计算机工程 ›› 2010, Vol. 36 ›› Issue (2): 275-276.doi: 10.3969/j.issn.1000-3428.2010.02.097

• 开发研究与设计技术 • 上一篇    下一篇

NTFS文件系统中的视频数据恢复方法

黄步根1,刘建军2,张晓南2   

  1. (1. 江苏警官学院公安科技系,南京210012;2. 南京市公安局网警支队,南京210005)
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2010-01-20 发布日期:2010-01-20

Recovery Method of Video Data in NTFS File System

HUANG Bu-gen1, LIU Jian-jun2, ZHANG Xiao-nan2   

  1. (1. Department of Forensic Science, Jiangsu Police Institute, Nanjing 210012;2. Department of Network Police, Nanjing Municipal Public Security Bureau, Nanjing 210005)
  • Received:1900-01-01 Revised:1900-01-01 Online:2010-01-20 Published:2010-01-20

摘要: 在NTFS文件系统中,视频监控文件在形成过程中被分割成大量非常小的块进行存储,通过多个索引表形成整个文件,删除该文件后,主索引表被丢弃,但扩展属性中的索引表还存在。针对该问题,提出根据文件的扩展属性恢复数据的方法,通过整合大量分散存储的碎片,能够恢复被删除的视频文件的大部分内容。

关键词: 数据恢复, 视频监控, NTFS文件系统

Abstract: In the NTFS file system, video monitor file is divided into a large number of very small block for storage, the entire file is formed by the index tables, the main index table is missing when the file is deleted, but other index tables exist in the extended attributes. This paper proposes a method for recovering data by the extended property according to file. This method can effectively combine many scattered fragments together and recover most of video monitor data which has already been deleted.

Key words: data recovery, video monitor, NTFS file system

中图分类号: