搜索
©1994-2010ChinaAcademicJournalElectronicPublishingHouse.Allrightsreserved.:2008208214:(19832),,,,(uestc_zhang@qq.com);(19502),,,,;(19672),,,,.FAT32,,(,610054):,WindowsFAT32FAT32,FAT32,,:;FAT32;;:TP309103:A:100123695(2009)0321116203Child2brothertree2baseddeletedfilerecoveryalgorithmonWindowsFAT32ZHANGHua,LIUNai2qi,GUOJian2dong(SchoolofComputerScience&Engineering,UniversityofElectronicScience&TechnologyofChina,Chengdu610054,China)Abstract:Forthesubjectiveorobjectivefactorscausedthelossofdataonthecomputer,thispaperproposedachild2brothertree2baseddeletedfilerecoveryalgorithmonWindowsFAT32filesystem.ItintroducedthestructureofWindowsFAT32filesystemondiskandchild2brothertree,andeeplyexpatiationthathowtoreconstructtheWindowsFAT32filesystemdirectorybasedonthechild2brothertree,andhowtoquicklysearchandobtainedthedeletefiledirectorytablewhichcouldbeusedtorecoveryitsrelateddeletedFATfilebyanalyzingitsvaluevarietyafterremovedwasdisplayedbythepaperaswellas.Keywords:datarecovery;FAT32filesystem;fileaccesstable;child2brothertree,,,[1],Windows,FAT32WindowsFAT3211,FAT32[2],MBRMBR(DBR)(FAT)(DATA)(FDT,FAT32FDTDATA,FDT)Windows2000ProfessionalWindowsXPProfessional,WinHexFAT32:a)MBRMBR63,FAT32446Bytemainbootrecorder,64Bytediskpartitiontable,2Byte0x55AA,[3]b)63,:,;BPB,;,,c)(),,d)FAT32FDT32Byte,,1FAT32,,,:,26320093ApplicationResearchofComputersVol.26No.3Mar.2009©1994-2010ChinaAcademicJournalElectronicPublishingHouse.Allrightsreserved.[4],1FAT32Windows2000ProfessionalWindowsXPPro2fessional,FAT321,,,,,firstchildnextsibling[5]//()typedefstructCSNode{ElemTypedata;structCSNode3firstchild,3nextsibling;}CSNode,3CSTree;,firstchild,,nextsiblingFAT32,1:,,131211classCDir{public:CDir();CDir();//voidInsertChild(CDir3pDirChild);//voidInsertBrother(CDir3pDirBrother);//voidInsertBrother(CDir3pDir,CDir3pDirBrother);//,voidGenerateChildTree(CDir3pDirParent);//,voidGenerateChildTree();//TCHARm_szFileName[14];//DWORDm_dwStartCluster;//DWORDm_dwLength;//BOOLm_bIsDir;//CDir3m_pChildDir;//CDir3m_pBrotherDir;//BOOLm_bIsDeleted;//Cpartition3m_pPartition;//,BOOLm_bIsDeletedByte;};3121231213BPB,,pDir,pDir2,Shift+Delete,16,31214Shift+Delete,16,3:,1616,,,,71113,:FAT32©1994-2010ChinaAcademicJournalElectronicPublishingHouse.Allrightsreserved.:a)20GBFAT32,,4KBFAT3220GB8,4KBb)20MB10,10,6070MB,6070MB,c),1GB300MB,Da2taRecovery,230MBd)DataRecovery,,,:[1],,,.WindowsNTFS[J].,2008,29(1):3062308.[2],.[M].:,2005:7240.[3],,.FAT[J].,2005,33(9):1052108.[4],,.[M].:,2001:142.[5],.[M].:,1999:1362137.(1115):[1],,.[J].,2006,43(3):1202122.[2]ESCHENAUERL,GLIGORV.Akeymanagementschemefordis2tributedsensornetworks[C]//Procofthe9thACMConfonCompu2terandCommunicationsSecurity.NewYork:ACMPress,2002:41247.[3]PANJAB,MADRIAS,BHARGAVAB.Energyandcommunicationefficientgroupkeymanagementprotocolforhierarchicalsensornet2works[C]//ProcofIEEEInernationalConferenceonSensorNet2works,Ubiquitions,andTrustworthyComputing.Taichong:IEEEPress,2006:3842393.[4]ZHUSen2cun,SETIAS,JAJODIAS.LEAP:efficientsecuritymecha2nismsforlarge2scaledistributedsensornetworks[C]//Procofthe10thACMConfonComputerandCommunicationsSecurity.NewYork:ACMPress,2003:62272.[5]MOKAMMELM,CHOIG.AnefficientPKC2basedsecurityarchitec2tureforwirelesssensornetworks[C]//ProcofMilitaryCommunica2tionsConference.Orlando:IEEEPress,2007:127.[6],,.[J].,2007,20(7):158121586.[7]LANDSTRAT,ZAWODNIOKM,JAGANNATHANS.Energy2effi2cienthybridkeymanagementprotocolforwirelesssensornetworks[C]//Procofthe32ndIEEEConferenceonLocalComputerNet2works.Dublin:IEEEPress,2007:100921016.811126