FAT32下有效数据快速恢复方法

针对来自客观设备失败和主观数据破坏,提出一种数据快速恢复方案。当文件系统未损坏或损坏不严重时,只选取文件分配表(FAT)表项中有价值的内容实现数据快速还原;如果破坏严重(或出于计算机取证需要),则可以从整个物理硬盘的所有空间(包括操作系统中不可见区域)里最大限度提取出用户的有效数据信息。根据FAT32文件系统中数据存储与删除机理,通过扫描FAT表中未分配空间,以文件头部特征码所在扇区的簇号和残存目录项中文件大小两个参数确定文件的存储空间进而恢复;探讨了复合文档结构,给出了根据文档存储规范和数据流标识提取有效信息方法。实验表明,该方案可以简单、高效地恢复被删除的数据。

Fast recovery method of effective data based on FAT32

For the objective device failure and subjective data destruction,this paper raised a fast data recovery solution.In case that the file system was not corrupt or not damaged severely,the available worthy content in the File Allocation Table(FAT) could be selected and used for fast data recovery.If the file system was damaged severely(or the computer evidence taking needs),the entire space of the physical hard disk(including invisible region in the operation system) could be checked and the maximum of valid user data could be extracted.According to the data storage and deletion mechanism in the FAT32 file system,by scanning the unallocated space in FAT,a method was provided to restore the deleted file based on the cluster number of sector storing file header signature and the file size in the directory entry.The compound document structure was explored,and a method to extract useful information was provided according to the specification of document storage and the identity of the data stream.The experiments show that the scheme can simply and efficiently recover the deleted data.