Partition Recovery Using MFT Entry Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for recovering partitions from disk storage devices are ineffective when the Master Boot Record (MBR), Globally Unique Identifier (GUID) Partition Table (GPT), and boot records are deleted or destroyed, as they rely on these structures for partition configuration information, making it impossible to access data even if the file contents remain intact.
Innovation Solution
A method and apparatus that utilize Master File Table (MFT) entry information to determine unallocated areas, analyze MFT entries, and create a tree structure to reconfigure the partition layout, allowing for the recovery of deleted partitions even when MBR, GPT, boot records, and backup boot records are missing or destroyed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MBR, GPT, and boot records are used for partition management, then partition configuration information can be stored and accessed, but the system becomes vulnerable to complete data loss when these structures are deleted or destroyed
Solution Approach 1:
The patent introduces MFT entries as an intermediary structure that survives the destruction of MBR/GPT boot records. These MFT entries act as mediators that preserve partition configuration information and enable recovery even when the traditional partition tables are completely deleted or destroyed by malicious codes.
Solution Approach 2:
The patent creates a virtual copy of the partition structure by extracting partition configuration information from surviving MFT entries. This virtual partition table is reconstructed based on metadata from MFT entries, allowing the system to operate as if the original partition structure were intact, even though the physical MBR/GPT structures are destroyed.
2Reliability
If MFT entries are used to recover partitions, then partition information can be recovered without MBR/GPT, but the complexity of analyzing and reconstructing partition layout increases
Solution Approach 1:
The patent segments the partition recovery process into distinct modules: MFT entry collection unit, MFT entry analysis unit, and MFT partition creation unit. Each module handles a specific aspect of the complex reconstruction process, making the overall system more manageable and maintainable despite the inherent complexity of partition recovery.
Solution Approach 2:
The patent performs preliminary actions by collecting and analyzing MFT entries before constructing the virtual partition table. The system first gathers partition configuration information from surviving MFT entries, then uses this pre-processed information to reconstruct the partition layout, simplifying the overall reconstruction process.
3Ease of operation
If traditional boot record searching methods are used, then partition recovery is simpler, but the method fails when all boot records are deleted
Solution Approach 1:
The patent changes the fundamental parameter for partition recovery from searching boot records (MBR/GPT) to analyzing MFT entries. This parameter change enables the system to operate in scenarios where traditional boot records are completely deleted, while maintaining a systematic approach through standardized MFT entry analysis procedures.
Data Source
AI summary
A method and apparatus for recovering a partition based on file system metadata, which calculate core information necessary for the recovery of a partition using only the MFT entry information of $MFT and recover a deleted partition when an MBR and a GPT that correspond to the partition configuration information of a disk and a BR and a BBR that store the configuration information of a volume are deleted or destroyed. The method includes determining an unallocated area in a disk or an evidence image, collecting MFT entries from the unallocated area, generating MFT partition candidate information by analyzing the MFT entries, and creating information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries.