CN111125298A - Method, equipment and storage medium for reconstructing NTFS file directory tree - Google Patents
Method, equipment and storage medium for reconstructing NTFS file directory tree Download PDFInfo
- Publication number
- CN111125298A CN111125298A CN201911343889.2A CN201911343889A CN111125298A CN 111125298 A CN111125298 A CN 111125298A CN 201911343889 A CN201911343889 A CN 201911343889A CN 111125298 A CN111125298 A CN 111125298A
- Authority
- CN
- China
- Prior art keywords
- file
- directory
- directory tree
- target
- ntfs
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 34
- 238000005192 partition Methods 0.000 claims abstract description 40
- 238000004590 computer program Methods 0.000 claims description 13
- 238000007670 refining Methods 0.000 claims 1
- 238000010586 diagram Methods 0.000 description 8
- 230000008569 process Effects 0.000 description 8
- 238000011084 recovery Methods 0.000 description 6
- 239000012634 fragment Substances 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 230000006870 function Effects 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/31—Indexing; Data structures therefor; Storage structures
- G06F16/316—Indexing structures
- G06F16/322—Trees
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1446—Point-in-time backing up or restoration of persistent data
- G06F11/1458—Management of the backup or restore process
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Quality & Reliability (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a method for reconstructing an NTFS file directory tree, which comprises the following steps: traversing a target partition disk, and extracting a FILE record item with a characteristic value of 'FILE'; analyzing and processing the FILE record item with the characteristic value of 'FILE'; and constructing a file directory tree according to the processed file record item information. The invention also discloses an electronic device and a storage medium. The technical scheme of the invention can solve the technical problems that the storage scenes of different partitions after the file data is lost according to the NTFS partition is difficult, and the file directory tree structure is difficult to restore efficiently and accurately in the prior art.
Description
Technical Field
The invention relates to the technical field of data recovery, in particular to a method, equipment and a storage medium for reconstructing an NTFS file directory tree.
Background
In the process of recovering lost data of the NTFS (new technology file system), a directory tree structure of an original partition needs to be constructed according to an MFT (master file table) file record number and a parent directory file record number of each file record entry, so as to restore a file directory tree state of the original partition.
For newly found file entries, the prior art typically searches for the parent node of the file entry in the found file entry. However, for the scenario where the child file entry is found first and then the parent file entry is found, the child file entry cannot be correctly associated with the parent file entry.
In the prior art, the position of the parent file record item is calculated to obtain the information of the parent file record item. However, in the practical process, more disks and processors are needed for random reading when the position of the parent file record item is calculated, so that the cost and time of data processing are increased, and the efficiency and accuracy of data processing are reduced. And if the DataRuns (file data fragment block linked list) information of the $ MFT file is incorrect, the position of the parent file entry cannot be correctly obtained, and the file directory tree structure cannot be accurately restored.
In summary, the technical problem that the file directory tree structure is difficult to restore efficiently and accurately according to different partition storage scenarios after the NTFS partitions lose file data exists in the prior art.
Disclosure of Invention
The invention provides a method, a system and a storage medium for reconstructing an NTFS file directory tree, and aims to solve the technical problem that the file directory tree structure is difficult to restore efficiently and accurately in the prior art.
To achieve the above object, according to a first aspect of the present invention, the present invention provides a method for reconstructing a directory tree of NTFS files, comprising the steps of:
traversing the target partition disk, and extracting a file record item with a preset characteristic value as a target file record item;
analyzing all target file entries to obtain file entry information;
and constructing a file directory tree according to the processed file record item information.
Preferably, the preset feature value is FILE, and the step of extracting the FILE entry having the preset feature value as the target FILE entry includes:
and extracting sectors and/or clusters with 4 bytes from the address of 0x00 as FILE in the target partition disk, and taking the sectors and/or clusters as target FILE record items.
Preferably, the step of analyzing all target file entries to obtain file entry information includes:
determining the types of all target file entries;
the attribute of the target FILE entry is parsed to extract the $ FILE _ NAME FILE NAME, and the MFT record number of the parent directory is obtained by the $ FILE _ NAME FILE NAME.
