Method for increasing NTFS incremental backup speed

Abstract

The invention discloses a method for improving NTFS incremental backup speed, which comprises the following steps: firstly, creating a snapshot for an NTFS partition needing to be backed up by a user, reading DBR information of the NTFS partition needing to be backed up, and judging whether a file system is normal or not according to the DBR information of the partition; reconstructing a block bitmap of the backup mirror image file by reading bitmap information; loading the MFT file record and the MFT record of the NTFS partition in the mirror image file into a memory, comparing the MFT file record of the NTFS partition on the disk with the MFT file record of the NTFS partition in the mirror image file, and generating a new mirror image file bitmap; and executing backup according to the new mirror image file bitmap. According to the method and the device, the snapshot technology is adopted, the state snapshot of the partition can be quickly created under the condition that the system performance is not influenced, the MFT record on the current partition is compared with the record in the mirror image file, the file which is changed since the last backup is intelligently identified, and then only the changed part is backed up, so that the backup efficiency is improved. Therefore, the storage space and time are saved.

Description

Technical Field

[0001] The invention belongs to the technical field of data backup, and in particular is a method for improving NTFS incremental backup speed. Background Art

[0002] Incremental backup is a data backup method. Compared with full backup (backing up all data), incremental backup only backs up the data that has changed since the last backup. Incremental backup is more efficient and saves storage space and time.

[0003] In the prior art, for example, the technical solution described in the patent with publication number CN116909813 is: an incremental backup method and related device, the method includes obtaining a base backup set and its magic number, determining the magic number of the second backup set and switching the block tracking bitmap, then locating the target data page address in the target block tracking bitmap file according to the magic number, and backing up the data page to the backup set, and writing the magic number of the second backup set at the same time. Through the use of the block tracking bitmap, the method can quickly locate the data page of the incremental backup, thereby reducing the loading time.

[0004] Since the traditional incremental backup for NTFS file system usually adopts the solution of comparing data differences block by block for incremental backup, no matter how much data to be backed up is stored in the NTFS file system, it is necessary to compare one by one to find the differences for backup, resulting in low efficiency and slow backup speed. For the customer's production environment, it is necessary to occupy the disk I / O for a long time, affecting the operation of the customer's production environment business. To solve these problems, a method is invented to only back up the data corresponding to the changed file records, thereby accelerating the backup and reducing the impact on the production environment. Summary of the invention

[0005] The purpose of the present invention is to provide a method for improving the speed of NTFS incremental backup, so as to solve the problems of low efficiency and slow backup speed in the prior art of incremental backup by comparing data differences block by block in the background technology.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A method for improving NTFS incremental backup speed includes the following steps:

[0008] Step S1, firstly, create a snapshot of the NTFS partition that the user needs to back up. If the snapshot is successfully created, proceed to the next step. If it fails, exit directly.

[0009] Step S2, reading the first sector of the NTFS partition to be backed up input by the user from the disk for creating the snapshot, obtaining the DBR information of the NTFS partition, and judging whether the file system is normal according to the DBR information of the NTFS partition;

[0010] Step S3, reading bitmap information from the NTFS partition; reconstructing the block bitmap of the backup image file through the read bitmap information;

[0011] Step S4, reading the MFT file record from the DBR information, and writing the MFT file record into the memory;

[0012] Step S5, reading the information of the NTFS partition to be backed up from the created image file; and loading the MFT record of the NTFS partition in the image file into the memory;

[0013] Step S6, comparing the MFT file record of the NTFS partition on the disk with the MFT file record of the NTFS partition in the image file, and generating a new image file bitmap;

[0014] Step S7, performing backup according to the new image file bitmap.

[0015] According to the above technical solution, in step S2, judging whether the file system is normal according to the DBR information specifically includes the following steps:

[0016] First, determine whether the file system identification string is NTFS, if not, exit; if yes, proceed to the next step;

[0017] Determine whether the value of the two bytes at offset 0x0d can be divided by the number of bytes in the sector of the disk, which is used to determine whether the file system is normal. If not, exit; if yes, proceed to the next step;

[0018] The system flag is judged to verify the file system: if the byte at offset 0x1fe is 0x55 and the byte at offset 0x1eff is 0xAA, it means that the system is normal and can be backed up. If not, exit.

[0019] According to the above technical solution, in step S3, the MFT file record is read from the DBR information as follows:

[0020] First, the starting cluster number of the MFT file record is read from the offset 0x30 of the DBR information. After jumping to the sector corresponding to the starting cluster number, the number of sectors of a file record size is read. By parsing the MFT file record and finding the 0x80 attribute of the file record, all file records are parsed and part of the file records are cached in the memory to improve the processing speed.

[0021] According to the above technical solution, in step S5, the information of the NTFS partition to be backed up is read from the image file as follows:

[0022] First, open the image file, read the file record information of the NTFS partition to be backed up from the image file, and read the DBR information of the first sector of the NTFS partition in the image file;

[0023] Determine whether the file system identification string at offset 0x00 is NTFS, if not, exit, if yes, proceed to the next step;

[0024] Determine whether the value of the two bytes at offset 0x0d can be divided by the number of bytes in the sector of the disk. If not, exit. If yes, proceed to the next step.

[0025] Determine whether a byte at offset 0x1fe is 0x55 and whether a byte at offset 0x1eff is 0xAA. If not, exit. If yes, the system is normal and can be backed up.

[0026] According to the above technical solution, the starting cluster number of the MFT file record is read from the DBR information offset 0x30 read from the image file, and the number of sectors of a file record is read after jumping to the starting cluster number according to the read starting cluster number. The MFT file record is parsed and the 0x80 attribute of the file record is found and all file records are parsed, and a part of the file records are cached in the memory.

[0027] According to the above technical solution, in step S6, the MFT file record of the NTFS partition on the disk and the MFT file record of the NTFS partition in the mirror file are compared specifically as follows: by looping through and comparing whether the number of file records of the two MFT file records are consistent, if they are inconsistent, the one with fewer file records is used as the maximum value for the MFT file record comparison, if they are consistent, no processing is performed.

[0028] According to the above technical solution, first determine whether the two MFT file records have the 0x20 attribute. If the 0x20 attribute exists, it needs to be backed up and the next step of comparison is performed. If not, the next step of comparison is performed.

[0029] Determine the 8 bytes at the offset 0x20 of the two MFT file records. If it is not equal to 0, it means that the record is a file index number of a master file table and needs to be backed up and compared in the next step. If it is equal to 0, no processing is done and the next step is compared.

[0030] Determine the two-byte flag bit at the offset 0x16 of the two MFT file records. If the flag here indicates that the file or directory is not in use, it needs to be backed up and a standard attribute comparison is performed; if not, no processing is performed and a standard attribute comparison is performed.

[0031] According to the above technical solution, the standard attributes are more specifically:

[0032] Get the data of the standard attributes in the file records from the two MFT file records respectively, and compare whether the creation time of the file in the standard attributes is consistent with the modification time of the file. If the creation time or modification time of the file on the disk is different from the creation time or modification time of the file in the image, it means that the data of the file on the disk and the data in the image have changed, and need to be backed up and compared in the next step; if they are consistent, no processing is done and the next step is compared;

[0033] Get the number of 0x30 attributes from the two MFT file records respectively. If the 0x30 attribute is not obtained in the file record in the disk or the image file, the data corresponding to the file record is not excluded and needs to be backed up completely. Then proceed to the next step of comparison.

[0034] If there is a 0x30 attribute or multiple 0x30 attributes, you need to loop to determine whether the file names of these 0x30 attributes start with a symbol. If so, you need to back up and enter other items for comparison. If not, skip the file and enter other items for comparison.

[0035] According to the above technical solution, the other items are more specifically:

[0036] Determine from the disk's MFT file record whether the value at the offset 0x16 of the file record header is a flag value. If it is a flag value, it means that the directory has been deleted. The deletion of the directory means that the data related to the directory has changed and needs to be backed up, and then proceed to the next step of comparison. If not, no processing is done and the next step of comparison is proceeded.

