FAT32下有效数据速恢复方法.doc

2012’ 32(9) ： 2500 - 2503,2594文章编号：1001 -9081(2012)09 -2500-04  doi： 10. 3724/SP. J. 1087.2012.02500 FAT32下有效数据快速恢复方法 摘要:针对来自客观设备失败和主观数据破坏,提出一种数据快速恢复方案。当文件系统未损坏或损坏不严 重时，只选取文件分配表（FAT)表项中有价值的内容实现数据快速还原；如果破坏严重（或出于计算机取证需要），则 可以从整个物理硬盘的所有空间（包括操作系统中不可见区域）里最大限度提取出用户的有效数据信息。根据 FAT32文件系统中数据存储与删除机理，通过扫描FAT表中未分配空间，以文件头部特征码所在扇区的簇号和残存 B录项中文件大小两个参数确定文件的存储空间进而恢复;探讨了复合文档结构，给出了根据文档存储规范和数据 流标识提取有效信息方法。实验表明，该方案可以简单、高效地恢复被删除的数据。 关键词：FAT32文件系统;数据恢复;复合文档；计算机取证;信息提取 中图分类号:TP309.3 文献标志码:A Fast recovery method of effective data based on FAT32 YANG De-ming* (Institute of Yangquan, Taiyuan University of Technology, Yangquan Shanxi 045000, China) Abstract： For the objective device failure and subjective data destruction, this paper raised a fast data recovery solution. In case that the file system was not corrupt or not damaged severely, the available worthy content in the File Allocation Table (FAT) could be selected and used for fast data recovery. If the file system was damaged severely (or the computer evidence taking needs)，the entire space of the physical hard disk (including invisible region in the operation system) could be checked and the maximum of valid user data could be extracted. According to the data storage and deletion mechanism in the FAT32 file system, by scanning the unallocated space in FAT, a method was provided to restore the deleted file based on the cluster number of sector storing file header signature and the file size in the directory entry. The compound document structure was explored, and a method to extract useful information was provided according to the specification of document storage and the identity of the data stream. The experiments show that the scheme can simply and efficiently recover the deleted data. Key words： FAT32 file system; data recovery; compound document; computer forensics; information extraction o引言 随着计算机等数字设备在工作和生活中应用的日益广 泛，不论原因是来自客观设备失败（如存储介质损坏，数据写 人设备时发生掉电或由其他灾难而引起的写操作异常）还是 来自用户的主观操作（误删除、误格式化、病毒篡改），电子文 件数据丢失问题日益突出，“电脑有价，数据无价”被人们所