A solid-state storage hard disk data recovery method and system

Abstract

The present invention discloses a method and system for recovering data from a solid-state storage hard drive, relating to the field of data processing technology. The method comprises: performing differential analysis on the historical log status characteristics and health status characteristics stored on the solid-state hard drive, and identifying data loss events of the solid-state hard drive based on the differential analysis results; constructing a data recovery mechanism based on abnormal data loss events, and recovering the lost data of the solid-state hard drive based on the data recovery mechanism; performing verification and evaluation on the recovered data, and optimizing the data recovery mechanism based on the verification and evaluation results. The present invention combines differentiated technical means such as metadata repair, backtracking reasoning, and data carving to achieve classified positioning, cause identification, and structured repair of lost data, effectively improving the pertinence, accuracy, and automation of data recovery.

Description

Technical Field

[0001] The present invention relates to a data processing module, and in particular to a solid-state storage hard disk data recovery method and system. Background Art

[0002] Solid-state drive (SSD) data refers to all information stored in the SSD using flash memory chips as the medium. It mainly includes user-level data, system-level data, file system metadata, flash translation layer mapping tables maintained by the controller, cache data, and log information, etc. This data together supports the read and write operations of the SSD under high performance and high reliability conditions.

[0003] Data recovery for solid-state storage hard drives is to ensure data integrity, business continuity and system stability. Since SSDs use a flash conversion layer and garbage collection mechanism, data is physically stored non-sequentially, mappings change dynamically and are susceptible to anomalies. Data loss, mapping table damage or page data unlocatable may occur due to various factors such as misoperation, abnormal attacks and environmental interference. If recovery cannot be implemented for different loss causes, the recovery strategy will be single and the location and structural relationship of lost data cannot be accurately located. This may lead to serious consequences such as data overwriting, broken mapping chains, unverifiable recovered data or permanent loss of business data, thereby threatening data security and availability.

[0004] Currently, no effective solutions have been proposed for the problems in related technologies. Summary of the Invention

[0005] In response to the problems in the related art, the present invention proposes a solid-state storage hard disk data recovery method and system to overcome the above technical problems existing in the existing related art.

[0006] To this end, the specific technical solutions adopted in the present invention are as follows:

[0007] According to one aspect of the present invention, a method for recovering data from a solid-state storage hard disk is provided, the method comprising:

[0008] Perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. Data loss events include human error events, abnormal attack events, and environmental interference events.

[0009] Build a data recovery mechanism based on abnormal data loss events, and recover lost data from solid-state drives based on the data recovery mechanism;

[0010] Perform verification and evaluation on the recovered data, and optimize the data recovery mechanism based on the verification and evaluation results.

[0011] Preferably, building a data recovery mechanism based on the abnormal data loss event, and recovering the lost data of the solid-state drive based on the data recovery mechanism includes:

[0012] Based on human error events, metadata repair technology is used to repair lost data caused by human error;

[0013] Based on abnormal attack events, the backtracking reasoning algorithm is used to reversely infer the attack source, and the lost data caused by the abnormal attack is corrected according to the reverse reasoning results;

[0014] Based on environmental interference events, a data carving algorithm is used to reconstruct the flash translation layer mapping table, and the lost data caused by environmental interference is reconstructed through the flash translation layer mapping table.

[0015] Preferably, based on the abnormal attack event, reverse reasoning the attack source using a backtracking reasoning algorithm, and correcting the lost data caused by the abnormal attack according to the reverse reasoning result includes:

[0016] Collect abnormal access nodes of SSD storage data when abnormal attack events are triggered, and build a monitoring path matrix representing the access path correlation strength based on the mapping relationship between abnormal access nodes and original data blocks;

[0017] The initial parameters of the backtracking reasoning algorithm are set. Based on the predefined correlation coefficient, the access nodes in the monitoring path matrix that are most relevant to the abnormal attack event are searched as candidate attack sources. The initial support set for backtracking reasoning is constructed based on the candidate attack sources.

[0018] Iteratively calculate the strength estimation value of each candidate attack source leading to the original data block, re-screen the candidate attack source with the greatest contribution based on the strength estimation value, and update the initial support set to obtain the backtracking reasoning support set;

[0019] The sparse regression residual function is used to calculate the residual vector of each candidate attack source in the backtracking reasoning support set, and the residual vector is compared with the preset threshold;

[0020] If the residual vector is less than the preset threshold, the backtracking reasoning is terminated and the candidate attack source with the minimum residual vector in the backtracking reasoning support set is selected as the final attack source. Otherwise, the iterative calculation continues;

[0021] The sparse coefficient vector of the final attack source is calculated and substituted into the constructed data correction function to generate the approximate reconstruction result of the original data block of the solid-state drive, and the approximate reconstruction result is encrypted and migrated to the secure data block.

