Partition recovery method and apparatus
US9164845B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Nov 27, 2009 |
| Grant date | Oct 20, 2015 |
| Priority date | — |
| Expiry date | Jun 30, 2032 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F11/1435
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Provided is a technology which searches an unallocated area to quickly extract information on a deleted partition when checking a disk and an evidence image in digital forensic, and adds a recovered partition to a forensic tool as a new partition. For this, the technology has direct access to the sector of a disk or an evidence image which is obtained, limits information search on an unallocated area only to an area satisfying the minimum size in which a partition may be created, changes an LBA-based sector access scheme into a CHS-based sector access scheme, and reads only the sector of a location having the possibility that a boot record exists to search information of a deleted partition, recovering a partition at high speed.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.