【作者】 王维雄；

【导师】 慕建君； 朱建勇；

【作者基本信息】 西安电子科技大学 ， 计算机系统结构， 2010， 硕士

【摘要】 信息和各种数据是当今信息社会最为宝贵的财富,重要数据的丢失或破坏往往会造成难以弥补的损失。如何最大程度的获得已丢失、已破坏的数据或电子犯罪证据,就成了本文所要探讨的问题。本文围绕各类文件数据的完整恢复和分区恢复的相关理论及其技术进行了一些研究,得到了一些结果,主要概括如下：1.概述了国内外数据恢复技术的研究进展情况,简要介绍了磁介质存储原理,分析了主流分区和文件系统结构。2.研究了各类文件存储结构,分析了国内外各类数据恢复软件对文件和分区的恢复能力及其优点和缺点。3.针对传统数据恢复软件无法完整恢复目录或主文件表损坏等情况下被损数据的不足,给出基于NTFS数据流属性、模式匹配的文件级数据恢复算法和残缺复合文档的恢复方案,实验表明这些算法和方案能够有效恢复部分极端数据灾难下的数据。4.针对传统分区恢复软件无法有效恢复多次破坏或覆盖等情况下被损分区链的不足,提出一套较为完整的分区表规则,并给出基于该规则的分区定位算法和分区表项计算工具,测试与分析结果表明该方法能有效解决MBR、EBR和DBR等破坏后的分区恢复。更多还原

【Abstract】 Information and various data are the most valuable riches in information society, the loss or damage of critical data will result in irreparable damage. The purpose of this paper is to investigate how to prevent these important data from being damaged and how to recover data or electronic evidence of the crime that has been lost or destroyed.This thesis mainly focuses on the theory and methods of file recovery and partition recovery. Some results are obtained and summarized as follows:1. The data recovery technology at home and abroad is summarized. The principle of magnetic media storage is discussed briefly. The structure of main partition and file system are illuminated.2. The principle of file storage is investigated. The performance of the domestic and foreign data recovery software to recovery the file and partition are analyzed, and the merit and shortcoming are summarized.3. For the shortcoming of traditional data recovery software which can’t recovery data when the directory or master file table is damaged, the file-level data recovery algorithms based on DATARUNS and pattern matching, and the programs of incomplete compound document recovery are proposed. Experimental results show that these algorithms and programs have a good performance to recovery some of the data under extreme data disaster.4. To compensate the shortcoming of traditional data recovery software can’t recovery the partition chain when it is multiple damaged or overwritten, a set of relatively complete partition table rules is proposed. Based on these rules, the partition location algorithm and computing tool of the partition table are given, the test and analysis results show that this method can effectively recover the partition when the MBR, EBR and DBR and others are damaged.更多还原