Apparatus and method for recovering partition using backup boot record information

摘要

In a method for recovering a partition using backup boot record information, an unallocated area is separated from a disk or an evidence image. The unallocated area is searched for a location of a backup boot record. Whether is backup boot record of a file system to be detected is present in found sectors is analyzed. If the backup boot record is found to be the backup boot record of the file system desired to be detected as a result of the analysis, it is verified whether the backup boot record is a boot record of a valid partition. If it is verified that the backup boot record is the boot record of the valid partition, a file system of a deleted partition is parsed using the backup boot record and a deleted directory or file is recovered.

主权项

1. A method for recovering a partition using backup boot record information, comprising:
separating an unallocated area from a disk or an evidence image; searching the unallocated area for a location of a backup boot record; analyzing whether a backup boot record of a file system desired to be detected is present in found sectors; if the backup boot record is found to be the backup boot record of the file system desired to be detected as a result of the analysis, verifying whether the backup boot record is a boot record of a valid partition; and if it is verified that the backup boat record is the boot record of the valid partition, parsing a file system of a deleted partition using the backup boot record, and recovering a deleted, directory or file, wherein searching for the location of the backup boot record is configured to search for the backup boot record depending on a type of file system based on an input sector map table, wherein searching for the location of the backup boot record is configured to search the unallocated area while jumping the unallocated area by a unit of a cylinder or by a unit of 2048 sectors, and analyze whether a specific sector is the backup boot record, and wherein searching by the unit of the cylinder and searching by the unit of 2048 sectors are simultaneously performed in a form of threads.