Method and apparatus for recovery of file system using metadata and data cluster

1. A method for recovery of a file system, comprising:

generating at least one master file table (MFT) entry list in a disc or an evidence image and collecting at least one data cluster candidate;

generating at least one MFT entry-data cluster pair candidate using the MFT entry list and the at least one data cluster candidate;

determining an attribute value of a virtual partition stored in virtual partition candidate information of at least one MFT entry-data cluster pair candidate; and

generating the virtual partition based on the stored attribute value,

wherein each MFT entry-data cluster pair candidate of the at least one MFT entry-data cluster pair candidate is a pair of data cluster candidates satisfying a predefined condition in which the MFT entry candidate and the at least one data cluster candidate are data from within a same virtual partition, and the MFT entry candidate satisfies the predefined condition among the at least one MFT entry of the MFT entry list,

the attribute value includes a position of the boot record of the virtual partition in the disc or the evidence image and a MFT entry size of the virtual partition,

for each virtual partition of a plurality of virtual partitions, the MFT entry list for each virtual partition is generated,

for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate the attribute value of each virtual partition of the plurality of the virtual partitions, and

for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate a volume size of each virtual partition of the plurality of the virtual partitions.

2. The method of claim 1 , wherein the collecting is performed on a plurality of segmented regions of the disc or the evidence image, respectively, in parallel by a plurality of execution units.

3. The method of claim 2 , wherein the number of the plurality of execution units is determined based on a size of the disc or the evidence image and the number of processors of an apparatus for recovery of a file system performing the method for recovery of a file system.

4. The method of claim 1 , wherein the MFT entry candidate forming the at least one MFT entry-data cluster pair candidate is a predefined type of MFT entry.

5. The method of claim 4 , wherein the predefined type of MFT entry is the MFT entry that provides mapping to a physical address from a logical cluster number (LCN) address recorded in the MFT entry.

6. The method of claim 4 , wherein an MFT entry header of the predefined MFT entry includes a predefined MFT entry header signature.

7. The method of claim 4 , wherein the collecting includes:

determining a position at which data are read in the disc or the evidence image using an MFT minimum generation unit;

when an MFT entry is detected at the position, adding the detected MFT entry to the MFT entry list; and

before the added MFT entry, when at least one reversely continued MFT entry is detected, adding the at least one reversely continued MFT entry to the MFT entry list.

8. The method of claim 7 , wherein the adding of the detected MFT entry to the MFT entry list includes:

reading data at the determined position;

determining the read data as the MFT entry when a predefined region among the read data has a value of a predefined MFT entry header signature; and

if it is determined that the read data are the MFT entry, adding the read data to the MFT entry list as the MFT entry.

9. The method of claim 7 , wherein the adding further includes moving the position as much as the MFT minimum generation unit.

10. The method of claim 1 , wherein the generating of the at least one MFT entry-data cluster pair candidate includes:

calculating a position of a boot record using a target MFT entry candidate among the at least one MFT entry candidate of the MFT entry list and a target data cluster candidate among the at least one data cluster candidate;

determining whether the target MFT entry candidate and the target data cluster candidate are data within the same partition based on the position of the boot record; and

if it is determined that the target MFT entry candidate and the target data cluster candidate are data within the same partition, adding a pair of the target MFT entry candidate and the target data cluster candidate to the at least one MFT entry-data cluster pair candidate.

11. The method of claim 10 , wherein the position of the boot record is calculated based on a relative position between the target MFT entry candidate and the target data cluster candidate.

12. The method of claim 10 , wherein the calculating of the position of the boot record includes:

acquiring an attribute value of the target MFT entry candidate;

acquiring an attribute value of the target data cluster candidate; and

calculating the position of the boot record using the attribute value of the target MFT entry candidate and the attribute values of the target data cluster candidate.

13. The method of claim 12 , wherein the attribute value of the target MFT entry candidate includes an MFT entry file size, an MFT entry file start position cluster offset, and the number of MFT entry file clusters, and

the attribute value of the target data cluster includes a current physical sensor offset.

14. The method of claim 13 , wherein the physical sector offset of the boot record is calculated based on the current physical sector offset, the MFT entry file start position cluster offset, and the number of bytes per the cluster of the virtual partition, and

the number of bytes per the cluster is determined based on the MFT entry file size and the number of MFT entry file cluster.

15. The method of claim 12 , wherein the attribute value of the at least one MFT entry includes a directory index size, a directory index start position cluster offset, and the number of directory index clusters of the MFT entry, and

the attribute value of the at least one target data cluster candidate includes a physical sector offset of the data cluster candidate.

16. The method of claim 1 , wherein the attribute value of the virtual partition includes a volume size of the virtual partition.

17. The method of claim 16 , wherein the volume size is calculated based on a cluster offset maximum value of the virtual partition and a position of a boot record of the virtual partition.

18. An apparatus for recovery of a file system, comprising:

a collection unit configured to generate at least one master file table (MFT) entry list in a disc or an evidence image and collect at least one data cluster candidate;

an analysis unit configured to generate at least one MFT entry-data cluster pair candidate using the MFT entry list and the at least one data cluster candidate; and

a generation unit configured to analyze virtual partition candidate information of the at least one MFT entry-data cluster pair candidate to determine a stored attribute value of a virtual partition and generate the virtual partition based on the attribute value,

wherein each MFT entry-data cluster pair candidate of the at least one MFT entry-data cluster pair candidate is a pair of data cluster candidates satisfying a predefined condition in which the MFT entry candidate and the at least one data cluster candidate are data from within a same virtual partition, and the MFT entry candidate satisfies the predefined condition among the at least one MFT entry of the MFT entry list

the attribute value includes a position of the boot record of the virtual partition in the disc or the evidence image and a MFT entry size of the virtual partition,

for each virtual partition of a plurality of virtual partitions, the MFT entry list for each virtual partition is generated,

for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate the attribute value of each virtual partition of the plurality of the virtual partitions, and

for each virtual partition of the plurality of the virtual partitions, the MFT entry list for each virtual partition is used to calculate a volume size of each virtual partition of the plurality of the virtual partitions.