[0022] Preferably, the strength estimation value of each candidate attack source leading to the original data block is iteratively calculated, the candidate attack source with the greatest contribution is re-screened based on the strength estimation value, and the initial support set is updated to obtain the backtracking reasoning support set including:

[0023] Use the regularization function to process the feature data of the candidate attack sources in the initial support set to obtain the regularized feature vector of each attack source;

[0024] Sort the regularized feature vectors in descending order, select the attack source indexes corresponding to the first several regularized feature vectors to construct a new support set, and use the new support set as the preliminary backtracking support set for the current iteration round;

[0025] According to the attack source index of the preliminary backtracking support set, the corresponding columns are extracted and a sub-matrix is ​​constructed. The output strength estimation value vector is fitted to the pre-sub-matrix using the least squares method.

[0026] The strength estimation value vectors are sorted, and the attack source index corresponding to the strength estimation value vector with the largest component among the first several is selected to update the preliminary backtracking support set to obtain the backtracking reasoning support set.

[0027] Preferably, encrypting and migrating the approximate reconstruction result to the secure data block includes:

[0028] The corrected approximate reconstruction result is divided into a predetermined size to generate a number of logical data blocks, each logical data block is represented by a block number and block content as a key-value pair;

[0029] The key-value pairs of the logical data blocks are distributed as input to the mapping nodes in the map-reduce framework. Each mapping node independently encrypts the content of the block it is assigned and retains the block number.

[0030] After encryption is completed, each mapping node outputs an encrypted key-value pair and distributes the encrypted key-value pair as input to the specification node in the mapping specification framework. After receiving the encrypted key-value pair, the specification node sorts the block numbers to restore the order of the original data blocks;

[0031] The block contents corresponding to the encryption key values ​​are integrated according to the order of the original data blocks to obtain the encrypted data blocks, and the encrypted data blocks replace the original data blocks and are migrated to the secure data block storage area.

[0032] Preferably, based on the environmental interference event, the flash translation layer mapping table is rebuilt using a data carving algorithm, and the lost data caused by the environmental interference is rebuilt using the flash translation layer mapping table, including:

[0033] Collect the physical block interference area of ​​the solid-state drive when the environmental interference event is triggered, and extract the valid mapping table fragment from the undamaged physical block interference area;

[0034] A data carving algorithm is used to extract contextual features of valid mapping table fragments and use them as input to train a conditional generative adversarial network. The generator constructs the mapping relationship between logical data blocks and physical blocks, and the discriminator evaluates the consistency of the mapping relationship.

[0035] Wasserstein loss and gradient penalty are used to train the conditional generative adversarial network, and the flash conversion layer mapping table is output through the conditional generative adversarial network;

[0036] The reconstructed flash translation layer mapping table is used to locate the original logical page data features, and the missing page content is reconstructed using the context data block of the original logical page data features.

[0037] Preferably, extracting context features of valid mapping table segments using a data carving algorithm includes:

[0038] Extract the original logical page from the valid mapping table fragment, construct a sparse matrix of the mapping relationship between the logical data block and the physical block, and build an enhanced matrix decomposition model based on the context features of each sparse matrix;

[0039] The context features of the sparse matrix are fused to form a context feature vector, and the enhanced matrix decomposition model is used to score the confidence of the context feature vector to screen high-confidence context features.

[0040] Preferably, the enhanced matrix decomposition model is used to perform confidence scoring on the context feature vector, and screening high-confidence context features includes:

[0041] The context feature vectors in the original logical page are used to construct scoring candidate segments, and the enhanced matrix factorization model is used to calculate the local confidence score and global importance score corresponding to the random context feature vectors in the scoring candidate segments in the context.

[0042] The context feature vectors whose local confidence scores are higher than the global importance scores are regarded as local noises that deviate from the global pattern and are removed from the candidate segments for scoring;

[0043] The remaining scoring candidate segments are taken as high-confidence scoring candidate segments, and the high-confidence scoring candidate segments are used as the enhanced matrix decomposition model to screen high-confidence context features.

[0044] Preferably, the expression of Wasserstein loss is:

[0045] ;

[0046] Where, W represents the Wasserstein distance; E Indicates averaging the entire data distribution; Represents a sample The data distribution generated by the generator; Representation sample The real data distribution; Represents the output value of the discriminator; Indicates the generated sample score; represents the true sample score.

[0047] According to another embodiment of the present invention, a solid-state storage hard disk data recovery system is provided, the system comprising:

[0048] The data loss analysis module is used to perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. Data loss events include human error events, abnormal attack events, and environmental interference events.

[0049] A data recovery processing module is used to build a data recovery mechanism based on abnormal data loss events and recover lost data from the solid-state drive based on the data recovery mechanism;

[0050] The data verification and evaluation module is used to verify and evaluate the recovered data and optimize the data recovery mechanism based on the verification and evaluation results.

[0051] The beneficial effects of the present invention are:

[0052] 1. This invention targets three typical data loss scenarios: human error, abnormal attack, and environmental interference. Combining differentiated technical means such as metadata repair, backtracking reasoning, and data carving, it achieves the classification and location, cause identification, and structured repair of lost data, effectively improving the pertinence, accuracy, and automation of data recovery. It not only enhances the recovery process's adaptability to multiple types of failure mechanisms, but also significantly improves the data integrity protection level and the fault tolerance of the storage system.

[0053] 2. The present invention gradually and accurately locates the source of attack through the backtracking reasoning algorithm. On the basis of constructing the monitoring path matrix, screening the initial support set, iteratively calculating the strength estimation value, introducing regularization and least squares method to optimize the support set update, and combining sparse regression residuals to determine the optimal attack source, it achieves high-precision correction of tampered or lost data. At the same time, after encrypting the reconstruction results, the logical data blocks are sorted, integrated and securely migrated through the mapping specification framework, which not only improves the accuracy of the recovery process, but also enhances the security and consistency of the data after migration, and has good practicality and security capabilities.

[0054] 3. The present invention extracts valid mapping table fragments and their contextual features in undamaged physical blocks through a data carving algorithm, uses contextual features to construct a sparse matrix and fuses them to form a contextual feature vector, further introduces an enhanced matrix decomposition model for confidence scoring to screen out high-confidence features, effectively avoiding local noise interference, and combines Wasserstein loss and gradient penalty to achieve high-stability reconstruction of the mapping table on the basis of the generator constructing the mapping relationship between logical data and physical blocks and the discriminator evaluating their consistency, ultimately achieving precise positioning of logical page data features and contextual reconstruction of missing page content, significantly improving recovery accuracy, fault tolerance and model generalization capabilities in scenarios of physical damage or page table loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 is a flow chart of a method for recovering data from a solid-state storage hard disk according to an embodiment of the present invention;

[0057] Figure 2 This is a principle block diagram of a solid-state storage hard disk data recovery system according to an embodiment of the present invention;

[0058] Figure 3 The present invention is a flowchart of a method for recovering data from a solid-state storage hard disk that causes an abnormal attack.

[0059] In the picture:

[0060] 1. Data loss analysis module; 2. Data recovery processing module; 3. Data verification and evaluation module. DETAILED DESCRIPTION

[0061] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention. They are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. By referring to these contents, ordinary technicians in this field should be able to understand other possible implementation methods and the advantages of the present invention.

[0062] According to an embodiment of the present invention, a method and system for recovering data from a solid-state storage hard disk are provided.

[0063] The present invention will now be further described with reference to the accompanying drawings and specific embodiments. Figure 1As shown, a method for recovering data from a solid-state storage hard disk according to an embodiment of the present invention includes:

[0064] S1. Perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. Data loss events include human error events, abnormal attack events, and environmental interference events.

[0065] It should be noted that the historical log status characteristics and current health status characteristics, the historical log status characteristics include logical block access frequency, write / erase times, system IO log, operation instruction sequence, historical temperature, voltage, current and other timing characteristics; the health status characteristics mainly come from the current internal status monitoring indicators, such as the number of bad pages, ECC error correction failures, current temperature, power outage times, mapping table consistency, etc.

[0066] The historical log status features and current health status features are differentially analyzed through time series alignment, window aggregation and structured processing. The change rate, difference, cumulative deviation and other indicators of each feature are calculated to form a differential feature vector. The differential features are modeled using an unsupervised anomaly detection algorithm to identify data points that deviate from the normal pattern.

[0067] Among them, human error operations manifest as block erasure, accidental deletion and other operations after legal IO operations; attack behaviors often manifest as illegal instruction access, frequent remapping, surge in ECC errors, and sudden changes in access entropy; environmental interference is often accompanied by temperature, voltage, power supply fluctuations and a wide range of health parameter abnormalities.

[0068] S2. Build a data recovery mechanism based on abnormal data loss events, and recover the lost data of the solid-state drive based on the data recovery mechanism.

[0069] Specifically, building a data recovery mechanism based on abnormal data loss events and recovering lost data from the solid-state drive based on the data recovery mechanism includes:

[0070] Based on human error events, metadata repair technology is used to repair lost data caused by human error.

[0071] It should be noted that the characteristics of erroneous operation behavior are identified; key metadata information, such as the file system's inode table and directory structure, are extracted from the log system or metadata backup within the time window to restore the version history of the damaged data structure; the remaining position of the mistakenly deleted data in the storage medium is located through metadata residual analysis technology (such as block redundancy comparison, address reference counting, and deleted block scanning); an index relationship is established between the restored file metadata structure and the actual data block mapping, and the data is mounted on a temporary file system for verification and export, thereby achieving effective repair and recovery of the erroneous operation data.

[0072] Based on abnormal attack events, the backtracking reasoning algorithm is used to reversely infer the attack source, and the lost data caused by the abnormal attack is corrected according to the reverse reasoning results.

[0073] Among them, such as Figure 3 As shown in the figure, based on the abnormal attack event, the backtracking reasoning algorithm is used to reversely infer the attack source, and the lost data caused by the abnormal attack is corrected according to the reverse reasoning result, including:

[0074] The abnormal access nodes of the solid-state drive storage data when the abnormal attack event is triggered are collected, and based on the mapping relationship between the abnormal access nodes and the original data blocks, a monitoring path matrix representing the access path association strength is constructed.

[0075] It should be noted that the diffusion pattern and propagation path of attack behavior in the storage access path are accurately captured to reveal the potential correlation between the attacker's operation logic and the underlying data structure; secondly, the concentration and persistence of abnormal access are quantified through the intensity information in the path matrix, thereby assisting in judging whether the attack is systematic and destructive, and improving the ability to identify complex behaviors such as multi-hop attacks, persistent access and disguised operations.

[0076] The initial parameters of the backtracking reasoning algorithm are set. Based on the predefined correlation coefficient, the access nodes in the monitoring path matrix that are most relevant to the abnormal attack event are searched as candidate attack sources. The initial support set for backtracking reasoning is constructed based on the candidate attack sources.

[0077] The strength estimation value of each candidate attack source leading to the original data block is iteratively calculated. Based on the strength estimation value, the candidate attack source with the greatest contribution is re-screened, and the initial support set is updated to obtain the backtracking reasoning support set.

[0078] The strength estimation value of each candidate attack source leading to the original data block is iteratively calculated. Based on the strength estimation value, the candidate attack source with the largest contribution is re-screened, and the initial support set is updated to obtain the backtracking reasoning support set including:

[0079] The regularization function is used to process the feature data of the candidate attack sources in the initial support set to obtain the regularized feature vector of each attack source.

[0080] It should be noted that the regularization function is used to process the feature data of the candidate attack sources in the initial support set, and the regularized feature vector of each attack source is obtained, including:

[0081] Extract the original feature data of each candidate attack source from the initial support set to form the original feature vector of the attack source; use min-max normalization to normalize the different feature dimensions to eliminate the influence of different dimensions on subsequent analysis; introduce a regularization function (such as L1 norm or L2 norm) to regularize the preprocessed feature vector; use the cost function minimization method to solve the constraints in the regularization optimization process, and finally solve the regularized feature vector of each candidate attack source, which is expressed as follows:

[0082] ;

[0083] Where, R ( x ) represents the selected regularization term, λ represents the regularization strength hyperparameter; J ( x ) represents the objective function; x Represents the original attack source feature vector; Indicates the ideal reference value of the attack source feature vector.

[0084] Sort the regularized feature vectors in descending order, select the attack source indexes corresponding to the first several regularized feature vectors to construct a new support set, and use the new support set as the preliminary backtracking support set for the current iteration round;

[0085] According to the attack source index of the preliminary backtracking support set, the corresponding columns are extracted and a sub-matrix is ​​constructed. The output strength estimation value vector is fitted to the pre-sub-matrix using the least squares method.

[0086] It should be noted that according to the attack source index identified in the initial backtracking support set, the corresponding columns are extracted from the original monitoring path matrix to construct a submatrix. Let the original matrix be A ∈ R m×n , the support set index corresponding columns form a submatrix As ∈ R m×k ; Analyze target observation vector b ∈ R m , the target observation vector represents the actual collected path access intensity or abnormal behavior impact, and the least squares method is used to solve A s x = b An approximate solution ofx ∈R k is the attack source strength weight vector to be estimated; the least squares solution is obtained by optimizing the objective function Obtained, that is, through the pseudo-inverse equation Get an analytical solution; if the matrix condition is poor, regularization (ridge regression) can be introduced to enhance the stability of the solution; the final output vector x That is, it is the strength estimation value of each preliminary backtracking attack source under the current access path.

[0087] The strength estimation value vectors are sorted, and the attack source index corresponding to the strength estimation value vector with the largest component among the first several is selected to update the preliminary backtracking support set to obtain the backtracking reasoning support set.

[0088] The sparse regression residual function is used to calculate the residual vector of each candidate attack source in the backtracking reasoning support set, and the residual vector is compared with the preset threshold.

[0089] It should be noted that the sparse regression residual function is a function used to measure the fitting ability of the feature vector under sparse modeling conditions, which is usually constructed as ,in y represents the observation vector; A s Represents the characteristic sub-matrix composed of candidate attack sources; x Represents the sparse coefficient solution obtained by sparse backpropagation, the residual vector r It reflects the insufficient explanatory power of the current candidate attack source combination for abnormal observations. By comparing the residual vector with the preset error threshold, it effectively eliminates candidate attack sources with poor fitting ability and high reconstruction error, and screens out key attack sources with high contribution and strong structural fitting in the current abnormal behavior. At the same time, it suppresses the interference of pseudo-correlation or collinear features, and improves the accuracy and interpretability of attack path tracking.

[0090] If the residual vector is less than the preset threshold, the backtracking reasoning is terminated and the candidate attack source with the minimum residual vector in the backtracking reasoning support set is selected as the final attack source. Otherwise, the iterative calculation continues;

[0091] The sparse coefficient vector of the final attack source is calculated and substituted into the constructed data correction function to generate the approximate reconstruction result of the original data block of the solid-state drive, and the approximate reconstruction result is encrypted and migrated to the secure data block.

[0092] The encryption and migration of the approximate reconstruction results to the secure data block includes:

[0093] The corrected approximate reconstruction result is divided into a predetermined size to generate a number of logical data blocks, each logical data block is represented by a block number and block content as a key-value pair;

[0094] The key-value pairs of the logical data blocks are distributed as input to the mapping nodes in the map-reduce framework. Each mapping node independently encrypts the content of the block it is assigned and retains the block number.

[0095] After encryption is completed, each mapping node outputs an encrypted key-value pair and distributes the encrypted key-value pair as input to the specification node in the mapping specification framework. After receiving the encrypted key-value pair, the specification node sorts the block numbers to restore the order of the original data blocks;

[0096] The block contents corresponding to the encryption key values ​​are integrated according to the order of the original data blocks to obtain the encrypted data blocks, and the encrypted data blocks replace the original data blocks and are migrated to the secure data block storage area.

[0097] It should be noted that by dividing the corrected approximate reconstruction results into logical data blocks and introducing distributed processing in the mapping specification framework, parallel encryption and orderly reconstruction of data blocks are achieved, thereby significantly improving data processing efficiency and system throughput.

[0098] At the same time, each mapping node independently encrypts the content of its assigned data block and retains only the block number, which enhances the isolation and local security of data during processing and reduces the overall risk brought by single-node leakage; the specification node sorts according to the block number and reconstructs the original order, effectively ensuring data integrity and structural correctness, and avoiding the order disorder introduced by encrypted distribution.

[0099] Based on environmental interference events, a data carving algorithm is used to reconstruct the flash translation layer mapping table, and the lost data caused by environmental interference is reconstructed through the flash translation layer mapping table.

[0100] It should be noted that in environmental interference events (such as sudden power outages and sudden failures of solid-state drives), the original mapping information is extremely easy to be lost or damaged. Reconstructing the flash translation layer mapping table using a data carving algorithm can extract residual information from physical pages that have not been covered or erased in the flash memory medium, and restore the mapping relationship from logical to physical addresses by analyzing valid data fragments, logical page number identifiers, write sequence information, etc. in the physical blocks. The beneficial effect of this combination is that it can bypass the failed controller cache or metadata storage area and directly reverse restore the core mapping structure of the FTL from the underlying physical data, thereby achieving the recovery of critical data in extreme cases where the original mapping table is not available or the mapping table is severely damaged.

[0101] Among them, based on the environmental interference event, the data carving algorithm is used to reconstruct the flash translation layer mapping table, and the lost data caused by the environmental interference is reconstructed through the flash translation layer mapping table, including:

[0102] Collect the physical block interference area of ​​the solid-state drive when the environmental interference event is triggered, and extract the valid mapping table fragment from the undamaged physical block interference area;

[0103] The data carving algorithm is used to extract the contextual features of the valid mapping table fragments and use them as input to train a conditional generative adversarial network. The generator constructs the mapping relationship from logical data blocks to physical blocks, and the discriminator evaluates the consistency of the mapping relationship.

[0104] It should be noted that the data carving algorithm is a technology that reversely infers data structure, logical relationship and mapping information by directly analyzing the original physical data remaining in the storage medium (such as page identifiers, redundancy checks, write order, LBA residual bits, etc.) in the absence of original metadata or mapping information.

[0105] A data carving algorithm is used to extract contextual features of valid mapping table fragments as input to a conditional generative adversarial network, thereby training a context-aware generator to automatically complete the mapping relationship between missing logical data blocks and physical blocks. At the same time, the discriminator scores the rationality and consistency of the generated mapping, thereby realizing mapping reconstruction in the case of environmental interference or mapping damage. The effect is to improve the accuracy of mapping reconstruction, maintain logical consistency, and significantly enhance the integrity and intelligence level of data recovery.

[0106] The context features of extracting valid mapping table fragments using the data carving algorithm include:

[0107] Extract the original logical page from the valid mapping table fragment, construct a sparse matrix of the mapping relationship between the logical data block and the physical block, and build an enhanced matrix decomposition model based on the context features of each sparse matrix;

[0108] The context features of the sparse matrix are fused to form a context feature vector, and the enhanced matrix decomposition model is used to score the confidence of the context feature vector to screen high-confidence context features.

[0109] Among them, the enhanced matrix decomposition model is used to score the confidence of the context feature vector, and the high-confidence context features are selected, including:

[0110] The context feature vectors in the original logical page are used to construct scoring candidate segments, and the enhanced matrix factorization model is used to calculate the local confidence score and global importance score corresponding to the random context feature vectors in the scoring candidate segments in the context.

[0111] The context feature vectors whose local confidence scores are higher than the global importance scores are regarded as local noises that deviate from the global pattern and are removed from the candidate segments for scoring;

[0112] The remaining scoring candidate segments are taken as high-confidence scoring candidate segments, and the high-confidence scoring candidate segments are used as the enhanced matrix decomposition model to screen high-confidence context features.

[0113] Wasserstein loss and gradient penalty are used to train the conditional generative adversarial network, and the flash conversion layer mapping table is output through the conditional generative adversarial network.

[0114] It should be noted that a training dataset is constructed, in which each sample includes a known logical page number, its possible corresponding physical page number (PPN) fragment, and contextual structural features as input to the conditional generative adversarial network. During the training phase, the generator uses the conditional features as a guide to generate mappings from logical data blocks to physical data blocks, while the discriminator receives the real and generated mapping pairs and judges their authenticity and structural consistency. To improve training stability and generation quality, the Wasserstein loss function is introduced:

[0115] ;

[0116] Where, W represents the Wasserstein distance; E Indicates averaging the entire data distribution; Representation sample The data distribution generated by the generator; Representation sample The real data distribution; Represents the output value of the discriminator; Indicates the generated sample score; represents the true sample score.

[0117] Replace the logarithmic loss of traditional GAN ​​to solve the problem of training instability and add a gradient penalty term:

[0118] ;

[0119] Where, GP represents the gradient penalty term; λ represents the gradient penalty coefficient; In real sample x and generate samples The samples obtained by linear interpolation between Represents the discriminator output about the generated sample gradient;

[0120] The generator and discriminator are trained alternately, and through multiple rounds of iterative optimization, the generator gradually learns and outputs an FTL mapping table structure that is more in line with the actual distribution. After training, the generator is used to directly output the mapping information from logical page numbers to physical page numbers under new input conditions, reconstructing missing or damaged FTL mapping tables, providing structural support and automatic mapping capabilities for data reconstruction caused by environmental interference.

[0121] The reconstructed flash translation layer mapping table is used to locate the original logical page data features, and the missing page content is reconstructed using the context data block of the original logical page data features.

[0122] It should be noted that the corresponding relationship of logical pages in physical storage is accurately located through the reconstructed flash translation layer mapping table, so that the original logical page data characteristics can be restored, and the content is reconstructed in combination with its context data block, making full use of logical continuity, access mode and data adjacency to improve the reconstruction accuracy of missing pages, thereby enhancing data integrity recovery capabilities, especially suitable for page-level data loss scenarios caused by abnormal power outages or media damage.

[0123] S3. Verify and evaluate the recovered data, and optimize the data recovery mechanism based on the verification and evaluation results.

[0124] It should be noted that the recovered data is verified and evaluated to identify errors, missing or redundant content in the recovered data; the verification results are quantified into an evaluation index vector, the data recovery quality of each recovery path or topological node is recorded, and paths or nodes with low recovery accuracy are identified through clustering, score sorting, etc.; the access logs, mapping reconstruction records and error distribution characteristics during the recovery process are combined to construct a topological dependency graph of the data recovery process, and the recovery credibility of each node is marked; the feedback information is used to adjust the key parameters in the topology mechanism to strengthen the information of high-credibility paths and suppress the influence of low-quality paths, thereby realizing dynamic optimization and adaptive adjustment of the data recovery topology structure.

[0125] According to another aspect of the present invention, Figure 2 As shown, a solid-state storage hard disk data recovery system is also provided, the system comprising:

[0126] Data loss analysis module 1 is used to perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. Data loss events include human error events, abnormal attack events, and environmental interference events.

[0127] Data recovery processing module 2, used to build a data recovery mechanism based on data loss abnormal events, and recover the lost data of the solid state drive based on the data recovery mechanism;

[0128] The data verification and evaluation module 3 is used to verify and evaluate the restored data and optimize the data recovery mechanism according to the verification and evaluation results.

[0129] The data loss analysis module 1 is connected to the data recovery processing module 2 , and the data recovery processing module 2 is connected to the data verification and evaluation module 3 .

[0130] In summary, with the help of the above technical solutions of the present invention, the present invention realizes the classification location, cause identification and structured repair of lost data by combining differentiated technical means such as metadata repair, backtracking reasoning and data carving for three typical data loss scenarios of human error, abnormal attack and environmental interference, effectively improving the pertinence, accuracy and automation of data recovery, not only enhancing the adaptability of the recovery process to multiple types of failure mechanisms, but also significantly improving the data integrity protection level and the fault tolerance of the storage system. The present invention gradually and accurately locates the attack source through the backtracking reasoning algorithm, and realizes high-precision correction of tampered or lost data on the basis of constructing a monitoring path matrix, screening the initial support set, iteratively calculating the strength estimate, introducing regularization and least squares method to optimize the support set update, and combining sparse regression residuals to determine the optimal attack source. At the same time, after encrypting the reconstruction results, the logical data blocks are sorted, integrated and securely migrated through the mapping specification framework, which not only improves the accuracy of the recovery process, but also enhances the security and consistency of the data after migration, and has good practicality and security protection capabilities. The present invention extracts valid mapping table fragments and their contextual features in undamaged physical blocks through a data carving algorithm, uses the contextual features to construct a sparse matrix and fuses them to form a contextual feature vector, further introduces an enhanced matrix decomposition model for confidence scoring to screen out high-confidence features, effectively avoiding local noise interference. On the basis of the generator constructing the mapping relationship between logical data and physical blocks and the discriminator evaluating their consistency, the Wasserstein loss and gradient penalty are combined to achieve high-stability reconstruction of the mapping table, and finally achieve precise positioning of logical page data features and context reconstruction of missing page content, significantly improving recovery accuracy, fault tolerance and model generalization capabilities in scenarios of physical damage or page table loss.

[0131] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for recovering data from a solid-state storage hard disk, characterized in that: The method includes: Perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. The data loss events include human error events, abnormal attack events, and environmental interference events. Build a data recovery mechanism based on abnormal data loss events, and recover lost data from solid-state drives based on the data recovery mechanism; Perform verification and evaluation on the recovered data, and optimize the data recovery mechanism based on the verification and evaluation results. The method of constructing a data recovery mechanism based on a data loss abnormality event and recovering lost data of a solid-state drive based on the data recovery mechanism includes: Based on abnormal attack events, the backtracking reasoning algorithm is used to reversely infer the attack source, and the lost data caused by the abnormal attack is corrected based on the reverse reasoning results. Specifically, the following are included: Collect abnormal access nodes of SSD storage data when abnormal attack events are triggered, and build a monitoring path matrix representing the access path correlation strength based on the mapping relationship between abnormal access nodes and original data blocks; The initial parameters of the backtracking reasoning algorithm are set. Based on the predefined correlation coefficient, the access nodes in the monitoring path matrix that are most relevant to the abnormal attack event are searched as candidate attack sources. The initial support set for backtracking reasoning is constructed based on the candidate attack sources. Iteratively calculate the strength estimation value of each candidate attack source leading to the original data block, re-screen the candidate attack source with the greatest contribution based on the strength estimation value, and update the initial support set to obtain the backtracking reasoning support set; The sparse regression residual function is used to calculate the residual vector of each candidate attack source in the backtracking reasoning support set, and the residual vector is compared with the preset threshold; If the residual vector is less than the preset threshold, the backtracking reasoning is terminated and the candidate attack source with the minimum residual vector in the backtracking reasoning support set is selected as the final attack source. Otherwise, the iterative calculation continues; Calculate the sparse coefficient vector of the final attack source, substitute it into the constructed data correction function to generate an approximate reconstruction result of the original data block of the solid-state drive, and encrypt and migrate the approximate reconstruction result to the secure data block; Based on environmental interference events, the data carving algorithm is used to rebuild the flash translation layer mapping table. The flash translation layer mapping table is used to reconstruct the lost data caused by environmental interference. Specifically, the following steps are performed: Collect the physical block interference area of ​​the solid-state drive when the environmental interference event is triggered, and extract the valid mapping table fragment from the undamaged physical block interference area; A data carving algorithm is used to extract contextual features of valid mapping table fragments and use them as input to train a conditional generative adversarial network. The generator constructs the mapping relationship between logical data blocks and physical blocks, and the discriminator evaluates the consistency of the mapping relationship. Use Wasserstein loss and gradient penalty to train the conditional generative adversarial network, and output the flash conversion layer mapping table through the conditional generative adversarial network; The reconstructed flash translation layer mapping table is used to locate the original logical page data features, and the missing page content is reconstructed using the context data block of the original logical page data features.

2. The method for recovering data from a solid-state storage hard disk according to claim 1, wherein: The method of reversely reasoning the attack source based on the abnormal attack event using a backtracking reasoning algorithm and correcting the lost data caused by the abnormal attack according to the reverse reasoning result also includes: Based on human error events, metadata repair technology is used to repair lost data caused by human error.

3. The method for recovering data from a solid-state storage hard disk according to claim 2, wherein: The iterative calculation of the strength estimation value of each candidate attack source leading to the original data block, re-screening the candidate attack source with the greatest contribution based on the strength estimation value, and updating the initial support set to obtain the backtracking reasoning support set includes: Use the regularization function to process the feature data of the candidate attack sources in the initial support set to obtain the regularized feature vector of each attack source; Sort the regularized feature vectors in descending order, select the attack source indexes corresponding to the first several regularized feature vectors to construct a new support set, and use the new support set as the preliminary backtracking support set for the current iteration round; According to the attack source index of the preliminary backtracking support set, the corresponding columns are extracted and a sub-matrix is ​​constructed. The output strength estimation value vector is fitted to the pre-sub-matrix using the least squares method. The strength estimation value vectors are sorted, and the attack source index corresponding to the strength estimation value vector with the largest component among the first several is selected to update the preliminary backtracking support set to obtain the backtracking reasoning support set.

4. The method for recovering data from a solid-state storage hard disk according to claim 3, wherein: The encryption migration of the approximate reconstruction result to the secure data block includes: The corrected approximate reconstruction result is divided into a predetermined size to generate a number of logical data blocks, each logical data block is represented by a block number and block content as a key-value pair; The key-value pairs of the logical data blocks are distributed as input to the mapping nodes in the map-reduce framework. Each mapping node independently encrypts the content of the block it is assigned and retains the block number. After encryption is completed, each mapping node outputs an encrypted key-value pair and distributes the encrypted key-value pair as input to the specification node in the mapping specification framework. After receiving the encrypted key-value pair, the specification node sorts the block numbers to restore the order of the original data blocks; The block contents corresponding to the encryption key values ​​are integrated according to the order of the original data blocks to obtain the encrypted data blocks, and the encrypted data blocks replace the original data blocks and are migrated to the secure data block storage area.

5. The method for recovering data from a solid-state storage hard disk according to claim 4, wherein: The process of extracting context features of valid mapping table segments using a data carving algorithm includes: Extract the original logical page from the valid mapping table fragment, construct a sparse matrix of the mapping relationship between the logical data block and the physical block, and build an enhanced matrix decomposition model based on the context features of each sparse matrix; The context features of the sparse matrix are fused to form a context feature vector, and the enhanced matrix decomposition model is used to score the confidence of the context feature vector to screen high-confidence context features.

6. The method for recovering data from a solid-state storage hard disk according to claim 5, wherein: The use of the enhanced matrix decomposition model to perform confidence scoring on the context feature vector and screening high-confidence context features includes: The context feature vectors in the original logical page are used to construct scoring candidate segments, and the enhanced matrix factorization model is used to calculate the local confidence score and global importance score corresponding to the random context feature vectors in the scoring candidate segments in the context. The context feature vectors whose local confidence scores are higher than the global importance scores are regarded as local noises that deviate from the global pattern and are removed from the candidate segments for scoring; The remaining scoring candidate segments are taken as high-confidence scoring candidate segments, and the high-confidence scoring candidate segments are used as the enhanced matrix decomposition model to screen high-confidence context features.

7. The method for recovering data from a solid-state storage hard disk according to claim 6, wherein: The expression of the Wasserstein loss is: ； Where, W represents the Wasserstein distance; E Indicates averaging the entire data distribution; Representation sample The data distribution generated by the generator; Representation sample The real data distribution; Represents the output value of the discriminator; Indicates the generated sample score; represents the true sample score.

8. A solid state storage hard disk data recovery system, characterized in that: The method for recovering data from a solid-state storage hard disk according to any one of claims 1 to 7 comprises: A data loss analysis module is used to perform differential analysis on the historical log status characteristics and health status characteristics stored in the solid-state drive, and identify data loss events of the solid-state drive based on the differential analysis results. The data loss events include human error events, abnormal attack events, and environmental interference events. A data recovery processing module is used to build a data recovery mechanism based on abnormal data loss events and recover lost data from the solid-state drive based on the data recovery mechanism; The data verification and evaluation module is used to verify and evaluate the recovered data and optimize the data recovery mechanism based on the verification and evaluation results.

Images