CN119937912A - Evidence fixing method, device and storage medium based on file system double cache - Google Patents
Evidence fixing method, device and storage medium based on file system double cache Download PDFInfo
- Publication number
- CN119937912A CN119937912A CN202411837844.1A CN202411837844A CN119937912A CN 119937912 A CN119937912 A CN 119937912A CN 202411837844 A CN202411837844 A CN 202411837844A CN 119937912 A CN119937912 A CN 119937912A
- Authority
- CN
- China
- Prior art keywords
- cache
- metadata
- file
- written
- file system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention provides a evidence fixing method, a device and a storage medium based on double caches of a file system, wherein the method comprises the steps of defining two objects of metadata of the file system and equipment; when the metadata is cached, judging whether the metadata exists in all metadata cache blocks of a file system metadata object, if yes, writing new metadata content into the matched metadata cache blocks, otherwise, dynamically adding a new metadata cache block, recording information of a target file, when the target file is cached, writing the file content blocks into partitions and/or physical devices corresponding to the device cache blocks according to the size of a fixed device cache block and the size of the file content blocks, and after the metadata cache writing and the target file cache writing are completed, writing all the metadata cache blocks into the device cache blocks which are cached with the file content blocks into the physical devices. According to the invention, the file system metadata and the device are taken as two objects, and the data writing is performed based on double caches, so that the performance is improved.
Description
Technical Field
The present application relates to the field of information security technologies, and in particular, to a method, an apparatus, and a storage medium for fixing evidence based on dual caches of a file system.
Background
In the process of evidence collection and preservation, the whole hard disk data is not required to be extracted sometimes, and only certain files or information in a folder are required to be extracted (for example, only certain file data in a U disk are required to be extracted). Sometimes, the special area (unassigned cluster) of the disk is extracted by the same way as logical data is acquired. The logical evidence file structures of different evidence obtaining manufacturers are different, and the following are several evidence fixing methods popular in the industry.
(1) And a non-file system scheme, namely a file aggregation tool such as Tar and a custom format. Multiple files or catalogues can be conveniently combined into one file, and storage, transmission or backup are convenient. It is not directly related to the management of the file system, but is used as a tool for file manipulation for archiving and compression of files.
(2) File system schemes EXT4, NTFS, exFAT, etc. FAT32 is one of the oldest file systems, the compatibility is best but the performance is poor, NTFS performance is better than FAT32 but the compatibility is not as good as FAT32, exFAT is specially designed for flash memory devices, the compatibility is better, the performance is better than FAT32 and NTFS, EXT4 performance is better than FAT32 and NTFS but the compatibility is not as good as FAT32 and NTFS, XFS and Btrfs are the file systems of the newer generation, the performance is better than FAT32, NTFS and EXT4, and the compatibility is not as good.
The prior art only focuses on the capability of a certain aspect of evidence fixation, such as convenient storage, strong file management, automatic capacity expansion, real-time mounting and the like. And cannot be satisfied in an application scenario where both strong file management capability and efficient performance are required.
Disclosure of Invention
In order to solve the technical problems, the invention provides a evidence fixing method, a device and a storage medium based on double caches of a file system, which take metadata and equipment of the file system as two objects, and write data based on the double caches, so that the performance is improved.
The invention adopts the following technical scheme:
In a first aspect, a method for fixing evidence based on dual caches of a file system includes:
Defining two objects of file system metadata and equipment, wherein the file system metadata is structural data used by a file system to manage file storage, and the equipment is physical equipment to which a target file with fixed evidence is to be written;
When the metadata is cached and written, judging whether the metadata exists in all metadata cache blocks of the file system metadata object, if so, writing new metadata content into the matched metadata cache blocks, otherwise, dynamically adding a new metadata cache block, and recording the information of the target file;
When the target file is cached and written, writing the file content blocks into the partitions and/or physical devices corresponding to the equipment cache area according to the fixed equipment cache area size and the file content block size;
And writing the device buffer area in which the file content blocks are cached into the physical device after the target file buffer writing is completed, and writing all the metadata buffer blocks into the physical device after the metadata buffer writing is completed.
Preferably, data with a modification frequency greater than a preset value is assigned to the file system metadata object, and data with a modification frequency less than or equal to the preset value is assigned to the device object.
Preferably, the data buffer writing of the metadata object of the file system but not the metadata is processed by adopting a mode of dynamically adding buffer blocks, and the data buffer writing of the metadata object but not the target file content is processed by adopting a mode of fixing a device buffer area.
Preferably, the metadata cache writing process is specifically as follows:
S21, judging whether the written metadata exist in all metadata cache blocks of the file system metadata object by taking the offset and the length of the target file as keywords, and if yes, turning to S22, and if no, turning to S23;
s22, writing the metadata content to be written into the matched metadata cache block;
S23, applying for a new metadata cache block, writing the metadata content to be written into the new metadata cache block, and recording the offset, the length and the offset of the target file in the metadata cache.
Preferably, the processing procedure of the target file cache writing is as follows:
When the target file is cached, the current cache area of the recording device is used for writing, after the current cache area is fully written, the physical device is written in real time, and then the physical offset of the written file content block is combined to jump into the next cache area, and the steps are sequentially circulated until the writing of the file content block is completed or the written cache area reaches the preset quantity.
Preferably, when the target file is cached, the current cache area of the recording device is used for writing, after the current cache area is fully written, the current cache area is written to the physical device in real time, and then the physical offset of the written file content block is jumped to the next cache area, and the steps are sequentially circulated until the writing of the file content block is completed or the written cache area reaches the preset number, and the method specifically comprises the following steps:
s31, enabling the initial position of the current buffer area to be offset to X corresponding to physical equipment, and writing a first file content block in the initial position of the current buffer area;
S32, judging the physical offset and the length of the written file content block, if the written file content block is in the current buffer, turning to S33, if the written file content block is in the next buffer, turning to S34, and if the written file content block is in the two buffers, turning to S35;
s33, directly writing the file content block into the corresponding position of the current buffer area, and turning to S36;
s34, dividing the file content block into two parts, filling the first half part with the current buffer area, and writing the current buffer area into physical equipment;
S35, directly writing the file content block into the physical equipment, and turning to S36;
S36, jumping to the next file content block.
Preferably, the evidence fixing method based on the file system double caches further comprises the steps of associating reading and writing of the metadata cache with device cache writing and device reading, enabling evidence solidification through the device cache writing after the metadata cache writing fails, and enabling acquisition through the device reading after the metadata cache reading fails.
In a second aspect, an evidence fixing device based on dual caches of a file system includes:
The object dividing module is used for defining two objects of file system metadata and equipment, wherein the file system metadata is structural data used for managing file storage by a file system, and the equipment is physical equipment to which a target file with fixed evidence is written;
The metadata cache writing module is used for judging whether the metadata exists in all metadata cache blocks of the file system metadata object when the metadata is cached and written, if so, writing new metadata content into the matched metadata cache blocks, otherwise, dynamically adding a new metadata cache block and recording the information of the target file;
the target file cache writing module is used for writing the file content blocks into the partitions and/or physical devices corresponding to the device cache areas according to the fixed device cache area size and the file content block size when the target file cache is written;
The evidence fixing module is used for writing the device buffer area in which the file content blocks are cached into the physical device after the target file buffer writing is completed, and writing all the metadata buffer blocks into the physical device after the metadata buffer writing is completed.
In a third aspect, an electronic device, comprising:
One or more processors;
storage means for storing one or more programs,
The one or more programs, when executed by the one or more processors, cause the one or more processors to implement the file system double cache based evidence fixing method.
In a fourth aspect, a computer readable storage medium has computer program code stored thereon, wherein the method of fixing evidence based on dual caches of a file system is performed when the computer program code is executed by a computer.
The invention has the following beneficial effects:
(1) The invention takes the metadata of the file system and the equipment as two objects based on the strong file management capability and capacity expansion capability of the conventional file system, and carries out reading and writing based on double caches, thereby improving the performance;
(2) Because metadata is small and scattered, file content is large and relatively concentrated (the evidence is fixed and is generally continuously stored, and the scene of fragment storage is relatively less), the metadata cache of the invention consists of a plurality of cache blocks, each cache block corresponds to a data structure, the structure records the offset of metadata in a target file, the offset and the length information in the cache, and the metadata cache is increased according to the written metadata application, while the equipment cache is of a fixed size and is set in combination with the actual running environment and the memory size, thereby meeting the requirement of the cache;
(3) According to the method and the device for the metadata cache, the metadata cache read-write and the device cache write are associated, and after the metadata cache read-write fails, the device cache write and the device read can meet the read-write requirements for metadata, so that the metadata cache read-write failure does not influence evidence fixation and only has a certain influence on performance.
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings described below are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is an exemplary device frame pattern to which an embodiment of the present application may be applied;
FIG. 2 is a flow chart of a method for fixing evidence based on dual caches of a file system according to an embodiment of the present application;
FIG. 3 is a diagram of file system metadata according to an embodiment of the present application;
FIG. 4 is a schematic diagram of a device processing object (file content) according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a dual file system cache based evidence fixing apparatus according to an embodiment of the present application;
Fig. 6 is a schematic structural diagram of a computer device suitable for use in implementing an embodiment of the application.
Detailed Description
The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, but not all embodiments, and all other embodiments obtained by those skilled in the art without making any inventive effort based on the embodiments of the present invention are within the scope of the present invention.
In the description of the present invention, it should be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises an element.
In the description of the present invention, unless explicitly stated and limited otherwise, the step identifiers S1, S2, S3, etc. are used for convenience of description, and do not represent an execution sequence, and the corresponding execution sequence may be adjusted as needed.
FIG. 1 illustrates an exemplary device architecture 100 of a file system dual cache based evidence fixing method or file system dual cache based evidence fixing device to which embodiments of the present application may be applied.
As shown in fig. 1, the apparatus architecture 100 may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used as a medium to provide communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
The user may interact with the server 105 via the network 104 using the first terminal device 101, the second terminal device 102, the third terminal device 103, to receive or send messages, etc. Various applications, such as a data processing class application, a file processing class application, and the like, may be installed on the terminal device one 101, the terminal device two 102, and the terminal device three 103.
The first terminal device 101, the second terminal device 102 and the third terminal device 103 may be hardware or software. When the first terminal device 101, the second terminal device 102, and the third terminal device 103 are hardware, they may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like. When the first terminal apparatus 101, the second terminal apparatus 102, and the third terminal apparatus 103 are software, they can be installed in the above-listed electronic apparatuses. Which may be implemented as multiple software or software modules (e.g., software or software modules for providing distributed services) or as a single software or software module. The present invention is not particularly limited herein.
The server 105 may be a server that provides various services, such as a background data processing server that processes files or data uploaded by the terminal device one 101, the terminal device two 102, and the terminal device three 103. The background data processing server can process the acquired file or data to generate a processing result.
It should be noted that, the evidence fixing method based on the dual file system provided by the embodiment of the present application may be executed by the server 105, or may be executed by the first terminal device 101, the second terminal device 102, or the third terminal device 103, and correspondingly, the evidence fixing device based on the dual file system may be set in the server 105, or may be set in the first terminal device 101, the second terminal device 102, or the third terminal device 103.
It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation. In the case where the processed data does not need to be acquired from a remote location, the above-described apparatus architecture may not include a network, but only a server or terminal device.
As shown in FIG. 2, the invention discloses a file system double-cache-based evidence fixing method, which comprises the following steps of.
S1, defining two objects of file system metadata and equipment, wherein the file system metadata is structural data used for managing file storage by a file system, and the equipment is physical equipment to which a target file with fixed evidence is to be written.
Specifically, the metadata structures of each file system are organized differently, and reference may be made to corresponding standard documents. The processing object of the device is mainly file content. The reference standard distinguishing between file system metadata and device two objects is whether modifications are required in the fixing process. The file contents are generally not rewritten after writing, and metadata is required. Such as the Ext4 file system, file system metadata includes superblocks, packet descriptors, block bitmaps, node bitmaps, and node tables. The file system metadata and device handle objects (file content) are shown in fig. 3 and 4.
Further, a particular point of the file system is classified as one of two objects of the file system metadata or the device. If there is a special point in Ext4, the file has the concept of an indirect node block, which is not part of the file content, but the middle may release modifications, then it is attributable to the metadata object by reference. Other file systems also have special points, and the supplementary judgment standard provided by the invention is that the part between the metadata and the file content needs to be verified and adjusted by combining the actual read-write frequency, because the part can be written to the target equipment in real time. The adjustment method is that the modification frequency is not high and is attributed to the device object, and the modification frequency is high and is attributed to the file system metadata object. The frequency of modification is set according to practical application, and the influence on performance is not great.
S2, when the metadata is cached and written, judging whether the metadata exists in all metadata cache blocks of the metadata object of the file system, if so, writing new metadata content into the matched metadata cache blocks, otherwise, dynamically adding a new metadata cache block, and recording the information of the target file.
Specifically, two object caches of the file system metadata and the device need to be defined. File system metadata differs from file content in that metadata is small and scattered, and file content is large and relatively concentrated (evidence is generally continuously stored in a fixed way, and the number of fragment stored scenes is relatively small). Therefore, in the invention, the metadata cache is set to be composed of a plurality of cache blocks, each cache block corresponds to a data structure, the structure records three information of the offset of the metadata in the target file, the offset and the length of the metadata in the cache, the metadata cache is increased according to the written metadata application, the equipment cache is of a fixed size, the larger the equipment cache is, the better the equipment cache is in combination with the actual running environment and the memory size, such as a physical memory 8G, and the equipment cache can select 1G, 2G and the like.
In this embodiment, reading and writing of the metadata cache are realized, and dynamic addition of the cache block is realized in the metadata cache writing, so that rapid matching is realized in the subsequent metadata cache reading process. The processing procedure of the metadata cache writing is as follows:
S21, judging whether the written metadata exist in all metadata cache blocks of the file system metadata object by taking the offset and the length of the target file as keywords, and if yes, turning to S22, and if no, turning to S23;
s22, writing the metadata content to be written into the matched metadata cache block;
S23, applying for a new metadata cache block, writing the metadata content to be written into the new metadata cache block, and recording the offset, the length and the offset of the target file in the metadata cache.
It should be noted that, for a special point of the file system, if some cache blocks are recovered in the evidence fixing process, a failure flag needs to be added, and the flag does not participate in the judgment of the cache block in S21, and the device is not written in S4, so as to avoid covering the file content finally.
And S3, when the target file is cached, writing the file content blocks into the partitions and/or physical devices corresponding to the device cache region according to the fixed device cache region size and the file content block size.
When realizing equipment cache writing (the file content is not rewritten after being written generally, and cache reading is not needed), the following situations need to be considered, namely, the writing position is in the current cache area, the writing position is in the next cache area, the writing position is behind two cache areas, and the like. And recording the use size of the current buffer area, writing to physical equipment in real time after the current buffer area is fully written, and jumping to the next buffer area by combining with physical offset, wherein the length of the buffer area is set to be L.
The treatment process is as follows:
s31, the initial position of the current buffer area corresponds to the offset X of the physical equipment, X=0 is calculated initially, and a first file content block is written;
S32, judging the physical offset plus length of the written data, if the current buffer is changed to S33, if the next buffer is changed to S34, if the next buffer is changed to S35;
S33, directly writing the file content block into the corresponding position (the physical offset-X of the written data) of the current buffer area, and turning to S36;
s34, dividing the file content block into two parts, filling the first half part into a current buffer area, and writing the current buffer area into the device, wherein the initial position of the current buffer area corresponds to the offset X+L of the physical device, and writing the second half part of the file content into the current buffer area, and turning to S36;
S35, directly writing the file content block into the physical equipment, and turning to S36;
S36 jumps to the next file content block.
And S4, after the target file is written, writing the device cache area cached with the file content blocks into the physical device, and after the metadata is written, writing all the metadata cache blocks into the physical device.
It should be noted that writing the device buffer in which the file content block is cached to the physical device may be actually understood as writing the last device buffer to the physical device. The last piece of equipment cache is defined as a physical equipment offset address Y corresponding to the starting position of the cache area, wherein y=target file size-target file size% equipment cache size.
Furthermore, the evidence fixing method based on the file system double caches further comprises the steps of associating the reading and writing of the metadata cache with the device cache writing and the device reading, performing evidence solidification through the device cache writing after the metadata cache writing fails, and acquiring through the device reading after the metadata cache reading fails. The read-write failure of the metadata cache does not affect the business processing, the evidence fixation and only has a certain effect on the performance.
