0095] By analyzing the text content of the script file, it is ensured that the restored script can accurately restore the code content in the original file to avoid data loss or code damage.

[0096] 6. Document file restoration

[0097] Supports document formats of common office software, such as wps, doc, xls, pdf, etc., ensuring that the file content can be opened and edited by regular office software after restoration.

[0098] 7. Image file restoration

[0099] By parsing the image file format, the transmitted image file can be restored and the image quality can be guaranteed.

[0100] 8. Restore compressed files

[0101] For compressed files in transmission, the system will automatically decompress and extract the files in the compressed package, and support decompression and file extraction of multi-layer compressed packages.

[0102] 9. Mail file restoration

[0103] For emails transmitted via SMTP, POP3 and other email protocols, the email body and attachments can be restored, and support recovery of email formats such as eml.

[0104] From the above, it can be seen that the innovative points of this application include:

[0105] Multi-protocol support: The system can restore files transmitted via HTTP, mail (SMTP, POP3, IMAP), FTP, SMB, NFS, instant messaging, network disk, etc.

[0106] Multiple file format support: The system can restore multiple file formats including executable files, script files, document files, image files, compressed files, email files, etc.

[0107] Intelligent file parsing: The system has the function of identifying the head and tail of files, and can perform intelligent parsing based on the file format characteristics to ensure the integrity and accuracy of the file content.

[0108] Efficient restoration algorithm: For different file types, the system calls the corresponding restoration algorithm to ensure fast and accurate restoration of file contents.

[0109] In addition, it should be noted that the objects processed by this application include HTTP data packets, SMTP data packets and FTP data packets. Figure 3 , Figure 4 , Figure 5 The HTTP data packet structure diagram, SMTP data packet structure diagram and FTP data packet structure diagram are given respectively.

[0110] HTTP data packet structure includes two forms: request and response, which are composed of message header and message body, separated by blank lines. The request message contains the request line, request header field, common header field, entity header field, and other possible header fields (such as Cookie). The response message contains the status line, response header field, common header field, entity header field, and other header fields (such as Set-Cookie). The HTTP protocol is stateless, which means that there is no direct connection between each request and response, and the Cookie mechanism is introduced to maintain the state.

[0111] The SMTP (Simple Mail Transfer Protocol) packet structure involves the interaction between the client and the server, including the connection, authentication, mail transmission and disconnection process. The SMTP interaction starts with the client successfully connecting to the server, followed by user authentication, then sending the mail content, and ending the SMTP session with the exit command. In the SMTP protocol, status words such as 220 indicate a successful connection, 250 indicate a successful handshake with the server, 334 indicate acceptance of the user login, and 235 indicate successful user login.

[0112] The FTP (File Transfer Protocol) packet structure involves two parts: the control connection and the data connection. The control connection is responsible for transmitting control commands and response codes, while the data connection is responsible for transmitting the actual file data. The FTP protocol supports a variety of file types and structures, as well as different transfer modes. FTP uses port 21 as the default port for the control connection, while the port for the data connection is dynamically selected as needed. The FTP protocol allows users to send commands (such as USER, PASS, PASV, PORT, etc.) through the control connection to control file uploads, downloads, and directory listings.

[0113] In an optional embodiment of the present application, the system further includes:

[0114] Single-protocol file restoration tools: For example, some HTTP file restoration tools only support file restoration under the HTTP protocol.

[0115] Specific format file restoration tools: For example, some PDF file restoration tools only support restoration of files in PDF format.

[0116] Multi-protocol file restore tools: Like some comprehensive tools, they support multiple protocols, but the file format support is limited.

[0117] The embodiment of the present application also provides a method for implementing a multi-format file restoration system, including:

[0118] Monitor network data flow in real time, use the preset protocol feature library to identify data packets of multiple protocols, and extract file data packets by analyzing the data packet structure; the multiple protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS protocols;

[0119] Parse the captured file data packets into recognizable file formats; identify the file type by analyzing the data packet file header information and transmission content, and ensure the consistency and integrity of the file content;

[0120] The file format features are further analyzed in the file type identification results, and the corresponding restoration algorithm is called according to the file type.

