Journal of Computer Applications ›› 2012, Vol. 32 ›› Issue (09): 2500-2503.DOI: 10.3724/SP.J.1087.2012.02500

• Database technology • Previous Articles     Next Articles

Fast recovery method of effective data based on FAT32

YANG De-ming*   

  1. Institute of Yangquan,Taiyuan University of Technology,Yangquan Shanxi 045000,China
  • Received:2012-02-24 Revised:2012-04-09 Online:2012-09-01 Published:2012-09-01

FAT32下有效数据快速恢复方法

杨德明*   

  1. 太原理工大学 阳泉学院,山西 阳泉 045000
  • 通讯作者: 杨德明
  • 作者简介:杨德明(1968-),男,山西阳泉人,讲师,硕士研究生,主要研究方向:数据存储与恢复、计算机网络通信。

Abstract: For the objective device failure and subjective data destruction, this paper raised a fast data recovery solution. In case that the file system was not corrupt or not damaged severely, the available worthy content in the File Allocation Table (FAT) could be selected and used for fast data recovery. If the file system was damaged severely (or the computer evidence taking needs), the entire space of the physical hard disk (including invisible region in the operation system) could be checked and the maximum of valid user data could be extracted. According to the data storage and deletion mechanism in the FAT32 file system, by scanning the unallocated space in FAT, a method was provided to restore the deleted file based on the cluster number of sector storing file header signature and the file size in the directory entry. The compound document structure was explored, and a method to extract useful information was provided according to the specification of document storage and the identity of the data stream. The experiments show that the scheme can simply and efficiently recover the deleted data.

Key words: FAT32 file system, data recovery, compound document, computer forensics, information extraction

摘要: 针对来自客观设备失败和主观数据破坏,提出一种数据快速恢复方案。当文件系统未损坏或损坏不严重时,只选取文件分配表(FAT)表项中有价值的内容实现数据快速还原;如果破坏严重(或出于计算机取证需要),则可以从整个物理硬盘的所有空间(包括操作系统中不可见区域)里最大限度提取出用户的有效数据信息。根据FAT32文件系统中数据存储与删除机理,通过扫描FAT表中未分配空间,以文件头部特征码所在扇区的簇号和残存目录项中文件大小两个参数确定文件的存储空间进而恢复;探讨了复合文档结构,给出了根据文档存储规范和数据流标识提取有效信息方法。实验表明,该方案可以简单、高效地恢复被删除的数据。

关键词: FAT32文件系统, 数据恢复, 复合文档, 计算机取证, 信息提取

CLC Number: