US6173291B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for recovering data from damaged or corrupted file storage media
Assignee: IMPERIAL BANK
•
Filing: 1997-09-26
•
Granted: 2001-01-09
•
Expires: 2017-09-26
Abstract
Abstract An automated method and apparatus for identifying and copying lost files from a mass data storage device of a computer when file system information (as opposed to the actual data files) stored on the mass data storage device has been corrupted or destroyed. The mass data storage device is scanned on a sector-by-sector basis in order to attempt to identify sectors containing file system data structures and file attributes. Identification is made using data signature and/or pattern matching filters. The location of, and any valid information found in, such sectors is used then to derive information useful in locating files to be copied to another storage device. For example, in a FAT, NTFS or other cluster-oriented file system, if information on the number of sectors per cluster (SPB) is not available from a boot directory, it and a cluster base (the starting sector of cluster 0) are calculated using the physical location of the beginning sectors of the directories or folders. When a starting cluster is known from a directory entry, but not additional file allocation information, a cluster chain may be reconstructed utilizing one or more of several disclosed methods.
Inventors
- 👤 Roy M. Jenevein
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 14:43
CPC Classifications
G; G06; G06F; G06F11/00; G06F11/07; G06F11/14; G06F11/1402; G06F11/1415; G06F11/1435; G06F16/00; G06F16/10; Y; Y10; Y10S; Y10S707/00; Y10S707/99951; Y10S707/99952; Y10S707/99953
Claims Analysis
Total Claims: 57
Claim 1
Independent Claim
122 words
A method for recovering files, wherein the files are organized in a hierarchical directory structure of an operating system's file system, from a first storage device of a computer when critical file system information is not available, the first file storage device being divided in a plurality of individually addressable sectors storing blocks of data, the method comprising the steps of: reading the first file storage device on a sector-by-sector basis; identifying sectors containing file attribute information stored by the file system in data structures by comparing data therein to predetermined data patterns; reconstructing the directory structure, at least in part, from the identified file attribute information; and copying a file in the reconstructed directory structure to a second file storage device.
Claim 2
Independent Claim
122 words
A method for recovering files, wherein the files are organized in a hierarchical directory structure of an operating system's file system, from a first storage device of a computer when critical file system information is not available, the first file storage device being divided in a plurality of individually addressable sectors storing blocks of data, the method comprising the steps of: reading the first file storage device on a sector-by-sector basis; identifying sectors containing file attribute information stored by the file system in data structures by comparing data therein to predetermined data patterns; reconstructing the directory structure, at least in part, from the identified file attribute information; and copying a file in the reconstructed directory structure to a second file storage device.
Claim 3
Independent Claim
125 words
A method for recovering files that are stored on a mass data storage device of a computing system and that are organized into a hierarchical file storage system used by an operating system, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing file system data structures by comparing data therein to predetermined data patterns and/or signatures found in data structures of the file system; reading the information from the identified sectors; and reconstructing at least part of the hierarchical file storage system based on information read from the identified sectors.
Claim 4
Independent Claim
125 words
A method for recovering files that are stored on a mass data storage device of a computing system and that are organized into a hierarchical file storage system used by an operating system, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing file system data structures by comparing data therein to predetermined data patterns and/or signatures found in data structures of the file system; reading the information from the identified sectors; and reconstructing at least part of the hierarchical file storage system based on information read from the identified sectors.
Claim 5
Dependent Claim
27 words
The method of claim 2 further comprising copying a file listed within the at least partly reconstructed hierarchical file structure to a second mass data storage device.
Claim 6
Dependent Claim
33 words
The method of claim 2 wherein storage on the mass data storage device is allocated for storing files on a cluster-by-cluster basis, a cluster being comprised of one or a plurality of sectors.
Claim 7
Dependent Claim
32 words
The method of claim 4 further comprising determining a number of sectors per cluster and a base cluster address when this information is not available by reading the file system data structures.
Claim 8
Dependent Claim
85 words
The method of claim 5 wherein determining the number of sectors per cluster includes: identifying by an address for a first sector of each of the two file system data structures, each of the file system data structures including information for determining its starting cluster number; reading the information for determining the starting cluster number for each of the directories; and comparing the starting cluster numbers and the address of the first sectors of the file system data structures to determine the sectors per cluster.
Claim 9
Dependent Claim
61 words
The method of claim 5 wherein determining the number of sectors per cluster is calculated for each directory located in file system, and reconstructing the hierarchical file storage system includes determining a hierarchical file structure using file attribute information from those file system data structures having the same sectors per cluster and address for the first sector of the base cluster.
Claim 10
Dependent Claim
96 words
The method of claim 5 , wherein determining the number of sectors per cluster includes: identifying an address for a first sector storing a first directory and an address for second sector storing a second directory; reading from the first directory an a starting cluster number for the first directory and from the second directory a starting cluster number for the second directory; and calculating the sectors per cluster by dividing the difference of the addresses of the first and second directories by the difference of the starting cluster numbers of the first and second directory.
Claim 11
Dependent Claim
60 words
The method of claim 5 wherein determining the cluster base address is calculated using the following formula, CB=(LBA root +Sectors root )−(2×SPC) wherein CB is the cluster base address, LBA root is an address of the first sector of the root directory, Sectors root is a number of sectors in the root directory, and SPC is the sectors per cluster.
Claim 12
Dependent Claim
110 words
The method of claim 5 wherein determining the cluster base address includes: identifying a first and a second directory; determining a starting cluster number for the first and the second directory; and calculating the address of the base cluster with the following formula, CB=(C dir1 ×LBA dir2 −C dir2 ×LBA dir1 )/(C dir1 −C dir2 ) wherein CB is the cluster base address, C dir1 is a cluster number of the first directory, C dir2 is the cluster number of the second directory, LBA dir1 is an address of the first sector of the first directory and LBA dir2 is an address for the first sector of the second directory.
Claim 13
Dependent Claim
81 words
The method of claim 4 further comprising: receiving a selection of a file to be recovered from the at least partially reconstructed hierarchical file structure; displaying in a first window on a user interface to the computing system an end portion of data from a last cluster storing data of the selected file; and displaying in a second window on the user interface to the computing system a beginning portion from a next available cluster not yet associated with a file.
Claim 14
Dependent Claim
42 words
The method of claim 11 further comprising displaying in a third window a list of clusters which have not been associated with a file and displaying in a fourth window a list of clusters which have been associated with the selected file.
Claim 15
Dependent Claim
79 words
The method of claim 4 further comprising: receiving a plurality of selections for files to be recovered from the at least partially reconstructed hierarchical file structure; and for each file, starting with the smallest file and continuing in order to the largest file, sequentially stringing together clusters storing content of the same type as that stored in a known starting cluster until the sequence of clusters store an amount of data equal to the known size of the file.
Claim 16
Dependent Claim
63 words
The method of claim 2 wherein the file system data structures include at least one sub-directory, the sub-directory having a first entry having an entry storing a first predetermined data pattern and a starting cluster number for the sub-directory, and a second entry storing a second predetermined data pattern and a starting cluster number for a parent directory to which the sub-directory belongs.
Claim 17
Dependent Claim
17 words
The method of claim 2 wherein the file system data structures include index buffers for an MFT.
Claim 18
Dependent Claim
14 words
The method of claim 2 wherein the file system data structures include file folders.
Claim 19
Dependent Claim
16 words
The method of claim 2 wherein the file system data structures include a cluster allocation table.
Claim 20
Dependent Claim
15 words
The method of claim 2 wherein the file system data structures include a boot record.
Claim 21
Dependent Claim
43 words
The method of claim 2 wherein, the file system data structures include a partition sector; the method includes identifying each partition sector; and reconstructing the hierarchical file storage system includes reconstructing a hierarchical file structure for each partition identified by a partition sector.
Claim 22
Dependent Claim
66 words
The method of claim 2 wherein identifying sectors containing file system data structures includes identifying a file system data structure containing cluster allocation information for files, and wherein the method further includes selecting a file to be recovered from the at least partially reconstructed hierarchical file structure, determining from the cluster allocation information what clusters contain data for the selected file, and copying the selected file.
Claim 23
Dependent Claim
17 words
The method of claim 20 wherein the cluster allocation information is stored in a File Allocation Table.
Claim 24
Dependent Claim
17 words
The method of claim 20 wherein the cluster allocation information is stored in a Master File Table.
Claim 25
Dependent Claim
146 words
A computer readable medium storing instructions for causing a computer to perform a process, when those instructions are read by the computer, for recovering files that are stored on a mass data storage device of the computer, wherein the files are organized into a hierarchical file storage system used by an operating system and the mass data storage device is divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address; the process comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing file system data structures by comparing data therein to predetermined data patterns and/or signatures found in data structures of the file system; reading the information from the identified sectors; and reconstructing at least part of the hierarchical file storage system based on information read from the identified sectors.
Claim 26
Dependent Claim
146 words
A computer readable medium storing instructions for causing a computer to perform a process, when those instructions are read by the computer, for recovering files that are stored on a mass data storage device of the computer, wherein the files are organized into a hierarchical file storage system used by an operating system and the mass data storage device is divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address; the process comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing file system data structures by comparing data therein to predetermined data patterns and/or signatures found in data structures of the file system; reading the information from the identified sectors; and reconstructing at least part of the hierarchical file storage system based on information read from the identified sectors.
Claim 27
Dependent Claim
33 words
The computer readable medium of claim 23 , wherein the process further comprises copying a file listed within the at least partly reconstructed hierarchical file structure to a second mass data storage device.
Claim 28
Dependent Claim
34 words
The computer readable medium of claim 23 , wherein storage on the mass data storage device is allocated for storing files on a cluster-by-cluster basis, a cluster being comprised of a plurality of sectors.
Claim 29
Dependent Claim
25 words
The computer readable medium of claim 25 , wherein the process further comprises determining a number of sectors per cluster and a cluster base address.
Claim 30
Dependent Claim
88 words
The computer readable medium of claim 26 , wherein determining the number of sectors per cluster includes: identifying by an address for a first sector of each of the two file system data structures, each of the file system data structures including information for determining its starting cluster number; reading the information for determining the starting cluster number for each of the directories; and comparing the starting cluster numbers and the address of the first sectors of the file system data structures to determine the sectors per cluster.
Claim 31
Dependent Claim
64 words
The computer readable medium of claim 26 , wherein determining the number of sectors per cluster is calculated for each directory located in file system, and reconstructing the hierarchical file storage system includes determining a hierarchical file structure using file attribute information from those file system data structures having the same sectors per cluster and address for the first sector of the base cluster.
Claim 32
Dependent Claim
98 words
The computer readable medium of claim 26 , wherein determining the number of sectors per cluster includes: identifying an address for a first sector storing a first directory and an address for second sector storing a second directory; reading from the first directory an a starting cluster number for the first directory and from the second directory a starting cluster number for the second directory; and calculating the sectors per cluster by dividing the difference of the addresses of the first and second directories by the difference of the starting cluster numbers of the first and second directory.
Claim 33
Dependent Claim
52 words
The computer readable medium of claim 26 , wherein determining the cluster base address includes reading from a root directory an address for a first sector of a root directory, determining a number of sectors in the root directory, and subtracting the product of the number of sectors per cluster and two.
Claim 34
Dependent Claim
114 words
The computer readable medium of claim 26 , wherein determining the cluster base address includes: identifying a first and a second directory; determining a starting cluster number for the first and the second directory; and calculating the address of the base cluster with the following formula, CB=(C dir1 ×LBA dir 2 −C dir2 ×LBA dir1 )/(C dir1 −C dir2 ) wherein CB is the cluster base address, C dir1 is a cluster number of the first directory, C dir2 is a cluster number of the second directory, LBA dir1 is an address of the first sector of the first directory and LBA dir2 is an address for the first sector of the second directory.
Claim 35
Dependent Claim
87 words
The computer readable medium of claim 25 , wherein the process further comprises: receiving a selection of a file to be recovered from the at least partially reconstructed hierarchical file structure; displaying in a first window on a user interface to the computing system an end portion of data from a last cluster storing data of the selected file; and displaying in a second window on the user interface to the computing system a beginning portion from a next available cluster not yet associated with a file.
Claim 36
Dependent Claim
30 words
The computer readable medium of claim 32 , wherein the process further comprises displaying in a third window a list of clusters which have not been associated with a file.
Claim 37
Dependent Claim
35 words
The computer readable medium of claim 33 , wherein the process further comprises displaying, for each cluster that has not been associated file, a predetermined classification for the type of a data the cluster contains.
Claim 38
Dependent Claim
86 words
The computer readable medium of claim 25 , wherein the process further comprises: receiving a plurality of selections for files to be recovered from the at least partially reconstructed hierarchical file structure; and for each file, starting with the smallest file and continuing in order to the largest file, sequentially stringing together clusters storing data of the same data type as that stored in a known starting cluster until the sequence of clusters store an amount of data equal to the known size of the file.
Claim 39
Dependent Claim
65 words
The computer readable medium of claim 23 wherein the file system data structures include at least one sub-directory, the sub-directory having a first entry having an entry storing a first predetermined data pattern and a starting cluster number for the sub-directory, and a second entry storing a second predetermined data pattern and a starting cluster number for a parent directory to which the sub-directory belongs.
Claim 40
Dependent Claim
19 words
The computer readable medium of claim 23 wherein the file system data structures include index buffers for an MFT.
Claim 41
Dependent Claim
14 words
The method of claim 23 wherein the file system data structures include file folders.
Claim 42
Dependent Claim
16 words
The method of claim 23 wherein the file system data structures include a cluster allocation table.
Claim 43
Dependent Claim
15 words
The method of claim 23 wherein the file system data structures include a boot record.
Claim 44
Dependent Claim
43 words
The method of claim 23 wherein, the file system data structures include a partition sector; the method includes identifying each partition sector; and reconstructing the hierarchical file storage system includes reconstructing a hierarchical file structure for each partition identified by a partition sector.
Claim 45
Dependent Claim
66 words
The method of claim 23 wherein identifying sectors containing file system data structures includes identifying a file system data structure containing cluster allocation information for files, and wherein the process further includes selecting a file to be recovered from the at least partially reconstructed hierarchical file structure, determining from the cluster allocation information what clusters contain data for the selected file, and copying the selected file.
Claim 46
Dependent Claim
17 words
The method of claim 42 wherein the cluster allocation information is stored in a File Allocation Table.
Claim 47
Dependent Claim
17 words
The method of claim 42 wherein the cluster allocation information is stored in a Master File Table.
Claim 48
Independent Claim
133 words
A method for recovering a file that has been stored in a hierarchical file system on a mass storage device coupled with a computing system when cluster allocation information for the file is missing or corrupted, the file system allocating storage on a cluster by cluster basis, each cluster having a predetermined number of one or more individually addressable sectors; the method comprising: determining a starting cluster and size for the file from the file system; classifying the content of the starting cluster based on the type of data it contains; assembling, in order, the starting cluster and each cluster following the starting cluster that has content of the same class as the starting cluster until the number the size of the data stored by the copied clusters equals that of the files.
Claim 49
Independent Claim
133 words
A method for recovering a file that has been stored in a hierarchical file system on a mass storage device coupled with a computing system when cluster allocation information for the file is missing or corrupted, the file system allocating storage on a cluster by cluster basis, each cluster having a predetermined number of one or more individually addressable sectors; the method comprising: determining a starting cluster and size for the file from the file system; classifying the content of the starting cluster based on the type of data it contains; assembling, in order, the starting cluster and each cluster following the starting cluster that has content of the same class as the starting cluster until the number the size of the data stored by the copied clusters equals that of the files.
Claim 50
Independent Claim
154 words
A method for recovering a file that has been stored in a hierarchical file system on a mass storage device coupled with a computing system when cluster allocation information for the file is missing or corrupted, wherein the file system allocates storage on a cluster by cluster basis, each cluster has a predetermined number of one or more individually addressable sectors, and the file's a starting cluster and size are known; the method comprising: displaying in a first window on a user interface to the computing system an end portion of data from a last cluster determined to be storing part of the file; displaying in a second window on the user interface to the computing system a beginning portion from a second cluster subsequent to the first cluster; and receiving an indication of whether the data of the second cluster displayed in the second window belongs with the data of the last cluster.
Claim 51
Independent Claim
154 words
A method for recovering a file that has been stored in a hierarchical file system on a mass storage device coupled with a computing system when cluster allocation information for the file is missing or corrupted, wherein the file system allocates storage on a cluster by cluster basis, each cluster has a predetermined number of one or more individually addressable sectors, and the file's a starting cluster and size are known; the method comprising: displaying in a first window on a user interface to the computing system an end portion of data from a last cluster determined to be storing part of the file; displaying in a second window on the user interface to the computing system a beginning portion from a second cluster subsequent to the first cluster; and receiving an indication of whether the data of the second cluster displayed in the second window belongs with the data of the last cluster.
Claim 52
Dependent Claim
43 words
The method of claim 46 further comprising: classifying the content of the starting cluster based on the type of data it contains; and displaying a list with a classification of the data contained in a plurality of clusters subsequent to the starting cluster.
Claim 53
Dependent Claim
50 words
The method of claim 46 further comprising: displaying in the first window an end portion of the second cluster if the indication is that the second cluster belongs to the first cluster; and displaying in the second window a beginning portion from a third cluster subsequent to the second cluster.
Claim 54
Independent Claim
89 words
A method for determining partitioning of mass data storage device when information about the location of the partitions is missing or corrupted, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing partitions by comparing data therein to predetermined data patterns and/or signatures found in partitions; and reading the information from the identified partition sectors.
Claim 55
Independent Claim
89 words
A method for determining partitioning of mass data storage device when information about the location of the partitions is missing or corrupted, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing partitions by comparing data therein to predetermined data patterns and/or signatures found in partitions; and reading the information from the identified partition sectors.
Claim 56
Independent Claim
90 words
A method for finding boot records of mass data storage device when information about location of the boot records is missing or corrupted, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing partitions by comparing data therein to predetermined data patterns and/or signatures found in partitions; and reading the information from the identified partition sectors.
Claim 57
Independent Claim
90 words
A method for finding boot records of mass data storage device when information about location of the boot records is missing or corrupted, the mass data storage device being divided into a plurality of individually addressable blocks, called herein sectors, for storing blocks of data, each sector having an address, the method comprising: reading from the mass data storage device on a sector-by-sector basis; identifying sectors containing partitions by comparing data therein to predetermined data patterns and/or signatures found in partitions; and reading the information from the identified partition sectors.
References Cited (Backward Citations)
US4941059A
Cited
US5083264A
Cited
US5276860A
Cited
US5321824A
Cited
US5421006A
Cited
US5561786A
Cited
US5473753A
Cited
US5432928A
Cited
US5469573A
Cited
US5555405A
Cited
US5535381A
Cited
US5603020A
Cited
US5493649A
Cited
US5623651A
Cited
US5594863A
Cited
US5761404A
Cited
US5832526A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-01-09 | 2004-07-10 | 2005-01-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-01-09 | 2008-07-10 | 2009-01-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-01-09 | 2012-07-10 | 2013-01-09 | $7700.00 | Window Closed / Lapsed |