文件恢复软件如何工作？
我想做一些简单的文件恢复软件，我想尝试恢复通过按 Shift + Delete 删除的文件。 我在 Windows 中工作，任何人都可以向我展示任何可以帮助我以编程方式执行此操作的链接或文档吗？ 我了解 C、C++、.NET。 有什么指点吗？
I wanted to make some simple file recovery software, where I want to try to recover files which happen to have been deleted by pressing Shift + Delete. I'm working in Windows, can anyone show me any links or documents which can help me to do so programatically? I know C, C++, .NET. Any pointers?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
http://www.google.hu/search?q=file+recovery+theory&ie=utf-8&oe=utf-8&aq=t& ;rls=org.mozilla:en-US:official&client=firefox-a :)
据我所知，文件恢复主要是在磁盘中查找文件头和/或文件名，然后尝试获取整个文件通过标题信息。
这可能是一个好的开始：http://geeksaresexy。 blogspot.com/2006/02/theory-behind-deleted-files-recovery.html
http://www.google.hu/search?q=file+recovery+theory&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a :)
Mainly file recoveries are looking for file headers and/or filenames in the disk as I know, then try to get the whole file by the header information.
This could be a good start: http://geeksaresexy.blogspot.com/2006/02/theory-behind-deleted-files-recovery.html
所有恢复工具的原理是，删除文件仅删除文件夹中的指针，并且（快速）分区格式化仅重写包含文件系统标头的分区的第一个扇区。 对分区数据（扇区级别）的深入分析可以重建大部分文件系统数据、簇分配表、文件夹和文件簇链。
当然，如果您在格式化分区时使用表面测试工具，该工具将重写所有扇区以确保它们正确，则任何内容都将无法恢复 - 除非您使用专门的硬件来查看实际磁道边缘的剩磁
The principle of all recovery tools is that deleting a file only removes a pointer in a folder and (quick) formatting of a partition only rewrites the first sectors of the partition which contains the headers of the filesystem. An in depth analysis of the partition data (at sector level) can rebuild a big part of the filesystem data, cluster allocation tables, folders, and file cluster chains.
All course if you use a surface test tool while formatting the partition that will rewrite all sectors to make sure that they are correct, nothing will be recoverable - unless you use specialized hardware to look at remanent magnetism on the edges of the actual tracks
在Windows中，当文件被删除（永久删除）时，它实际上并没有从磁盘中删除，而是在文件名前面添加了字符（我猜），并且Windows在资源管理器中显示时会忽略这些...并且恢复工具将搜索这些文件磁盘中的文件名类型。 并且您的文件根据已删除文件位置上覆盖的一些数据恢复完整性。 不知道 Windows 仍然使用这种模式..但很久以前我在某个地方读过这个
In windows when a file is deleted(permanent delete) it's not actually deleted from disk but the file name added with char( _ I guess) in front of it and windows ignores these when showing in explorer... and recovery tools will search these kind of file names in the disk. And your file recover integrity based on some data over written on location of deleted file. Don't know this pattern still used by windows.. but long time back I have read this some where