Fragmented file data recovery method

Abstract

The invention discloses a fragmented file data recovery method. The fragmented file data recovery method comprises the following steps of S1 carrying out analysis to obtain partition information; S2 finding a file system idle area; S3 selecting the type of a file needing to be recovered; S4 searching the file header characteristic; S5 judging whether the file header characteristic is found out or not; executing S6 when the file header characteristic is found out; executing S7 when the file header characteristic is not found out; S6 recombining the file in dependence on the file header characteristic, and executing S8 after the recombination is successful; S7 carrying out file recombination in dependence on a pre-stored file storage mode, and executing S8 after the recombination is successful; and S8 extracting the file which is recombined successfully. Beneficial effects of the fragmented file data recovery method are that the file header can be found out according to the file header characteristic, and the data content of the file can be found out according to the file header, under the condition that the file header is lost, fragments in the file system can be found out according to the file format or code known in advance, the fragmented file is checked, whether the data is correct is judged, ordered recombination is carried out to the fragment data, the aim of recovering an incomplete fragmented file is reached, and the data recovery success rate is high.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a data recovery method for fragmented files. Background technique [0002] In the 21st century with the rapid development of information technology, computer technology is changing with each passing day and is closely related to people's daily life. The loss of storage device data can often bring endless troubles and troubles to individuals and even business units. In the work involving computer data storage, such as in In enterprise work, the loss caused by the loss of enterprise data is immeasurable. If it is small, it will make the company unable to carry out its work, and if it is large, it may cause heavy losses and close down of the enterprise. Especially in information enterprises, the company's electronic data is their lifeblood. If these data can be recovered, the company can be saved and the loss of the company can be minimized; for example, in the field of...

AI Technical Summary

Problems solved by technology

[0003] At present, the most popular data forensics commercial software on the market includes encase, winhex, R-stdio, etc. These softwares exist in regular file records, and the files are continuous and can be recovered; It is impossible to restore the data or key information in these files; through research and analysis, these data still exist in the storage medium, but the files are not continuously stored in the medium, and the existing recovery methods can only be based on finding the file header information. The file is recovered in RAW mode. This method can only find the file header and the content stored continuously with the file header, but most of the rest of the file cannot be found. Also because most file types have their own decoding format, only the file header The existing data cannot be displayed normally, so RAW recovery cannot achieve good results for discontinuous or incomplete data.

Images