如何使用Java恢复已删除的文件? [英] How to recover deleted files using Java?

问题描述

我想通过Java在不使用本机库的情况下从磁盘恢复文件

I want to recover files from a disk by Java without using native libraries

我正在使用Java 8进行此操作

I'm doing this using Java 8

据我所知，已删除的文件会保留在磁盘上，直到被覆盖为止

As far as I know deleted files remain on the disk until they are overwritten

我可以直接访问linux上的磁盘，并且可以读取原始数据，但是，例如，如何解析ext4或NTFS文件系统上的已删除文件?

I have direct access to disk on linux and I can read raw data, but, how can I parse deleted files on an ext4 or NTFS file system for example?

谢谢.

推荐答案

要恢复已删除的文件，需要了解底层文件系统的实现方式，因此您需要做一些阅读工作，然后才能到达任何地方.

Recovering deleted files requires knowledge of how the underlaying file system is implemented, so you have a bit of reading to do before you can get anywhere.

从理论上讲，是的，您绝对可以使用纯Java来做到这一点.您只需要了解如何绕过文件系统从原始磁盘读取数据即可.在Unix系统上，这很简单:将设备节点作为文件打开(您需要 root 权限)并进行读取.在Windows上，可能有类似的过程.最糟糕的是，您必须使用C或C ++创建一个帮助程序库才能为您读取数据.

In theory, YES, you can definitely do this in pure Java; you just need to find out how to read data from a raw disk, bypassing the file system. On a Unix system this is simple: open the device node as a file (you'll need root permissions) and just read. On Windows there is probably a similar process; at worst you'll have to create a helper library in C or C++ to read the data for you.

一旦您可以访问原始数据，请查看文件在特定文件系统中的存储方式，并开始在读取的数据中寻找相似的模式.

Once you get access to the raw data, look up how files are stored in your particular file system and start looking for similar patterns in the data that you read.

这不是您下午可以做的事情.

This is not something you can do in an afternoon though.

更新:如何绕过文件系统.

在Unix系统上，您可以像这样从分区或卷中读取内容:

On a Unix system you can read from a partition or volume like this:

InputStream sda1 = new FileInputStream("/dev/sda1");
int firstByte = sda1.read();

在Windows上，您将从 \\.\ PhysicalDisk0 中读取.来自命名文件，路径，以及命名空间:

On Windows you would read from \\.\PhysicalDisk0. From Naming Files, Paths, and Namespaces:

使用Win32设备名称空间的另一个示例是使用

Another example of using the Win32 device namespace is using the CreateFile function with "\\.\PhysicalDiskX" (where X is a valid integer value) or "\\.\CdRomX". This allows you to access those devices directly, bypassing the file system. This works because these device names are created by the system as these devices are enumerated, and some drivers will also create other aliases in the system. For example, the device driver that implements the name "C:\" has its own namespace that also happens to be the file system.

API通常使用"\\.\"前缀，因为 CreateFile 是用于打开文件和设备的函数，具体取决于您使用的参数.

APIs that go through the CreateFile function generally work with the "\\.\" prefix because CreateFile is the function used to open both files and devices, depending on the parameters you use.

如果使用的是Windows API函数，则应使用"\\.\"前缀仅访问设备，而不访问文件.

If you're working with Windows API functions, you should use the "\\.\" prefix to access devices only and not files.

大多数API不支持"\\.\"；只有那些旨在与设备名称空间一起使用的设备才能识别它.请务必检查每个API的参考主题.

Most APIs won't support "\\.\"; only those that are designed to work with the device namespace will recognize it. Always check the reference topic for each API to be sure.

我不知道Java API是使用 CreateFile 实现的，还是它进行了一些名称修饰，这意味着您无法访问设备名称空间.在最坏的情况下，您必须创建一个包装库，该包装库调用 CreateFile 并将其返回的HANDLE转换为可在Java中使用的文件描述符.那根本没用.

I don't know if the Java API is implemented using CreateFile or if it does some name mangling that means you can't access the device namespace. In the worst case you'll have to create a wrapper library that calls CreateFile and turns the HANDLE it returns into a file descriptor that can be used in Java; that's no work at all.

这篇关于如何使用Java恢复已删除的文件?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！