文档介绍：ISSN 1001-9081 CODEN JYIIDU
2012-09-01 http: //www. joca. cn
2012’ 32(9) : 2500 - 2503,2594
文章编号:1001 -9081(2012)09 -2500-04
doi: 10. 3724/SP. J.
FAT32下有效数据快速恢复方法
摘要:针对来自客观设备失败和主观数据破坏,提出一种数据快速恢复方案。当文件系统未损坏或损坏不严重时,只选取文件分配表(FAT)表项中有价值的内容实现数据快速还原;如果破坏严重(或出于计算机取证需要),则可以从整个物理硬盘的所有空间(包括操作系统中不可见区域)里最大限度提取出用户的有效数据信息。根据 FAT32文件系统中数据存储与删除机理,通过扫描FAT表中未分配空间,以文件头部特征码所在扇区的簇号和残存 B录项中文件大小两个参数确定文件的存储空间进而恢复;探讨了复合文档结构,给出了根据文档存储规范和数据流标识提取有效信息方法。实验表明,该方案可以简单、高效地恢复被删除的数据。
关键词:FAT32文件系统;数据恢复;复合文档;计算机取证;信息提取中图分类号: 文献标志码:A
Fast recovery method of effective data based on FAT32
YANG De-ming*
(Institute of Yangquan, Taiyuan University of Technology, Yangquan Shanxi 045000, China)
Abstract: For the objective device failure and subjective data destruction, this paper raised a fast data recovery solution.
In case that the file system was not corrupt or not damaged severely, the available worthy content in the File Allocation Table (FAT) could be selected and used for fast data recovery. If the file system was damaged severely (or puter evidence taking needs),the entire space of the physical hard disk (including invisible region in the operation system) could be checked and the maximum of valid user data could be extracted. According to the data storage and deletion mechanism in the FAT32 file system, by scanning the unallocated space in FAT, a method was provided to resto