Preferably, the step of determining the types of all target file entries includes:
the types of all target file entries are determined from the flag having the address 0x 16.
Preferably, the parsing the attribute of the target FILE entry to extract a $ FILE _ NAME FILE NAME, and obtaining the MFT record number of the parent directory by the $ FILE _ NAME FILE NAME includes:
analyzing the data with the sequence number of 0x30 in the attribute address to obtain a $ FILE _ NAME FILE NAME;
the parent directory FILE reference is obtained by parsing data with a sequence number of 0x00 in the $ FILE _ NAME FILE NAME, and the MFT record number of the parent directory is obtained from the parent directory FILE reference.
Preferably, the step of constructing a file directory tree according to the processed file entry information includes:
taking a root directory node in a target partition disk as a vertex of a directory tree;
taking the vertex as a father node, and creating a lost directory node relative to the vertex;
the processing of the directory tree including vertices and lost directory nodes is completed based on the type of all target file entries in the file entry information and the MFT record number of the parent directory.
Preferably, the step of processing the directory tree including the vertices and the lost directory nodes according to the types of all target file entries in the file entry information and the MFT record number of the parent directory comprises:
traversing the current directory tree by taking the MFT record number of the parent directory as a keyword so as to find out parent directory nodes which have a matching relation with the keyword;
inserting the target file record item with the type of the directory class and the matching relation of the keywords into a child node of a parent directory node corresponding to the keywords;
and inserting the target file record item which is located by the keyword without the matching relation and has the type of the directory class into the lost directory node.
Preferably, the method further comprises:
after all target file entries of which the types are directory classes have been inserted into the directory tree, performing the following steps to insert the target file entries of which the types are file classes into the directory tree:
inserting the target file record item with the type of the file class and the matching relation of the keywords into a child node of a parent directory node corresponding to the keywords;
and inserting the target file record item which is located by the keyword without the matching relation and has the file type under the lost directory node.
To achieve the above object, according to a second aspect of the present invention, there is provided an electronic apparatus comprising:
a memory for storing a computer program;
a processor for implementing the steps of the method for reconstructing the NTFS file directory tree when executing the computer program.
To achieve the above object, according to a third aspect of the present invention, the present invention provides a computer readable storage medium having stored thereon a program for reconstructing an NTFS file directory tree, which when executed by a processor implements the steps of the method for reconstructing an NTFS file directory tree.
According to the technical scheme, all file entries with preset characteristic values are extracted by traversing the target partition disk, all target file entries are analyzed and processed uniformly, the technical problem that a file directory tree is inaccurate in a scanning stage is solved, the situations that the disk occupancy rate is too high and the data processing efficiency is too low due to random disk reading can be effectively reduced, and the performance of a data recovery process is improved.
According to the technical scheme, a lost directory node is created, and the file record items of the parent directory nodes which cannot be matched are inserted into the lost directory node. Therefore, the technical problems that in the prior art, different partition storage scenes are difficult to restore the file directory tree structure efficiently and accurately according to different partition storage scenes after the NTFS partition loses the file data are solved. The technical effects that the file record information collected in the NTFS partition is accurately assembled into an effective directory structure, and the file directory tree structure before loss is more accurately restored are achieved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the structures shown in the drawings without creative efforts.
Fig. 1 is a schematic flow chart of an exemplary embodiment of the present invention.
The implementation, functional features and advantages of the objects of the present invention will be further explained with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
NTFS is short for New technology File System, is a disk format supported by the series operating system of Windows kernel, and is especially designed for network and disk quota, file encryption and other management security features, provides long file name, data protection and recovery, can realize security through directory and file permission, and supports spanning partitions. NTFS is a file system that organically organizes system files and user files of the entire partition, with MFT (MasterFileTable, main file table or main index record) as a core.