[0037] Compare the values ​​at offset 0x16 in the disk's MFT file record and the image's MFT file record to see if they are the same. If they are different, it means the data has changed and needs to be backed up, and the next step of comparison is entered; if they are the same, no processing is done, and the next step of comparison is entered;

[0038] Get the file record data from the two MFT file records, and determine whether the resident attribute flag of the file record data attribute header is resident. If it is a resident attribute, it needs to be backed up and proceed to the next step of comparison; if not, no processing is done and proceed to the next step of comparison;

[0039] Get the 0x80 attribute of the file record data attribute, and determine whether the size of the 0x80 attribute is consistent. If it is inconsistent, it needs to be backed up and enter the next step of comparison. Otherwise, record the data flow of the 0x80 attribute and enter the algorithm process of excluding blocks.

[0040] According to the above technical solution, the block exclusion algorithm is specifically as follows:

[0041] The BIT position of the starting block = (starting sector + the number of sectors in each block - 1) / the number of sectors in each block;

[0042] The BIT bit of the end block = (end sector + number of sectors per block - 1) / number of sectors per block;

[0043] After completing the above steps, enter the next cycle.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] In the present invention, by adopting snapshot technology, a partition state snapshot can be quickly created without affecting system performance. In the process of creating the snapshot, the consistency of the backup data can be ensured, and the problem of incomplete or inconsistent data caused by changes in the data during the backup process can be avoided. By comparing the MFT (master file table) records on the current partition with the records in the image file, the files that have changed since the last backup can be intelligently identified, and only the changed parts can be backed up, thereby saving storage space and time.

[0046] The method of the present invention only needs to read files related to the change, rather than the entire partition, which can reduce IO operations, optimize the use of disk and network resources, and improve the efficiency of the overall backup. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is the main flow chart of incremental backup of the present invention;

[0048] Figure 2 The present invention processes file records and generates a new image file bitmap flow chart. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] Embodiment 1

[0051] like Figure 1A method for improving NTFS incremental backup speed is shown, comprising the following steps:

[0052] Step S1, firstly, create a snapshot of the NTFS partition that the user needs to back up. If the snapshot is successfully created, proceed to the next step. If it fails, exit directly.

[0053] Step S2, reading the first sector of the NTFS partition to be backed up input by the user from the disk for creating the snapshot, obtaining the DBR information of the NTFS partition, and judging whether the file system is normal according to the DBR information of the NTFS partition;

[0054] Step S3, reading bitmap information from the NTFS partition; reconstructing the block bitmap of the backup image file through the read bitmap information;

[0055] Step S4, reading the MFT file record from the DBR information, and writing the MFT file record into the memory;

[0056] Step S5, reading the information of the NTFS partition to be backed up from the created image file; and loading the MFT record of the NTFS partition in the image file into the memory;

[0057] Step S6, comparing the MFT file record of the NTFS partition on the disk with the MFT file record of the NTFS partition in the image file, and generating a new image file bitmap;

[0058] Step S7, performing backup according to the new image file bitmap.

[0059] In the present invention, by adopting snapshot technology, a partition status snapshot can be quickly created without affecting system performance. In the process of creating the snapshot, the consistency of the backup data can be ensured, avoiding data incompleteness or inconsistency problems caused by changes in data during the backup process. By comparing the MFT (master file table) records on the current partition with the records in the mirror file, the files that have changed since the last backup can be intelligently identified, and then only the changed parts are backed up, thereby saving storage space and time.

[0060] The method of the present invention only needs to read files related to the change, rather than the entire partition, which can reduce IO operations, optimize the use of disk and network resources, and improve the efficiency of the overall backup.

[0061] In the present invention, by generating a new image file bitmap, the files to be restored can be quickly located, reducing the restoration time. The system can automatically manage the backup process, allowing users to perform backup and restore operations more conveniently, reducing the risk and complexity of manual operations.

[0062] Embodiment 2

[0063] This embodiment provides a specific implementation method.

