一种Office文件数据分片识别、排序、重组及修复方法  

A Method of Office Data Fragmentation Recognition, Sorting, Reorganization and Repair

作　　者：徐国天[1] XU Guotian(Cyber Crime Investigation Department,Criminal Investigation Police University of China,Shenyang Liaoning 110854,China)

机构地区：[1]中国刑事警察学院网络犯罪侦查系

出　　处：《信息网络安全》2019年第9期26-30,共5页Netinfo Security

基　　金：辽宁省自然科学基金[20180550841,2015020091];中央高校基本科研业务费[3242017013];公安部理论及软科学研究计划[2016LLYJXJXY013];公安部技术研究计划[2016JSYJB06];辽宁省社会科学规划基金[L16BFX012]

摘　　要：恢复被删除的涉案Office文档对调查取证工作有重要意义。当被删除的Office文件数据分为多段存储在磁盘内,且MFT记录被覆盖时,现有数据恢复工具无法有效恢复被删除的数据。针对这一问题,文章提出一种Office文件数据分片识别、排序、重组及修复方法。根据Office文件尾部目录区数据定位全部数据分片,确定分片排列次序,重组Office文件,并对受损数据分片进行修复。实践证明,该方法可有效恢复2007以上版本Office文档,在Office文件数据恢复方面优于X-way等恢复工具采用的首尾特征值恢复方法,可以达到更优的恢复效果。Restoring deleted office documents is of great significance to the investigation and evidence collection.When the deleted office file data is stored on disk in multiple segments and MFT records are overwritten,the existing data recovery tools can not effectively recover the deleted data.In order to solve this problem,this paper proposes a method of office data fragmentation recognition,sorting,reorganization and repair.According to the data in the catalog area at the end of the Office file,locate all data fragments,determine the order of fragmentation,reorganize the Office file,and repair the damaged data fragments.Practice has proved that the method proposed in this paper can effectively restore the version of Office documents above 2007.

关 键 词：Office数据分片 识别 排序 重组 修复 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]