METHODS AND SYSTEMS FOR DATA RECOVERY

• US 20080256139A1
• Filed: 04/11/2008
• Published: 10/16/2008
• Est. Priority Date: 04/13/2007
• Status: Active Grant

• Current Assignee: Peraton, Inc.
• Original Assignee: Crucial Security, Inc. (L3Harris Technologies, Inc.)
• Inventors: Jessee, Lucas John
• Granted Patent: US 8,010,502 B2
• Time in Patent Office: Days
• US Class Current: 707/202
• CPC Class Codes: G06F 11/1435 using file system or storage system metadata

Abstract

To recover deleted files in a data store, candidate blocks of the data store may be identified and, for each of the candidate blocks, a probability that the candidate block contains a directory entry may be determined. Directory entry metadata for candidate blocks that have a determined probability that is greater than a predetermined probability threshold may then be extracted.

Claims

1. A method for recovering deleted files in a data store, comprising:

identifying candidate blocks of a data store;

determining for each of the candidate blocks a probability that the candidate block contains a directory entry; and

extracting directory entry metadata for candidate blocks that have a determined probability that is greater than a predetermined probability threshold.

2. The method of claim 1, wherein the candidate blocks comprise at least one of blocks located in unallocated clusters or blocks located in unused portions of allocated clusters.

3. The method of claim 1, wherein determining the probability comprises testing a reserved byte in the candidate block and testing an attribute byte in the candidate block.

4. The method of claim 1, wherein determining the probability comprises testing temporal data in the candidate block.

5. The method of claim 1, wherein determining the probability comprises testing a file name in the candidate block.

6. The method of claim 1, wherein determining the probability comprises testing for contiguous groups of candidate blocks that have an initial probability that is greater than a predetermined threshold.

7. The method of claim 1, wherein determining the probability comprises:

assigning initial probabilities for blocks in a cluster by testing a reserved byte, testing an attribute byte, testing temporal data, and testing a file name; and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

8. The method of claim 1, wherein determining the probability comprises:

assigning initial probabilities for blocks in a cluster by testing for each block two or more of;

a reserved byte;

an attribute byte, temporal data, and a file name; and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

9. The method of claim 1, wherein determining the probability comprises:

assigning initial probabilities for blocks in a cluster by testing for each block three or more of;

a reserved byte;

an attribute byte, temporal data, and a file name; and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

10. The method of claim 1, further comprising recovering the content of a deleted file using file information in the extracted metadata.

11. The method of claim 1, further comprising constructing a timeline using temporal information in the extracted metadata.

12. A system for recovering deleted files in a data store, comprising:

a candidate block identification module for identifying candidate blocks of a data store;

a determination module for determining for each of the candidate blocks a probability that the candidate block contains a directory entry; and

an extraction module for extracting directory entry metadata for candidate blocks that have a determined probability that is greater than a predetermined probability threshold.

13. The system of claim 12, wherein the candidate blocks comprise at least one of blocks located in unallocated clusters or blocks located in unused portions of allocated clusters.

14. The system of claim 12, wherein the determination module is configured to determine the probability by testing a reserved byte in the candidate block and testing an attribute byte in the candidate block.

15. The system of claim 12, wherein the determination module is configured to determine the probability by testing temporal data in the candidate block.

16. The system of claim 12, wherein the determination module is configured to determine the probability by testing a file name in the candidate block.

17. The system of claim 12, wherein the determination module is configured to determine the probability by testing for contiguous blocks that have an initial probability that is greater than a predetermined threshold.

18. The system of claim 12, wherein the determination module is configured to determine the probability by:

assigning initial probabilities for blocks in a cluster by testing a reserved byte, testing an attribute byte, testing temporal data, and testing a file name and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

19. The system of claim 12, wherein the determination module is configured to determine the probability by:

assigning initial probabilities for blocks in a cluster by testing for each block two or more of;

a reserved byte;

an attribute byte, temporal data, and a file name; and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

20. The system of claim 12, wherein the determination module is configured to determine the probability by:

assigning initial probabilities for blocks in a cluster by testing for each block three or more of;

a reserved byte;

an attribute byte, temporal data, and a file name; and

determining probabilities that are increased from the initial probabilities for contiguous candidate blocks having initial probabilities greater than a predetermined initial probability threshold.

21. The system of claim 12, further comprising a recovery module for recovering the content of a deleted file using file information in the extracted metadata.

22. The system of claim 12, further comprising a timeline module for constructing a timeline using temporal information in the extracted metadata.

23. A method for determining whether candidate blocks of a data store are likely to contain a directory entry, comprising:

identifying candidate blocks of a data store;

assigning initial probabilities to candidate blocks by testing portions of each block to determine whether such portion meets criteria associated with a directory entry;

assigning a final probability that is higher than the initial probability to each candidate block in a contiguous group of candidate blocks that each have high initial probabilities;

reporting candidate blocks with a final probability greater than a predetermined threshold as a list of blocks that are likely to contain a directory entry.

24. The method of claim 23, wherein the identified candidate blocks comprise at least one of blocks located in unallocated clusters or blocks located in unused portions of allocated clusters.

25. The method of claim 23, wherein assigning the initial probability comprises testing a reserved byte in the candidate block and testing an attribute byte in the candidate block.

26. The method of claim 23, wherein assigning the initial probability comprises testing temporal data in the candidate block.

27. The method of claim 23, wherein assigning the initial probability comprises testing a file name in the candidate block.

28. The method of claim 23, wherein assigning the initial probability comprises testing a reserved byte, testing an attribute byte, testing temporal data, and testing a file name.

29. The method of claim 23, further comprising extracting directory entry metadata for candidate blocks on the list.

30. The method of claim 29, further comprising recovering the content of a deleted file using file information in the extracted metadata.

31. The method of claim 29, further comprising constructing a timeline using temporal information in the extracted metadata.