[0064] The technical problem to be solved by the present invention comprises the following steps:

[0065] Step 1: First, create a snapshot of the NTFS partition that the user needs to back up. First, try to use the Windows VSS service to create a snapshot of the NTFS partition. If it fails, exit.

[0066] Step 2, read the first sector of the NTFS partition to be backed up input by the user from the disk of the snapshot created in step 1, obtain the DBR of the partition, and determine whether the file system identification string at offset 0x00 is NTFS, if not, exit.

[0067] Determine whether the value of the two bytes at offset 0x0d can be divided exactly by the number of bytes in the th sector of the disk (used to determine whether the file system is normal). If not, exit.

[0068] Then determine whether a byte at offset 0x1fe is 0x55 and whether a byte at offset 0x1eff is 0xAA (used to verify whether the file system is normal). If not, exit.

[0069] Step 3, read the DBR of the NTFS partition from the snapshot in step 1, obtain the size of each file record of the NTFS partition and the total number of sectors of the NTFS partition from the DBR, and calculate the size of each data block during backup based on the maximum number of indexes supported by the image file (the maximum number of bootable images is already defined by the user, and there is no need to create an image file here) and the total number of sectors of the NTFS partition. The specific formula is: size of each backup block = total number of sectors / maximum number of blocks supported by the image file.

[0070] If the total number of sectors is less than or equal to the maximum number of blocks supported by the image file, the size of each backup block is equal to the cluster size of the NTFS partition. The bitmap information of the current partition is read from the NTFS partition, and the block bitmap of the backup image file is reconstructed through the bitmap information of the NTFS partition. The bitmap of the NTFS file system is traversed. If a bit in the bitmap is marked as 1, the bit corresponding to the corresponding data block in the corresponding image file bitmap must also be marked as 1, until the bitmap information of the entire NTFS partition is analyzed and closed, and the original NTFS bitmap is reconstructed into bitmap data suitable for the image file according to the new block size.

[0071] Step 4, read the starting cluster number of the MFT file from the offset 0x30 of the DBR, jump to the sector corresponding to the starting cluster number based on the read starting cluster number, and then read the number of sectors of a file record size (here, find the location of the MFT file through the information in the first sector of the NTFS file system, and then read the data of a file record).

[0072] By parsing the MFT file record and finding the 0x80 attribute of the file record, all file records are parsed and part of the file records are cached in memory (caching part of the file record in memory is mainly to speed up processing, because a file record usually has only 1024 bytes, and it will be very slow if you have to read from the disk once for every 1024 bytes processed).

[0073] Step 5, the following needs to read the information of the NTFS partition to be backed up from the image file. First, open the image file through the image module, and read the file record information of the partition when it was backed up from the image file, locate the location of the partition in the image file, and read the first sector DBR of the partition in the image file, and determine whether the file system identification string at offset 0x00 is NTFS, if not, exit.

[0074] Determine whether the two-byte value at offset 0x0d can be divided by the number of bytes in the disk's sector. If not, exit.

[0075] Then determine whether the byte at offset 0x1fe is 0x55 and whether the byte at offset 0x1eff is 0xAA. If not, exit.

[0076] Step 6, read the starting cluster number of the MFT file from 0x30 of the DBR read from the image file, jump to the starting cluster number based on the read starting cluster number and read the number of sectors of a file record (find the location of the MFT file through the information in the first sector of the NTFS file system, and then read the data of a file record), parse the MFT file record and find the 0x80 attribute of the file record and parse all file records, and cache some file records in memory.

[0077] Step 7. Now we have the file record of the NTFS partition on the disk and the file record of the partition in the historical backup in the image file. First, compare the file record numbers of the two file records to see if they are consistent. If they are inconsistent, the file record with the smaller number will be used as the maximum value for file record comparison.

[0078] Next, we will start looping and comparing the two file records based on the total number of file records, such as Figure 2As shown, if the comparison finds that the two file records have not changed, the data corresponding to this file record is excluded. The specific steps are as follows:

[0079] First, determine whether this file record has the 0x20 attribute. If the 0x20 attribute exists, it does not need to be excluded from the bitmap constructed in step 3. When backing up, all data of file records with the 0x20 attribute must be backed up by default and enter the next loop comparison.

[0080] Determine the 8 bytes at the file record offset 0x20. If it is not equal to 0, it means that the record is a file index number of a master file table. All data of this type of file record needs to be backed up and cannot be excluded from the bitmap constructed in step 3 and enter the next loop.

[0081] Determine the two-byte flag bit at the file record offset 0x16. If the flag here indicates that the file or directory is not in use, skip it directly, do not exclude it from the bitmap constructed in step 3, and enter the next loop.

[0082] Get the data of the standard attributes in the file record from the disk and the image respectively, and compare whether the creation time of the file in the standard attributes is consistent with the modification time of the file. If the creation time or modification time of the file on the disk is different from the creation time or modification time of the file in the image, it means that the data of the file on the disk and the data in the image have changed, so it cannot be excluded from the bitmap constructed in step 3 and enter the next loop.

[0083] Get the number of 0x30 attributes in the file record from the disk and the image file respectively. If no 0x30 attribute is obtained in the file record in the disk or the image file, the data corresponding to the file record is not excluded, because the 0x30 attribute refers to the file name. In the NTFS file system, except for some system-specific files that do not have a file name, other regular files should have a file name. Therefore, it can be determined that most of these files without a file name are system files, so they cannot be excluded and need to be backed up. If there is a 0x30 attribute or multiple 0x30 attributes, it is necessary to loop to determine whether the file names of these 0x30 attributes start with the "$" symbol. If so, they are not excluded, because files starting with "$" are all source files in the NTFS file system. Source files are not excluded and go to the next step;

[0084] Determine from the file record on the disk whether the value at offset 0x16 of the file record header is 2. If it is 2, it means "the directory has been deleted". The deletion of the directory means that the data related to the directory has changed and cannot be excluded from the backup bitmap, and directly enters the next cycle.

[0085] Compare the values ​​at offset 0x16 in the disk's file record and the mirror's file record to see if they are the same. If they are different, it means that the data has changed and cannot be excluded, and enters the next cycle.

[0086] For the file record of the deleted directory and the file record of the mirror, the data stream of 0xa0 of the file record is obtained. First, the numbers of the data streams are compared to see if they are consistent. If they are inconsistent, they cannot be excluded and the next cycle is entered. If the numbers are consistent, the values ​​of the data streams are compared to see if they are consistent. If they are inconsistent, they cannot be excluded and the next cycle is entered. If they are consistent, it means that this directory needs to be excluded, and the recorded data flow is converted into the location of the data block that needs to be backed up and represented as the block that needs to be excluded.

[0087] Get the file record from the disk and the image file record, determine whether the resident attribute flag of its attribute header is resident, if it is a resident attribute, there is no need to exclude it and directly enter the next loop, get the 0x80 attribute of the attribute, and determine whether the size of the base 0x80 attribute is consistent. If it is inconsistent, there is no need to exclude it, which means that the data corresponding to the file record must be different, and enter the next loop, otherwise record the data stream of the 0x80 attribute and enter the algorithm flow of step 17 to exclude the block.

[0088] The algorithm for excluding blocks: the starting sector of the data flow is divided by the number of sectors of each data block to obtain the position of the starting block, and then the total number of sectors is converted according to the total number of clusters of the data flow. The converted total number of sectors is then divided by the number of sectors of each block to finally obtain the number of consecutive blocks. Finally, the positions of the data blocks that need to be backed up corresponding to the starting block and consecutive blocks are set to 0, indicating that these blocks do not need to be backed up. The specific algorithm is as follows:

[0089] The BIT position of the starting block = (starting sector + the number of sectors in each block - 1) / the number of sectors in each block;

[0090] The BIT bit of the end block = (end sector + number of sectors per block - 1) / number of sectors per block;

[0091] After completing the above steps, enter the next cycle.

[0092] So far, the bitmap information of the data blocks of the NTFS partition that needs to be backed up has been constructed. The program can read and back up the data by parsing the sector information corresponding to the constructed bitmap.

[0093] Explanation of professional terms:

[0094] NTFS: (New Technology File System) is a dedicated file system developed by Microsoft. It has become the default file system for the Windows NT family since Windows NT 3.1. It provides a full set of features, including security descriptors, encryption, disk quotas, and rich metadata.

[0095] DBR: DBR (DOS BOOT RECORD) is located at cylinder 0, head 1, sector 1, i.e. logical sector 0. DBR is divided into two parts: DOS boot program and BPB (BIOS parameter block). The DOS boot program locates and loads DOS system files (IO.SYS, MSDOS.SYS), while BPB is used to describe the disk information of this DOS partition. BPB is located at DBR offset 0BH, a total of 13 bytes.

[0096] 0x20 attribute: 0x20 attribute is an attribute list. When a file requires multiple file records, it is used to describe the attribute list of the file.

[0097] 0x30 attribute: 0x30 attribute is the file name attribute, which is used to store the file name.

[0098] 0x80 attribute: The 0x80 attribute is a data stream attribute, which contains the contents of the file. The file size generally refers to the size of the unnamed data stream.

[0099] Attribute 0xa0: The index allocation attribute of the NTFS file system, which stores the location information of all child nodes of the B+ tree directory that makes up the index.

[0100] VSS: VSS stands for Volume Shadow Copy Service, which is used to create file system snapshots. It can capture the status of files and file systems while the operating system is running, and provides the ability to back up open or locked files.

[0101] MFT: Master File Table, $MFT is composed of a file record array.

[0102] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0103] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for improving NTFS incremental backup speed, characterized by: The following steps are involved: Step S1, firstly, create a snapshot of the NTFS partition that the user needs to back up. If the snapshot is successfully created, proceed to the next step. If it fails, exit directly. Step S2, reading the first sector of the NTFS partition to be backed up input by the user from the disk for creating the snapshot, obtaining the DBR information of the NTFS partition, and judging whether the file system is normal according to the DBR information of the NTFS partition; Step S3, reading bitmap information from the NTFS partition; reconstructing the block bitmap of the backup image file through the read bitmap information; Step S4, reading the MFT file record from the DBR information, and writing the MFT file record into the memory; Step S5, reading the information of the NTFS partition to be backed up from the created image file; And load the MFT record of the NTFS partition in the image file into memory; Step S6, comparing the MFT file record of the NTFS partition on the disk with the MFT file record of the NTFS partition in the image file, and generating a new image file bitmap; Step S7, performing backup according to the new image file bitmap.

2. The method for improving NTFS incremental backup speed according to claim 1, characterized in that: In step S2, judging whether the file system is normal according to the DBR information specifically includes the following steps: First, determine whether the file system identification string is NTFS, if not, exit; if yes, proceed to the next step; Determine whether the value of the two bytes at offset 0x0d can be divided by the number of bytes in the sector of the disk, which is used to determine whether the file system is normal. If not, exit; if yes, proceed to the next step; The system flag is judged to verify the file system: if the byte at offset 0x1 fe is 0x55 and the byte at offset 0x1 eff is 0xAA, the system is normal and can be backed up. If not, exit.

3. A method for improving NTFS incremental backup speed according to claim 2, characterized in that: In step S3, the MFT file record is read from the DBR information as follows: First, the starting cluster number of the MFT file record is read from the offset 0x30 of the DBR information. After jumping to the sector corresponding to the starting cluster number, the number of sectors of a file record size is read. By parsing the MFT file record and finding the 0x80 attribute of the file record, all file records are parsed and part of the file records are cached in the memory to improve the processing speed.

4. The method for improving NTFS incremental backup speed according to claim 3, characterized in that: In step S5, the information of the NTFS partition to be backed up is read from the image file: First, open the image file, read the file record information of the NTFS partition to be backed up from the image file, and read the DBR information of the first sector of the NTFS partition in the image file; Determine whether the file system identification string at offset 0x00 is NTFS, if not, exit, if yes, proceed to the next step; Determine whether the value of the two bytes at offset 0x0d can be divided by the number of bytes in the sector of the disk. If not, exit. If yes, proceed to the next step. Determine whether a byte at offset 0x1 fe is 0x55 and whether a byte at offset 0x1 eff is 0xAA. If not, exit. If yes, the system is normal and can be backed up.

