System and method to derive high level file system information by passively monitoring low level operations on a FAT file system
View Patent ↗A method (and corresponding system and computer program product) detects modified files and/or directories in a storage device. The method builds a file-sector coordination table for files in the storage device before relinquishing access control of the storage device to a host computer. The method passively monitors write transactions in the storage device from the host computer. The method identifies sectors affected by the monitored write transactions and stores in a sector list. The method regains access control of the storage device from the host computer and builds a list of modified files by intersecting the sector list with the file-sector coordination table. The method may optionally share the list of modified files with related applications.
1. A computer-implemented method for detecting modified files from a plurality of files stored in a plurality of sectors of a storage device, the method comprising:
building a file-sector coordination table for the plurality of files, the file-sector coordination table comprising information about sectors used by each of the plurality of files;
relinquishing a high-level access control of the storage device to a computer;
monitoring write transactions in the storage device while the high-level access control of the storage device is relinquished to the computer;
identifying sectors affected by the monitored write transactions;
regaining the high-level access control of the storage device from the computer; and
intersecting, after regaining the high-level access control of the storage device from the computer, a collection of sector identifiers of the identified sectors with the file-sector coordination table to build a list of modified files.
2. The method of claim 1 , wherein the list of modified files includes data files and directories.
3. The method of claim 1 , wherein a modified file comprises at least one of a new file, a deleted file, a moved file, and a changed file.
4. The method of claim 1 , wherein the storage device uses one of the variants of the File Allocation Table (FAT) file system.
5. The method of claim 1 , wherein building the file-sector coordination table comprises:
building the file-sector coordination table for the plurality of files by traversing the storage device.
6. The method of claim 1 , wherein identifying the sectors affected by the monitored write transactions further comprises:
compiling a sector list or a sector bitmap to store the identified sectors.
7. The method of claim 1 , wherein intersecting the collection of sector identifiers of the identified sectors with the file-sector coordination table to build the list of modified files comprises:
for each identified sector, identifying an associated file in the file-sector coordination table and adding the associated file to the list of modified files.
8. The method of claim 1 , wherein building the file-sector coordination table for the plurality of files comprises:
building the file-sector coordination table responsive to receiving a signal requesting for relinquishment of the high-level access control of the storage device to the computer.
9. The method of claim 1 , wherein intersecting the collection of sector identifiers of the identified sectors with the file-sector coordination table to build the list of modified files comprises:
identifying newly created or moved files based on the collection of sector identifiers of the identified sectors and the file-sector coordination table.
10. The method of claim 1 , further comprising:
notifying an associated application of the list of modified files.
11. A non-transitory computer readable medium with stored instructions, the instructions when executed by a processor cause the processor to perform a method comprising:
building a file-sector coordination table for a plurality of files stored in a plurality of sectors of a storage device, the file-sector coordination table comprising information about sectors used by each of the plurality of files;
relinquishing a high-level access control of the storage device to a computer;
monitoring write transactions in the storage device while the high-level access control of the storage device is relinquished to the computer;
identifying sectors affected by the monitored write transactions;
regaining the high-level access control of the storage device from the computer; and
intersecting, after regaining the high-level access control of the storage device from the computer, a collection of sector identifiers of the identified sectors with the file-sector coordination table to build a list of modified files.
12. The non-transitory computer readable medium of claim 11 , wherein a modified file comprises at least one of a new file, a deleted file, a moved file, and a changed file.
13. The non-transitory computer readable medium of claim 11 , wherein the storage device uses one of the variants of the File Allocation Table (FAT) file system.
14. The non-transitory computer readable medium of claim 11 , wherein intersecting the collection of sector identifiers of the identified sectors with the file-sector coordination table to build the list of modified files comprises:
for each identified sector, identifying an associated file in the file-sector coordination table and adding the associated file to the list of modified files.
15. The non-transitory computer readable medium of claim 11 , wherein intersecting the collection of sector identifiers of the identified sectors with the file-sector coordination table to build the list of modified files comprises:
identifying newly created or moved files based on the collection of sector identifiers of the identified sectors and the file-sector coordination table.
16. A mobile computing device, comprising:
a storage device using a File Allocation Table (FAT) file system, the storage device containing a plurality of files in a plurality of sectors;
a storage driver configured for building a file-sector coordination table for the plurality of files, the file-sector coordination table comprising information about sectors used by each of the plurality of files, the storage driver further configured for relinquishing a high-level access control of the storage device to a computer, monitoring write transactions in the storage device while the high-level access control of the storage device is relinquished to the computer, identifying sectors affected by the monitored write transactions in the storage device, regaining the high-level access control of the storage device from the computer, and intersecting, after regaining the high-level access control of the storage device from the computer, a collection of sector identifiers of the identified sectors with the file-sector coordination table to build a list of modified files.
17. The mobile computing device of claim 16 , wherein a modified file comprises at least one of a new file, a deleted file, a moved file, and a changed file.
18. The mobile computing device of claim 16 , wherein the list of modified files includes data files and directories.
19. The mobile computing device of claim 18 , wherein the storage driver is further configured for identifying an associated file in the file-sector coordination table for each identified sector and adding the associated file to the list of modified files.
20. The mobile computing device of claim 18 , wherein the storage driver is further configured for identifying newly created or moved files based on the collection of sector identifiers of the identified sectors and the file-sector coordination table.