Abstract:
In the situation that the metadata of file system is distrusted or cannot be trusted, it is difficult to recovery the Oracle data files completely with the traditional method of data recovery. Rather than rely on the metadata of file system, Oracle control file and log file information, the file carving based on the characteristics of the Oracle data files’ internal structure is realized. File carving strategies like ideas parallel unique path, bi-fragment gap carving, entropy and so on are adopted to detect the fragment of Oracle data files. It proposes a file caving algorithm based on the keywords of the file header and file addresses. Experimental results show that this algorithm can also extract Oracle data files effectively with no metadata of file system while it gets rid of the traditional data recovery dependences on the metadata of file system.
Key words:
file caving,
Oracle database,
data file,
data block structure,
fragments detection,
fragments reorganization
摘要： 在系统元信息被破坏或不信任的环境下，传统数据恢复方法难以完整地恢复Oracle数据文件。为此，提出不依赖系统元信息，不使用Oracle控制文件和日志文件信息，而是基于Oracle数据文件内部结构特征进行文件雕复的数据恢复方法。采用并行唯一路径、二分碎片间隙雕复和熵值等方法进行碎片侦测，设计一种基于文件头关键字和文件地址的雕复方法。实验结果表明，该方法在无系统元信息的情况下，能有效提取Oracle数据文件，摆脱传统数据恢复对系统元信息的依赖性。
关键词:
文件雕复,
Oracle数据库,
数据文件,
数据块结构,
碎片侦测,
碎片重组
CLC Number: