Partition Recovery Using Sector Map Candidate Regions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current partition recovery methods are time-consuming and require technical skill, as they involve manual analysis of disk maps and sector access, making it inefficient to recover deleted partitions quickly and effectively, especially with large disk capacities.
Innovation Solution
A partition recovery method and apparatus that classify unallocated disk areas, construct sector maps, and search for boot records to parse filesystems, allowing for rapid recovery of deleted directories and files by utilizing an access module, filesystem parsing module, sector map construction module, partition search module, and filesystem creation module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual analysis of disk map and sector access is used to recover deleted partitions, then partition recovery can be achieved, but the process is time-consuming and requires technical skill
Solution Approach 1:
The patent segments the disk into allocated and unallocated areas, and further divides unallocated areas into candidate regions based on partition table analysis. This segmentation allows the system to focus search efforts only on relevant unallocated regions rather than scanning the entire disk, significantly reducing recovery time while maintaining accuracy
Solution Approach 2:
The patent performs preliminary analysis of the partition table to identify candidate unallocated areas before conducting the actual partition recovery search. By pre-identifying potential recovery regions based on partition boundary information, the system eliminates the need for exhaustive full-disk scanning, thereby improving productivity and reducing time loss
2Reliability
If all sectors are sequentially accessed to search deleted partition information, then complete recovery information can be found, but tens of minutes to tens of hours are taken according to disk capacity
Solution Approach 1:
The patent applies local quality by treating different disk regions differently - allocated areas are analyzed through partition table information while unallocated areas are searched based on candidate region identification. This localized approach ensures reliable recovery by focusing detailed analysis only where deleted partitions are likely to exist, rather than uniformly processing all sectors
Solution Approach 2:
The patent performs partial action by searching only the identified candidate unallocated areas rather than all sectors on the disk. This partial search strategy is sufficient to find deleted partition information while dramatically reducing processing time from tens of hours to a much shorter duration, maintaining reliability without excessive action
3Ease of operation
If manual partition recovery methods are used, then partition information can be recovered, but user's technical skill is required and the process is complex
Solution Approach 1:
The patent implements self-service by enabling the system to automatically analyze partition tables, identify candidate unallocated areas, and search for deleted partition information without requiring user intervention. The automated process eliminates the need for users to manually interpret disk maps or understand partition structures, making the operation simple while the system handles the complex analysis internally
Data Source
AI summary
Provided is a technology which searches an unallocated area to quickly extract information on a deleted partition when checking a disk and an evidence image in digital forensic, and adds a recovered partition to a forensic tool as a new partition. For this, the technology has direct access to the sector of a disk or an evidence image which is obtained, limits information search on an unallocated area only to an area satisfying the minimum size in which a partition may be created, changes an LBA-based sector access scheme into a CHS-based sector access scheme, and reads only the sector of a location having the possibility that a boot record exists to search information of a deleted partition, recovering a partition at high speed.