| 摘要 |
<p>A falsification detection method is provided which is capable of recognizing the substance of a falsification, applicable to not only a specific file system, but also any arbitrary application writing data with a logical structure, usable in a standalone environment and able to prevent its performance from deteriorating even for a very large data size. Data stored in the storage medium employed in a disk drive is divided into meta information expressing a data structure and contents. At a step 130, time transients of the meta information are analyzed whereas, at steps 140 and 150, time transients of the contents are analyzed. By analyzing the data at two stages in this way, replacement of a file and replacement of contents of the file can be detected whereas the substance of a falsification can be recognized in the case of a file system. In addition, by providing every block in the storage medium employed in the disk drive with a flag area that can be updated by the disk drive but only referred to by a host, a falsification can be detected even if the falsification results from a write operation carried out by using an illegal access path. <IMAGE></p> |
