【作者】 郭军；

【导师】 何泾沙；

【作者基本信息】 北京工业大学 ， 软件工程（专业学位）， 2016， 硕士

【摘要】 随着科学技术和信息时代的发展,数据的重要性日益突出,人们更加依赖于计算机和智能系统设备,这无疑给人们的工作和生活带来了巨大方便。传统数据恢复技术能够恢复人为误删等数据,但是当文件系统损坏或文件系统元数据信息损坏、丢失时,传统数据恢复技术无法恢复数据,造成无法估计的损失。而文件雕复技术不依赖于原始磁盘镜像的文件系统,它从表面上无结构的二进制数据流(即原始磁盘镜像)中恢复数据,它克服了传统数据恢复技术在文件系统损坏或元数据损坏以及文件在磁盘上不连续存放而形成碎片等无法恢复的情况,因此受到了极大的关注。本文通过对文件雕复技术进行研究,基于信息熵、字节频率分布和字节平均值三种特征提取算法,并结合支持向量机作为分类器来分类文件碎片,并使用基于磁盘簇逻辑顺序的重组算法或基于数据文件性质的重组算法对文件碎片进行重组,提出了一种对多种文件类型有效的文件雕复算法,并通过恢复Word文档和JPEG图像进行验证。主要工作如下:首先,提出一种基于内容特征的文件碎片分类算法。该算法利用信息熵原理,计算目标类型文件的熵值范围,通过熵值特征提取算法提取出目标类型文件碎片的集合。之后在二类分类的基础上,采用1-gram的方法,利用字节频率分布和字节平均值两个特征,并结合基于支持向量机的监督学习算法对熵值提取出的碎片集合进一步分类。其次,设计三组仿真实验对基于内容特征的文件碎片分类算法进行验证,实验结果表明该算法的可行性和有效性。然后,提出一种基于内容特征的文件雕复算法。该算法是在基于内容特征的文件碎片分类算法基础上,对已完成分类的目标类型文件碎片,采用基于磁盘簇逻辑顺序的重组算法或基于数据文件性质的重组算法对目标类型文件碎片进行重组,确定同一文件碎片间正确的拼接关系,恢复其文件。最后,为了验证该算法的可行性,选取DFRW 2006发布的磁盘镜像作为实验数据,对Word文档和JPEG图像进行恢复。通过设计详细的实验步骤,并将实验结果与Foremost和PhotoRec两种工具的雕复结果进行对比,结果表明该算法能够从无结构的磁盘镜像中恢复文件,并证明了该算法的可行性和有效性。更多还原

【Abstract】 With the development of science and technology in information age, the importance of data is becoming more and more prominent. Moreover, people are severely dependent on computers and intelligent system equipment, which will undoubtedly bring great convenience to people’s work and life. Traditional data recovery technique can recover human mistaken delete data. However, when the file system or metadata information is damaged or lost, it can not recover data, resulting in imponderable losses. File carving technique does not rely on the File System of original disk image. It recovers data from superficial unstructured binary data stream(i.e. the original disk image). It overcomes the disadvantages existing in traditional data recovery technique, such as the fragments forming from discontinuous storage beyond recovering. In consequence, it has received great attention. In this paper, we mainly proposed a file carving algorithm applicable to multi-type files based on the information entropy, byte frequency distribution and mean byte value feature extraction algorithm, combing with support vector machine as the classifier to classify file fragments and reassembling the file fragments using the reassembly algorithm based on logical sequence of disk cluster or the property of data files. Then we demonstrate it by recovering Word documents and JPEG images. Our contribution is as follows:First of all, we propose a file fragments classification algorithm based on content features. The algorithm calculates the entropy range of target type files through information entropy principle and extracts its set by using the entropy feature extraction algorithm. Later based on binary classification and the 1-gram method, as well as byte frequency distribution and mean byte value we further classify the extracting fragments by integrating the supervised learning algorithm based on support vector machine.Secondly, we have executed simulation experiments to verify file fragments classification algorithm based on content features. The results show that our proposed method is feasible and effective.Thirdly, we propose a file carving algorithm based on content features. On the basis of file fragments classification algorithm based on content features, it mainly recombines the target file fragments, determines their connection relationship and recovers them by using the reassembly algorithm based on logical sequence of disk cluster or the property of data files.Finally, in order to verify the feasibility of the algorithm, we select released the disk image of DFRW 2006 as the experimental data and try to recovery Word documents and JPEG images. Comparing with the results of Foremost and PhotoRec tools, the experiment shows that the algorithm is able to recover files from unstructured disk image, thus proving the feasibility and effectiveness of the algorithm.更多还原