5. The method for improving NTFS incremental backup speed according to claim 4, characterized in that: The starting cluster number of the MFT file record is read from the DBR information offset 0x30 read from the image file. After jumping to the starting cluster number, the number of sectors of a file record is read. By parsing the MFT file record and finding the 0x80 attribute of the file record, all file records are parsed and a part of the file records are cached in the memory.

6. The method for improving NTFS incremental backup speed according to claim 1, characterized in that: In step S6, the MFT file record of the NTFS partition on the disk and the MFT file record of the NTFS partition in the mirror file are compared specifically as follows: by looping through and comparing whether the number of file records in the two MFT file records is consistent, if not, the one with fewer file records is used as the maximum value for MFT file record comparison, if they are consistent, no processing is performed.

7. A method for improving NTFS incremental backup speed according to claim 6, characterized in that: First, determine whether the two MFT file records have the 0x20 attribute. If the 0x20 attribute exists, it needs to be backed up and compared in the next step. If not, proceed to the next step. Determine the 8 bytes at the offset 0x20 of the two MFT file records. If it is not equal to 0, it means that the record is a file index number of a master file table and needs to be backed up and compared in the next step. If it is equal to 0, no processing is done and the next step is compared. Determine the two-byte flag bit at the offset 0x16 of the two MFT file records. If the flag here indicates that the file or directory is not in use, it needs to be backed up and a standard attribute comparison is performed; if not, no processing is performed and a standard attribute comparison is performed.

8. The method for improving NTFS incremental backup speed according to claim 7, characterized in that: The standard properties are more specific: Get the data of the standard attributes in the file records from the two MFT file records respectively, and compare whether the creation time of the file in the standard attributes is consistent with the modification time of the file. If the creation time or modification time of the file on the disk is different from the creation time or modification time of the file in the image, it means that the data of the file on the disk and the data in the image have changed, and need to be backed up and compared in the next step; if they are consistent, no processing is done and the next step is compared; Get the number of 0x30 attributes from the two MFT file records respectively. If the 0x30 attribute is not obtained in the file record in the disk or the image file, the data corresponding to the file record is not excluded and needs to be backed up completely. Then proceed to the next step of comparison. If there is a 0x30 attribute or multiple 0x30 attributes, you need to loop to determine whether the file names of these 0x30 attributes start with a symbol. If so, you need to back up and enter other items for comparison. If not, skip the file and enter other items for comparison.

9. The method for improving NTFS incremental backup speed according to claim 1, characterized in that: Other items are more specific: Determine from the disk's MFT file record whether the value at the offset 0x16 of the file record header is a flag value. If it is a flag value, it means that the directory has been deleted. The deletion of the directory means that the data related to the directory has changed and needs to be backed up, and then proceed to the next step of comparison. If not, no processing is done and the next step of comparison is proceeded. Compare the values ​​at offset 0x16 in the disk's MFT file record and the image's MFT file record to see if they are the same. If they are different, it means the data has changed and needs to be backed up, and the next step of comparison is entered; if they are the same, no processing is done, and the next step of comparison is entered; Get the file record data from the two MFT file records, and determine whether the resident attribute flag of the file record data attribute header is resident. If it is a resident attribute, it needs to be backed up and proceed to the next step of comparison; if not, no processing is done and proceed to the next step of comparison; Get the 0x80 attribute of the file record data attribute, and determine whether the size of the 0x80 attribute is consistent. If it is inconsistent, it needs to be backed up and enter the next step of comparison. Otherwise, record the data flow of the 0x80 attribute and enter the algorithm process of excluding blocks.

10. The method for improving NTFS incremental backup speed according to claim 9, characterized in that: The specific algorithm for excluding blocks is: BI T bit of the starting block = (starting sector + number of sectors per block - 1) / number of sectors per block; The BIT bit of the end block = (end sector + number of sectors per block - 1) / number of sectors per block; After completing the above steps, enter the next cycle.

Images