The time elapsed for the two methods of evidence curing using the tar tool and evidence curing using the optimized EXT4 protocol of the present invention will be compared as follows.
Application scene:
Source data (mechanical disk Y-disk) 5G size, 46535 files, 34450 folders.
Target image (state of mechanical disk X1.9T, remainder 439G) is copied off immediately after one image is written.
Packaging using the tar tool takes 840 seconds in total, with 120 seconds of traversing the file before creating the mirror. Whereas the EXT4 protocol optimized using the present invention takes 761 seconds. It can be known that the evidence fixing method based on the file system double cache is better than the existing non-file system scheme in performance.
In summary, the invention provides a evidence fixing method based on a file system double-cache based on the strong file management capability and capacity expansion capability of a conventional file system on the basis of the conventional file system scheme, takes file system metadata and file content as two objects, wherein the file system metadata is based on cache read-write, and the file content is based on cache write (reading is not needed and is directly read from physical equipment but not from cache) so as to be applicable to all file systems and successfully applied to a logic evidence quick fixing method of an intelligent terminal, thereby improving the evidence fixing performance.
As shown in fig. 5, the present invention provides an embodiment of a dual file system based evidence fixing apparatus, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices, including:
The object dividing module 501 is configured to define two objects of file system metadata and a device, where the file system metadata is structural data used by a file system to manage file storage, and the device is a physical device to which a target file with fixed evidence is to be written;
The metadata cache writing module 502 is configured to determine whether the metadata exists in all metadata cache blocks existing in the metadata object of the file system when the metadata is cached, if so, write new metadata content into the matched metadata cache blocks, otherwise, dynamically add a new metadata cache block, and record information of the target file;
The target file cache writing module 503 is configured to write, when the target file cache is written, the file content block into the partition and/or the physical device corresponding to the device cache according to the fixed size of the device cache and the size of the file content block;
The evidence fixing module 504 is configured to write the device buffer area cached with the file content block to the physical device after the target file cache writing is completed, and write all metadata cache blocks to the physical device after the metadata cache writing is completed.
As shown in fig. 6, a schematic diagram of a computer apparatus 600 suitable for use in an electronic device (e.g., a server or terminal device as shown in fig. 1) for implementing an embodiment of the present application is shown. The electronic device shown in fig. 6 is only an example and should not be construed as limiting the functionality and scope of use of the embodiments of the application. As shown in fig. 6, the computer apparatus 600 includes a Central Processing Unit (CPU) 601 and a Graphics Processor (GPU) 602, which can perform various appropriate actions and processes according to programs stored in a Read Only Memory (ROM) 603 or programs loaded from a storage section 609 into a Random Access Memory (RAM) 604. In the RAM 604, various programs and data required for the operation of the computer device 600 are also stored. The CPU 601, GPU 602, ROM 603, and RAM 604 are connected to each other through a bus 605. An input/output (I/O) interface 606 is also connected to the bus 605. Connected to the I/O interface 606 are an input portion 607 including a keyboard, a mouse, and the like, an output portion 608 including a speaker, a Liquid Crystal Display (LCD), and the like, a storage portion 609 including a hard disk, and the like, and a communication portion 610 including a network interface card, such as a LAN card, a modem, and the like. The communication section 610 performs communication processing via a network such as the internet. The drive 611 may also be connected to the I/O interface 606 as needed. A removable medium 612 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 611 as necessary, so that a computer program read out therefrom is mounted into the storage section 609 as necessary.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flowcharts. In such embodiments, the computer program may be downloaded and installed from a network via the communication portion 610, and/or installed from the removable medium 612. The above-described functions defined in the method of the present application are performed when the computer program is executed by a Central Processing Unit (CPU) 601 and a Graphics Processor (GPU) 602.
It should be noted that the computer readable medium according to the present application may be a computer readable signal medium or a computer readable medium, or any combination of the two. The computer readable medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor apparatus, device, or means, or a combination of any of the foregoing. More specific examples of a computer-readable medium may include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution apparatus, device, or apparatus. In the present application, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may be any computer readable medium that is not a computer readable medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution apparatus, device, or apparatus. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.
In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based devices which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The modules involved in the embodiments of the present application may be implemented in software or in hardware. The described modules may also be provided in a processor.
As another aspect, the present application also provides a computer-readable medium that may be included in the electronic device described in the above embodiment, or may exist alone without being incorporated into the electronic device.
The computer readable medium is loaded with one or more programs, when the one or more programs are executed by the electronic device, the electronic device is enabled to define two objects of file system metadata and device, wherein the file system metadata is structural data used for managing file storage by a file system, the device is physical device to which a target file with fixed evidence is to be written, when metadata cache writing is carried out, whether the metadata exists in all metadata cache blocks of the file system metadata object, if yes, new metadata content is written into the matched metadata cache blocks, otherwise, a new metadata cache block is dynamically added, information of the target file is recorded, when the target file cache writing is carried out, the file content blocks are written into a partition and/or physical device corresponding to the device cache according to the size of the fixed device cache and the size of the file content block, after the target file cache writing is completed, the device cache with the file content blocks is written into the physical device, and after the metadata cache writing is completed, all metadata cache blocks are written into the physical device.
The above description is only illustrative of the preferred embodiments of the present application and of the principles of the technology employed. It will be appreciated by persons skilled in the art that the scope of the application referred to in the present application is not limited to the specific combinations of the technical features described above, but also covers other technical features formed by any combination of the technical features described above or their equivalents without departing from the inventive concept described above. Such as the above-mentioned features and the technical features disclosed in the present application (but not limited to) having similar functions are replaced with each other.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411837844.1A CN119937912A (en) | 2024-12-13 | 2024-12-13 | Evidence fixing method, device and storage medium based on file system double cache |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411837844.1A CN119937912A (en) | 2024-12-13 | 2024-12-13 | Evidence fixing method, device and storage medium based on file system double cache |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN119937912A true CN119937912A (en) | 2025-05-06 |
Family
ID=95553373
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202411837844.1A Pending CN119937912A (en) | 2024-12-13 | 2024-12-13 | Evidence fixing method, device and storage medium based on file system double cache |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN119937912A (en) |
-
2024
- 2024-12-13 CN CN202411837844.1A patent/CN119937912A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR102240557B1 (en) | Method, device and system for storing data | |
| US11516288B2 (en) | Synchronized content library | |
| US12333173B2 (en) | Transparent data movement between a private cloud and storage ecosystem and another storage system | |
| JP5814436B2 (en) | Caching information system and method | |
| JP2019517042A (en) | Providing access to hybrid applications offline | |
| US10855746B2 (en) | Generating content fragments for content distribution | |
| CN105474200A (en) | Hydration and dehydration with placeholders | |
| CN107197359B (en) | Video file caching method and device | |
| US11119977B2 (en) | Cognitive compression with varying structural granularities in NoSQL databases | |
| CN106817388A (en) | The system that virtual machine, host obtain the method, device and access data of data | |
| CN104123309A (en) | Method and system used for data management | |
| CN113791735A (en) | Video data storage method and device, computer equipment and storage medium | |
| CN115495020A (en) | File processing method and device, electronic equipment and readable storage medium | |
| US8984028B2 (en) | Systems and methods for storing data and eliminating redundancy | |
| US9020902B1 (en) | Reducing head and tail duplication in stored data | |
| US20190243807A1 (en) | Replication of data in a distributed file system using an arbiter | |
| US11366613B2 (en) | Method and apparatus for writing data | |
| CN119937912A (en) | Evidence fixing method, device and storage medium based on file system double cache | |
| CN118152346A (en) | File online operation scene conversion method, device, system and storage medium | |
| CA2722511C (en) | Efficient change tracking of transcoded copies | |
| CN114629895A (en) | File fragment breakpoint continuous transmission method and device, terminal equipment and medium | |
| CA2722514A1 (en) | Compressing photos for devices | |
| JP7042567B2 (en) | Distribution of digital content with embedded user-specific information | |
| CN119071596A (en) | Multimedia data processing method, device, equipment, storage medium and program product | |
| CN120336275A (en) | Resource synchronization method, device, equipment and readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |