Methods and systems for data recovery
First Claim
Patent Images
1. A method for recovering deleted files in a data store comprising a FAT file system, comprising:
- identifying candidate blocks of a data store, each candidate block comprising a plurality of portions;
determining for each of the candidate blocks a first probability that the candidate block contains a directory entry based upon one of the plurality of portions;
determining for each of the candidate blocks a second probability that the candidate block contains a directory entry based upon another one of the plurality of portions;
combining the first probability and second probability to form a combined probability;
wherein the first and second probabilities are based on the portion being part of a valid directory entry;
extracting directory entry metadata for candidate blocks that have a combined probability that is greater than a predetermined probability threshold; and
recovering the content of a deleted file using the extracted directory entry metadata.
12 Assignments
0 Petitions
Accused Products
Abstract
To recover deleted files in a data store, candidate blocks of the data store may be identified and, for each of the candidate blocks, a probability that the candidate block contains a directory entry may be determined. Directory entry metadata for candidate blocks that have a determined probability that is greater than a predetermined probability threshold may then be extracted.
-
Citations
42 Claims
-
1. A method for recovering deleted files in a data store comprising a FAT file system, comprising:
-
identifying candidate blocks of a data store, each candidate block comprising a plurality of portions; determining for each of the candidate blocks a first probability that the candidate block contains a directory entry based upon one of the plurality of portions; determining for each of the candidate blocks a second probability that the candidate block contains a directory entry based upon another one of the plurality of portions; combining the first probability and second probability to form a combined probability; wherein the first and second probabilities are based on the portion being part of a valid directory entry; extracting directory entry metadata for candidate blocks that have a combined probability that is greater than a predetermined probability threshold; and recovering the content of a deleted file using the extracted directory entry metadata. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
-
12. A system for recovering deleted files in a data store comprising a FAT file system, comprising:
-
a processor; a candidate block identification module operating on said processor for identifying candidate blocks of a data store, each candidate block comprising a plurality of portions; a determination module operating on said processor for determining for each of the candidate blocks; a first probability that the candidate block contains a directory entry based upon one of the plurality of portions, a second probability that the candidate block contains a directory entry based upon another one of the plurality of portions, and a combined probability formed by combining the first probability and second probability; wherein the first and second probabilities are based on the portion being part of a valid directory entry; an extraction module operating on said processor for extracting directory entry metadata for candidate blocks that have a combined probability that is greater than a predetermined probability threshold; and recovering the content of a deleted file using the extracted directory entry metadata. - View Dependent Claims (13, 14, 15, 16, 17, 18, 19, 20, 21, 22)
-
-
23. A method for determining whether candidate blocks of a data store are likely to contain a directory entry comprising a FAT file system, comprising:
-
identifying candidate blocks of a data store, each candidate block comprising a plurality of portions; assigning initial probabilities to candidate blocks by determining first and second probabilities based upon different ones of the plurality of portions to determine whether the different ones of the plurality of portions meets the criteria associated with a directory entry; assigning a combined probability by combing the first and second probabilities; assigning a final probability that is higher than the combined probability to each candidate block in a contiguous group of candidate blocks that each have high combined probabilities; wherein the first and second probabilities are based on the portion being part of a valid directory entry; reporting candidate blocks with a final probability greater than a predetermined threshold as a list of blocks that are likely to contain a directory entry; and recovering the content of a deleted file using the reported candidate blocks. - View Dependent Claims (24, 25, 26, 27, 28, 29, 30, 31)
-
-
32. A system for recovering deleted files in a data store comprising a FAT file system, comprising:
-
a candidate block identification hardware module for identifying candidate blocks of a data store, each candidate block comprising a plurality of portions; a determination hardware module for determining for each of the candidate blocks first and second probabilities that the candidate block contains a directory entry, based upon different ones of the plurality of portions and for determining a combined probability based on the combination of the first and second probabilities; wherein the first and second probabilities are based on the portion being part of a valid directory entry; an extraction hardware module for extracting directory entry metadata for candidate blocks that have a combined probability that is greater than a predetermined probability threshold; and recovering the content of a deleted file using the extracted directory entry metadata. - View Dependent Claims (33, 34, 35, 36, 37, 38, 39, 40, 41, 42)
-
Specification