摘要
磁盘中已删除文件在未被覆盖之前,其存储方式为连续和离散存储。针对连续存储提出了一种准确匹配已删除文件首簇高16位算法,并重点分析离散存储碎片,提出了一种基于部分匹配预测算法PPMC来重构磁盘上已删除文件碎片的模型。采用PPMC算法确定出任意两个碎片的相邻性概率值,然后再通过剪枝技术,将不可能的分支裁减,逐步加工处理,重构出一个有完整顺序的原文件。
The style of deleted file＇ s storage was consecutive storage or scattered storage before recovered by other files. This paper proposed an algorithm of match first cluster＇ s high-16 bit accurately. Further more, emphasized to analyse scattered fragments of disk files, proposed a modal of reassembling deleted file fragments based on PPMC algorithm and α-β pruning technology. Employed prediction by partial matching （PPM） to build a context model and compute candidate probabilities of the possible adjacency of two document fragments, and adopted α-β pruning technology to prune some impossible tree one bye one, then reassemble a complete file.
出处
《计算机应用研究》
CSCD
北大核心
2008年第9期2836-2838,共3页
Application Research of Computers
关键词
数据恢复
文件碎片
取证系统
文件重构
data recovery
file fragments
forensic system
file reassembly