Therefore, in the NTFS file system, information related to file and directory storage is mainly stored and managed in a $ MFT metafile (the $ MFT metafile is different from the MFT file, and all MFT file records are included in the $ MFT metafile), where the $ MFT metafile includes at least one file entry (FileRecord), that is, a single management unit is a file entry. In practice, the file delete operation is simply to mark the file entry as deleted, and does not immediately delete the file entry and the actual data area. Also, the partition formatting operation will only reset the $ MFT front end metafile and the small number of files and directories needed for partition initialization, and other file entries on the original partition will not be cleared immediately. The deletion-based operation is simply the basis for system operations that are marked as a deleted state and partition formatting operations in the file entry, which provides the possibility for artificial recovery operations for NTFS missing data.
Generally, in order to recover the NTFS lost data, the file directory tree of the original partition needs to be restored, and all file entries need to be collected through the entire disk and then analyzed. During this process, the directory tree structure of the original partition needs to be constructed according to the MFT file record number and the parent directory file record number of each file record entry to restore the file directory tree state of the original partition.
However, for a $ MFT file, in a more complex partitioned storage scenario, it is not necessarily a physically contiguous storage state, and there may be several chunks whose storage information is in the first file entry of the $ MFT file, and if the partition is formatted such that the file entry is reset, the storage information of the original partition mf $ t chunk is not available. And the fragment blocks of a file entry may not be pointed to by the $ MFT file anymore due to a number of delete file operations, etc. Thus, for file entries that are not pointed to by a $ MFT file, the collection can only be searched in unused areas of the disk and analyzed for its relationship to the current partition file system. However, in the prior art, the relationship between the file directory tree and the current partition file system is often lack of analysis, so that the file directory tree structure cannot be efficiently and accurately restored.
In addition, the storage order of the file entries on the physical disk is not necessarily completely stored in the top-down order of the directory tree, and there is a case where the child node file entry is before and the parent node file entry is after. However, in the prior art, a corresponding processing mode for the condition that the file record item of the child node is before the file record item of the parent node is behind is often lacked, so that the file directory tree structure cannot be efficiently and accurately restored.
Note that all (content or index information) of the small files and directories are stored in the file record of the MFT base, and the attributes thereof become resident attributes. If the attribute value of the large file (directory) exceeds 1KB, a pointer is used in the basic file record to point to an external cluster outside the MFT basic file record, so as to form a B-Tree (B + Tree) structure. Attributes whose values are stored in flight rather than in the MFT file record are referred to as nonresident attributes.
Runlist, which represents non-resident attribute (outer cluster) location information, consists of several datasruns data streams. These external clusters are usually called a run (DataRun) or an extent (extent) and can be used to store attributes (e.g., index entries) or attribute values (e.g., file data). Therefore, the DataRuns data stream is an important parameter for data recovery, and is used to determine the starting cluster number and file size of data.
In summary, in the prior art, it is difficult to reconstruct the NTFS file directory tree according to different partition storage scenarios after the NTFS partitions lose file data, and therefore an efficient and accurate algorithm for restoring the file directory tree structure is urgently needed.
The main solution of the embodiment of the invention is as follows:
as shown in fig. 1, the method for reconstructing the NTFS file directory tree specifically includes the steps of:
s10: traversing the target partition disk, and extracting a file record item with a preset characteristic value as a target file record item;
specifically, the target partition disk is traversed to search for file entries (FileRecord) of the NTFS file system. I.e., whether 4 bytes from the 0x00 address of the sector or cluster is the characteristic value "FILE".
Taking 4 bytes from the address of 0x00 as sectors and/or clusters of the characteristic value "FILE" as a target FILE record item.
In the prior art, the technical scheme of acquiring the information of the parent file record item by calculating the position of the parent file record item in the scanning process is often adopted. Therefore, more disks and processors are required for random reading. And in the case that the DataRuns (file data fragment block linked list) information of the $ MFT file is incorrect, the correct position thereof cannot be correctly acquired. According to the method and the device, the target partition disk is traversed, the file record items with the preset characteristic values are extracted to serve as the target file record items, so that all the target file record items are obtained to serve as objects of data processing, data inaccuracy caused by incorrect information of DataRuns (file data fragment block linked list) is avoided, and random reading of a consumption disk and a processor when the position of a father file record item is calculated is also avoided.
S20: and analyzing all target file record items to obtain file record item information.
Specifically, for each found file entry, analysis is performed according to NTFSFileRecord, including:
judging whether the file record item is a file or a directory; that is, whether the file entry indicates a file or a directory is determined by marking data with an address of 0x16 in Flags.
Extracting the MFT record number; that is, MFT record number is acquired from data having an address of 0x 2C.
Analyzing the attribute of the target FILE record item and extracting a $ FILE _ NAME FILE NAME;
and, obtain the MFT record number of the parent directory by $ FILE _ NAME filename.
The steps of parsing and extracting the $ FILE _ NAME FILE NAME and obtaining the MFT record number of the parent directory by the $ FILE _ NAME FILE NAME include:
analyzing data with the sequence number of 0x30 in the Attribute Attribute address to obtain a $ FILE _ NAME FILE NAME;
and acquiring a parent directory FILE reference by analyzing data with a sequence number of 0x00 in the $ FILE _ NAME FILE NAME, and acquiring the MFT record number of the parent directory from the parent directory FILE reference.
It should be noted that the address related to the judgment file entry, the address related to the extraction of the MFT record number, and the address in the Attribute address are all offset addresses of the file entry data buffer.
S30: and analyzing all target file record items to obtain file record item information.
Namely, taking a root directory node in a target partition disk as a vertex of a directory tree;
taking the vertex as a father node, and creating a lost directory node relative to the vertex;
and processing and perfecting the directory tree comprising the vertex and the lost directory node according to the types of all target file record items in the file record item information and the MTF record number of the parent directory.
Specifically, the step of constructing the file directory tree includes:
the root directory (RootDirectory) nodes of the partitions are constructed first as the vertices of the tree. The MFT record number of all file entries under the root directory for which the MFT record number is missing is defaulted to 5.
And under the directory node with the parent directory as the root directory, creating a lost directory node which is used as a default parent directory when the parent directory of the file record item is lost.
And traversing the current tree structure, finding and inserting a father directory node matched with the file record item, and if the father directory node matched with the file record item is not found, inserting the file record item into the lost directory node.
The step of traversing the current tree structure, finding and inserting a parent directory node matched with the file record item, and if no parent directory node matched with the file record item is found, inserting the file record item into the lost directory node includes:
respectively processing the file records according to the judgment result of whether the file records are files or directories;
when the file record item is a file, traversing a current tree structure, finding a father directory node matched with the file record item in the tree structure, and inserting the father directory node into a child node of the father directory node;
if the file record item does not find the corresponding father directory node in the tree structure, inserting the file record item into the lost directory node;
when the file record item is a directory, traversing a current tree structure, finding a parent directory node matched with the file record item in the tree structure, and inserting the parent directory node into a child node of the parent directory node;
and if the corresponding parent directory node is not found in the tree structure of the file record item, inserting the file record item into the lost directory node.
After the step S30 is completed, the file directory tree data structure of a current partition can be obtained, so as to implement accurate restoration of the lost data file directory tree of the NTFS file system, and the file directory tree structure can be restored without increasing random reading cost and without depending on the storage sequence of the file entries in the disk and the storage state of the $ MFT file after one-time sequential disk reading is completed.
In the prior art, for a newly found file record item, searching whether a parent node exists in the found file record item, and if so, pointing to the parent node; if not, the file is classified as a lost path. However, for the scenario where the child file entry is found first and then the parent file entry is found, the child file entry cannot be correctly associated with the parent file entry.
In the prior art scheme, the position of the parent file entry in the $ MFT is calculated by MFTFileReferenceNumber (MFT record number). For the scheme of acquiring the information of the parent file record item by calculating the position of the parent file record item in the scanning process, more disks are needed to read at random and spend expenses. And in the case that the DataRuns (file data fragment block linked list) information of the $ MFT file is incorrect, the correct position thereof cannot be correctly acquired.
In the technical scheme of the application, the integrity of the reconstructed directory tree is irrelevant to the sequence of finding the file record items, and the file record item information is acquired without additionally reading a disk randomly. The problem that the directory tree is constructed inaccurately in the scanning process in the prior art is solved, and extra reading expense is not needed to be added in the scanning process.
By the technical scheme, the file record information collected in the NTFS partition can be accurately assembled into an effective directory structure, the file directory tree structure before loss can be more accurately restored, and the problem that the file directory tree is inaccurate in the scanning stage is solved; and the cost of disk random reading is effectively reduced, and the performance of the data recovery process is improved.
In order to implement reconstruction of the NTFS file directory tree, the present invention further provides an electronic device, including:
a memory for storing a computer program;
a processor for implementing the steps of the method for reconstructing the NTFS file directory tree when executing the computer program.
Furthermore, the present invention also provides a computer readable storage medium having stored thereon a program for reconstructing an NTFS file directory tree, which when executed by a processor implements the steps of reconstructing an NTFS file directory tree as described above.
The specific embodiment of the computer-readable storage medium of the present invention is substantially the same as the embodiments of the method for reconstructing the NTFS file directory tree, and will not be described in detail herein.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should be noted that in the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.
Claims (10)
1. A method for reconstructing an NTFS file directory tree, comprising the steps of:
traversing the target partition disk, and extracting a file record item with a preset characteristic value as a target file record item;
analyzing all target file entries to obtain file entry information;
and constructing a file directory tree according to the processed file record item information.
2. The method for reconstructing the NTFS FILE directory tree according to claim 1, wherein the preset feature value is FILE, and the step of extracting the FILE entry having the preset feature value as the target FILE entry comprises:
and extracting sectors and/or clusters with 4 bytes from the address of 0x00 as FILE in the target partition disk, and taking the sectors and/or clusters as target FILE record items.
3. The method of reconstructing an NTFS file directory tree as claimed in claim 1, wherein the step of analyzing all target file entries to obtain file entry information comprises:
determining the types of all target file entries;
the attribute of the target FILE entry is parsed to extract the $ FILE _ NAME FILE NAME, and the MFT record number of the parent directory is obtained by the $ FILE _ NAME FILE NAME.
4. The method of reconstructing an NTFS file directory tree as claimed in claim 3, wherein the step of determining the types of all target file entries comprises:
the types of all target file entries are determined from the flag having the address 0x 16.
5. The method of reconstructing an NTFS FILE directory tree as claimed in claim 3, wherein the step of parsing attributes of the target FILE entry to extract a $ FILE _ NAME FILE NAME, and obtaining the MFT record number of the parent directory by the $ FILE _ NAME FILE NAME comprises:
analyzing the data with the sequence number of 0x30 in the attribute address to obtain a $ FILE _ NAME FILE NAME;
the parent directory FILE reference is obtained by parsing data with a sequence number of 0x00 in the $ FILE _ NAME FILE NAME, and the MFT record number of the parent directory is obtained from the parent directory FILE reference.
6. The method of reconstructing an NTFS file directory tree as claimed in claim 3, wherein the step of constructing a file directory tree according to the processed file entry information comprises:
taking a root directory node in a target partition disk as a vertex of a directory tree;
taking the vertex as a father node, and creating a lost directory node relative to the vertex;
the processing of the directory tree including vertices and lost directory nodes is completed based on the type of all target file entries in the file entry information and the MFT record number of the parent directory.
7. The method of reconstructing an NTFS file directory tree as claimed in claim 6, wherein the step of refining the directory tree including vertices and lost directory nodes according to the type of all target file entry in file entry information and the MFT record number of the parent directory comprises:
traversing the current directory tree by taking the MFT record number of the parent directory as a keyword so as to find out parent directory nodes which have a matching relation with the keyword;
inserting the target file record item with the type of the directory class and the matching relation of the keywords into a child node of a parent directory node corresponding to the keywords;
and inserting the target file record item which is located by the keyword without the matching relation and has the type of the directory class into the lost directory node.
8. The method of reconstructing an NTFS file directory tree according to claim 7, the method further comprising:
after all target file entries of which the types are directory classes have been inserted into the directory tree, performing the following steps to insert the target file entries of which the types are file classes into the directory tree:
inserting the target file record item with the type of the file class and the matching relation of the keywords into a child node of a parent directory node corresponding to the keywords;
and inserting the target file record item which is located by the keyword without the matching relation and has the file type under the lost directory node.
9. An electronic device, comprising:
a memory for storing a computer program;
a processor for implementing the steps of the method of reconstructing an NTFS file directory tree according to any one of claims 1 to 8 when executing said computer program.
10. A computer-readable storage medium, having stored thereon a program for reconstructing an NTFS file directory tree, which when executed by a processor, performs the steps of the method for reconstructing an NTFS file directory tree according to any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911343889.2A CN111125298A (en) | 2019-12-23 | 2019-12-23 | Method, equipment and storage medium for reconstructing NTFS file directory tree |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911343889.2A CN111125298A (en) | 2019-12-23 | 2019-12-23 | Method, equipment and storage medium for reconstructing NTFS file directory tree |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111125298A true CN111125298A (en) | 2020-05-08 |
Family
ID=70501585
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911343889.2A Pending CN111125298A (en) | 2019-12-23 | 2019-12-23 | Method, equipment and storage medium for reconstructing NTFS file directory tree |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111125298A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113312007A (en) * | 2021-06-29 | 2021-08-27 | 成都易我科技开发有限责任公司 | Method and device for counting directory and file sizes in NTFS file system |
| CN113742127A (en) * | 2021-09-16 | 2021-12-03 | 重庆大学 | Fault recovery method for bare flash memory file system |
| CN114168558A (en) * | 2021-12-06 | 2022-03-11 | 成都傲梅科技有限公司 | Method for optimizing NTFS file system speed by reconstructing file records |
| CN114328797A (en) * | 2021-11-09 | 2022-04-12 | 腾讯科技（深圳）有限公司 | Content search method, content search device, electronic device, storage medium, and program product |
| CN114860656A (en) * | 2022-04-12 | 2022-08-05 | 深圳市绿联科技股份有限公司 | File scanning method and device, electronic equipment and storage medium |
| CN117435384A (en) * | 2023-12-14 | 2024-01-23 | 中电云计算技术有限公司 | Directory repair method, apparatus, device and readable storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1959649A (en) * | 2006-09-19 | 2007-05-09 | 珠海金山软件股份有限公司 | Method for rebuilding directory structure and recovering data in NTFS volume |
| CN105677514A (en) * | 2016-01-08 | 2016-06-15 | 四川秘无痕信息安全技术有限责任公司 | Method for reconstructing disaster data file directory structure |
| CN106372080A (en) * | 2015-07-22 | 2017-02-01 | 安恒通（北京）科技有限公司 | File clearing method, apparatus and system |
| CN110347643A (en) * | 2019-07-22 | 2019-10-18 | 成都易我科技开发有限责任公司 | NTFS volume cloning process and device between a kind of disk |
-
2019
- 2019-12-23 CN CN201911343889.2A patent/CN111125298A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1959649A (en) * | 2006-09-19 | 2007-05-09 | 珠海金山软件股份有限公司 | Method for rebuilding directory structure and recovering data in NTFS volume |
| CN106372080A (en) * | 2015-07-22 | 2017-02-01 | 安恒通（北京）科技有限公司 | File clearing method, apparatus and system |
| CN105677514A (en) * | 2016-01-08 | 2016-06-15 | 四川秘无痕信息安全技术有限责任公司 | Method for reconstructing disaster data file directory structure |
| CN110347643A (en) * | 2019-07-22 | 2019-10-18 | 成都易我科技开发有限责任公司 | NTFS volume cloning process and device between a kind of disk |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113312007A (en) * | 2021-06-29 | 2021-08-27 | 成都易我科技开发有限责任公司 | Method and device for counting directory and file sizes in NTFS file system |
| CN113312007B (en) * | 2021-06-29 | 2023-02-03 | 成都易我科技开发有限责任公司 | Method and device for counting directory and file sizes in NTFS (New technology File System) |
| CN113742127A (en) * | 2021-09-16 | 2021-12-03 | 重庆大学 | Fault recovery method for bare flash memory file system |
| CN114328797A (en) * | 2021-11-09 | 2022-04-12 | 腾讯科技（深圳）有限公司 | Content search method, content search device, electronic device, storage medium, and program product |
| CN114328797B (en) * | 2021-11-09 | 2024-03-19 | 腾讯科技（深圳）有限公司 | Content search method, device, electronic apparatus, storage medium, and program product |
| CN114168558A (en) * | 2021-12-06 | 2022-03-11 | 成都傲梅科技有限公司 | Method for optimizing NTFS file system speed by reconstructing file records |
| CN114168558B (en) * | 2021-12-06 | 2024-06-11 | 成都傲梅科技有限公司 | Method for optimizing NTFS file system speed by reconstructing file records |
| CN114860656A (en) * | 2022-04-12 | 2022-08-05 | 深圳市绿联科技股份有限公司 | File scanning method and device, electronic equipment and storage medium |
| CN117435384A (en) * | 2023-12-14 | 2024-01-23 | 中电云计算技术有限公司 | Directory repair method, apparatus, device and readable storage medium |
| CN117435384B (en) * | 2023-12-14 | 2024-04-16 | 中电云计算技术有限公司 | Directory repair method, apparatus, device and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111125298A (en) | Method, equipment and storage medium for reconstructing NTFS file directory tree | |
| US9183268B2 (en) | Partition level backup and restore of a massively parallel processing database | |
| CN109522290B (en) | HBase data block recovery and data record extraction method | |
| US7577808B1 (en) | Efficient backup data retrieval | |
| CN110569147B (en) | Deleted file recovery method based on index, terminal device and storage medium | |
| US11645161B2 (en) | Catalog of files associated with snapshots | |
| CN110515543B (en) | Object bucket-based snapshot method, device and system | |
| US9465694B2 (en) | Method and apparatus for recovering partition based on file system metadata | |
| CN109710455A (en) | Deletion file access pattern method and system based on FAT32 file system | |
| CN111104377A (en) | File management method, electronic device and computer-readable storage medium | |
| Li et al. | Database management strategy and recovery methods of Android | |
| CN106372080A (en) | File clearing method, apparatus and system | |
| US7769719B2 (en) | File system dump/restore by node numbering | |
| CN109656929B (en) | Method and device for carving complex relation type database file | |
| CN109522305B (en) | Big data deduplication method and device | |
| CN111698330B (en) | Data recovery method and device of storage cluster and server | |
| CN111309677A (en) | File management method and device of distributed file system | |
| CN111176901B (en) | HDFS deleted file recovery method, terminal device and storage medium | |
| CN107590233B (en) | File management method and device | |
| KR101688629B1 (en) | Method and apparatus for recovery of file system using metadata and data cluster | |
| CN108021472B (en) | Format recovery method of ReFS file system and storage medium | |
| CN112380174B (en) | XFS file system analysis method containing deleted files, terminal device and storage medium | |
| CN110489432B (en) | Model-based database automatic synchronization method, medium, equipment and device | |
| CN115543918A (en) | File snapshot method, system, electronic equipment and storage medium | |
| CN108132971B (en) | Analysis method and device for database fragment files |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20211122 Address after: 518000 1001, block D, building 5, software industry base, Yuehai street, Nanshan District, Shenzhen City, Guangdong Province Applicant after: Shenzhen Wanxing Software Co.,Ltd. Address before: 518000 1002, block D, building 5, software industry base, Yuehai street, Nanshan District, Shenzhen City, Guangdong Province Applicant before: SHENZHEN SIBO TECHNOLOGY Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200508 |
|
| RJ01 | Rejection of invention patent application after publication |