Method and apparatus for recovery of file system using metadata and data cluster
AssigneeElectronics and Telecommunications Research Institute
InventorsHyunuk Hwang, Kibom Kim, Seungyong Lee, Seongtaek Chee
Life of this patent
Estimating the term…
Abstract
A method and an apparatus for recovery of a file system using metadata and data clusters. The apparatus for recovery of a file system generates an MFT entry list in a disc or an evidence image, collects at least one data cluster candidate, and uses at least one MFT entry and at least one data cluster candidate within the MFT entry list to generate at least one MFT entry-data cluster pair candidate. The apparatus for recovery of a file system analyzes the at least one MFT entry-data cluster pair candidate to determine attribute values of a virtual partition and generate the virtual partition based on the attribute values.
Claims18
A method for recovery of a file system, comprising:
- generating at least one master file table (MFT) entry list in a disc or an evidence image and collecting at least one data cluster candidate;
- generating at least one MFT entry-data cluster pair candidate using the MFT entry list and the at least one data cluster candidate;
- determining an attribute value of a virtual partition stored in virtual partition candidate information of at least one MFT entry-data cluster pair candidate;
- and
- generating the virtual partition based on the stored attribute value,
- wherein each MFT entry-data cluster pair candidate of the at least one MFT entry-data cluster pair candidate is a pair of data cluster candidates satisfying a predefined condition in which the MFT entry candidate and the at least one data cluster candidate are data from within a same virtual partition, and the MFT entry candidate satisfies the predefined condition among the at least one MFT entry of the MFT entry list,
- the attribute value includes a position of the boot record of the virtual partition in the disc or the evidence image and a MFT entry size of the virtual partition,
- for each virtual partition of a plurality of virtual partitions, the MFT entry list for each virtual partition is generated,
- for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate the attribute value of each virtual partition of the plurality of the virtual partitions, and
- for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate a volume size of each virtual partition of the plurality of the virtual partitions.
An apparatus for recovery of a file system, comprising:
- a collection unit configured to generate at least one master file table (MFT) entry list in a disc or an evidence image and collect at least one data cluster candidate;
- an analysis unit configured to generate at least one MFT entry-data cluster pair candidate using the MFT entry list and the at least one data cluster candidate;
- and
- a generation unit configured to analyze virtual partition candidate information of the at least one MFT entry-data cluster pair candidate to determine a stored attribute value of a virtual partition and generate the virtual partition based on the attribute value,
- wherein each MFT entry-data cluster pair candidate of the at least one MFT entry-data cluster pair candidate is a pair of data cluster candidates satisfying a predefined condition in which the MFT entry candidate and the at least one data cluster candidate are data from within a same virtual partition, and the MFT entry candidate satisfies the predefined condition among the at least one MFT entry of the MFT entry list
- the attribute value includes a position of the boot record of the virtual partition in the disc or the evidence image and a MFT entry size of the virtual partition,
- for each virtual partition of a plurality of virtual partitions, the MFT entry list for each virtual partition is generated,
- for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate the attribute value of each virtual partition of the plurality of the virtual partitions, and
- for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate a volume size of each virtual partition of the plurality of the virtual partitions.
Dependencies are inferred from the claim text.