[0121] The multi-format file restoration method provided in the embodiment of the present application is implemented in the multi-format file restoration system. For the specific definition of the multi-format file restoration method, please refer to the definition of the multi-format file restoration system above, which will not be repeated here. The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A multi-format file restoration system, characterized in that: The system comprises: The file capture module is used to monitor the network data flow in real time, identify the data packets of multiple protocols by using the preset protocol feature library, and extract the file data packets by analyzing the data packet structure; the multiple protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS protocols; The file parsing module is used to parse the captured file data packets into recognizable file formats; wherein, by analyzing the header information and transmission content of the data packet file, the file type is identified and the consistency and integrity of the file content is ensured; The file format classification and restoration module is used to further analyze the file format features in the file type identification results and call the corresponding restoration algorithm according to the file type.

2. The multi-format file restoration system according to claim 1, characterized in that: Using the preset protocol feature library, we can identify data packets of various protocols and extract file data packets by analyzing the data packet structure. Specifically, it includes: Build a library containing multiple protocol features to identify and distinguish different protocols in data streams; protocol features include protocol identification fields, typical data packet structures, port information, and protocol header formats; Analyze the contents of data packets through deep packet inspection technology and reassemble the data packets; wherein, the reassembly includes rebuilding the original data stream of the file according to the session state to make it complete; Based on the protocol feature library, the corresponding parsing rules and file capture methods are loaded to support the capture of file streams of different protocols.

3. The multi-format file restoration system according to claim 1, characterized in that: The file format classification and restoration module specifically includes: through the file head and tail recognition function, intelligent analysis of file format characteristics, and the restoration of executable files, script files, document files, image files, compressed file files, and email files.

4. The multi-format file restoration system according to claim 3, characterized in that: In the file head and tail recognition function, the file tail recognition specifically includes: Extract the tail features of the file format from the feature library and search step by step in the data stream or file content; wherein, through the pattern matching algorithm, find out whether there is a byte sequence that meets the tail features in the data stream; the pattern matching algorithm specifically adopts regular expression matching technology; In addition, by verifying the standard length and segmentation of the file, it is ensured that the location of the file tail identifier is reasonable, thereby determining whether the file is complete.

5. The multi-format file restoration system according to claim 1, characterized in that: The system also includes an executable file restoration module, which is used to restore executable files in PE format and ELF format, identify binary data in the file and restore it to a complete executable file.

6. The multi-format file restoration system according to claim 1, characterized in that: The system also includes a script file restoration module, which is used to ensure that the restored script can accurately restore the code content in the original file by analyzing the text content of the script file, thereby avoiding data loss or code damage.

7. The multi-format file restoration system according to claim 1, characterized in that: The system also includes a document file restoration module, which is used to restore the document format of the office software so that the document format can be opened and edited by the office software; wherein the document format includes wps, doc, xls, pdf; It also includes a picture file restoration module, which is used to restore the transmitted picture file by parsing the picture file format.

8. The multi-format file restoration system according to claim 1, characterized in that: The system also includes a compressed package file restoration module, which automatically decompresses and extracts files in the compressed package for the compressed files being transmitted, and supports decompression and file extraction of multi-layer compressed packages.

9. The multi-format file restoration system according to claim 1, characterized in that: The system also includes an email file restoration module, which is used to restore the email body and attachment content according to the email transmitted by the email protocol; among them, it supports the restoration of email formats such as eml.

10. A method for implementing the multi-format file restoration system according to any one of claims 1 to 9, characterized in that: The implementation method includes: Monitor network data flow in real time, use the preset protocol feature library to identify data packets of multiple protocols, and extract file data packets by analyzing the data packet structure; the multiple protocols include at least HTTP, SMTP, POP3, IMAP, FTP, SMB, and NFS protocols; Parse the captured file data packets into recognizable file formats; identify the file type by analyzing the data packet file header information and transmission content, and ensure the consistency and integrity of the file content; The file format features are further analyzed in the file type identification results, and the corresponding restoration algorithm is called according to the file type.

Images