KR102079519B1 - A method for identifying TAT file system, and for confirming an image save area to recover a black box image data - Google Patents

Abstract

The present invention is to provide a method for restoring a black box image data and a method for backing up image data by automatically identifying various file systems used for storing black box image data and determining an image data storage area.
According to the present invention, according to the present invention, by confirming the black box file system from the data stored in the black box and reading the image data storage area, the image data area in the black box that is impossible to extract the image data by normal data recovery Image data stored separately can be restored, and all black box image data stored in the allocated area and the unallocated area can be found and extracted.

Description

A method for identifying TAT file system, and for confirming an image save area to recover a black box image data}

The present invention relates to a data analysis method stored in a vehicle black box in the field of digital forensic evidence, and has a TAT (Time Allocation Table) file system applied among various file systems used for storing image data in a vehicle black box. And a method for more effectively analyzing the image evidence of the vehicle black box by identifying the type discrimination and the image data storage area.

Currently, a vehicle black box processes image data input through front or rear cameras using image processing technology and stores the data in a memory storage device. FAT (File Allocation Table), the most compatible with various operating systems (OS), TAT (Time Allocation Table) to store video data in real time, and FAT and TAT for efficient data management and stable data storage. The format free method combining the advantages of the above is being used.

However, since the file systems used in the black box are not compatible with the OS and other file systems, it is difficult to extract the saved video data when the backup of the black box video is performed. When recovering video data, it is necessary to identify the file system. Since video data storage methods are different for each manufacturer, a method for more effectively identifying a video data storage area is required.

An object of the present invention is to provide a method for restoring a black box image data and a method for backing up image data by automatically identifying various file systems used for storing black box image data and determining an image data storage area.

According to an embodiment of the present invention for achieving the technical problem, in the method for confirming the black box file system and the image storage area,

The verification of the black box file system includes a zero sector detection step of reading the start information of the file system,

A partition table reading step of reading partition table information;

A TAT signature reading step of searching for a signature of a time allocation table (TAT) file system and determining the file system,

The image storage area check includes a map information reading step of checking data map information of the TAT file system and reading map information;

And finally a file system determination step of determining the file system used in the black box.

The zero sector detection step detects MBR (Main Boot Recorder) data among data stored in a black box, checks a signature recorded at a specific position of the detected data, and determines whether there is partition information. If the MBR data is abnormal, you can stop reading the black box file system.

In the partition table reading step, the presence of the primary TAT file system is detected by reading the partition table detected in the zero sector detection step, reading partition related information such as the number of partitions and capacity of the black box data.

The TAT signature reading step determines the presence or absence of a TAT signature on a sector basis when determined as the TAT file system in the partition table reading step. The determination of the presence or absence of the TAT signature is performed only up to the reference value, and if the TAT signature does not exist until the reference value, it is determined that the TAT file system is not.

When the map information reading step is determined by the TAT file system, the map information is moved to a sector in which the map information is stored to detect the map information, and from the detected map information, the event recording area, the constant recording area, Read the parking recording area, manual recording area, etc. and check the size of the area and the existence of video data.

The file system determination step is a step of determining the file system used in the black box based on the information obtained through the above process, and can determine three types of FAT, TAT, and format free.

As described above, according to the present invention, by confirming the black box file system from the data stored in the black box and reading the image data storage area, the image stored in each image data area in the black box, which cannot be extracted by normal data recovery. Data can be recovered and all black box image data stored in the allocated area and the unallocated area can be found and extracted.

1 is a flowchart illustrating a method of identifying a black box file system and identifying an image storage area according to an embodiment of the present invention.
FIG. 2 is a flowchart for explaining the file system determination step of FIG. 1.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, FIG. 1 is a flowchart illustrating a method of identifying a black box file system and checking an image storage area.

As shown in FIG. 1, the black box file system identification and image storage area confirmation method includes a zero sector detection step, a partition table reading step, a TAT signature reading step, a map information reading step, and a file system determining step.

First, in the zero sector detection step, the MBR is searched from among the data stored in the black box, the data is detected, the signature is checked from the detected data, the partition information is detected, and the partition information is detected. If there is no signature or partition information in the MBR information, it is determined as Error and the file system determination step is moved.

Next, the partition table reading step is a step of reading the partition information detected in the zero sector detection step, which is a previous step, and reads whether a partition exists, the number of partitions, the partition capacity, and the like. When the reading is complete, the next step is to move to the TAT signature reading step. If there is an error in the partition information, it is determined as Error and the file system determination step is moved.

The next step, the TAT signature reading step, is to read the signature of the TAT file system, which searches for the TAT signature recorded at a specific position while moving sector by sector. The search for the TAT signature proceeds to 2,097,152 sectors, which are reference values. If the TAT signature is confirmed during the search, the search is terminated.

The next step, reading the map information, detects map information on the image data stored in the black box and analyzes the map information. The map information is stored in the designated location in the sector where the TAT signature exists, Check and detect if map information is stored in the normal structure. Based on the detected map information, map information analysis is performed to analyze various video storage areas such as event recording area, regular recording area, parking recording area, parking shock recording area, and emergency image storage area.

The file system determination step, which is the final step, is a step for determining the file system on the basis of the previously determined information, which will be described in detail with reference to FIG.

2 is a flowchart for explaining a file system determination step.

The file system determination step includes a partition size confirmation step and a signature classification step, and the file system determination first begins at the partition size information confirmation step. In the partition size checking step, the partition size is checked to determine the FAT file system if the partition size of the image data is larger than 200 MB, and the TAT file system if the partition size is smaller than 200 MB.

In the next step of identifying the signature, it is finally determined whether the file system is a FAT file system or a TAT file system according to the file signature information.

If it is determined as a FAT file system, it checks the size of the saved video file and if the video file size has a certain value, it is determined as a format free file system. Determine.

If it is determined as a TAT file system, it is determined as a TAT file system after confirming the existence of the map information.

As described above, although the present invention has been described with reference to the limited embodiments and the drawings, the present invention is not limited to the above embodiments, which are those skilled in the art to which the present invention pertains. It is to be understood that the present invention may be modified and changed in various ways without departing from the spirit and scope of the invention as set forth herein.

Claims (7)

In the method of checking the black box file system and the image storage area,
The verification of the black box file system includes a zero sector detection step of reading the start information of the file system;
A partition table reading step of reading partition table information;
A TAT signature reading step of searching for a signature of a time allocation table (TAT) file system and determining the file system,
The image storage area confirmation includes a map information reading step of checking data map information of the TAT file system and reading map information;
A file system determination step of determining a file system used in the black box,
The file system determining step includes a partition size checking step and a signature distinguishing step,
In the partition size checking step, if the size of the partition where the image data is stored is larger than 200 MB, the partition size is checked, and if the size is smaller than 200 MB, the TAT file system is determined.
In the next step of distinguishing the signature, it is finally determined whether it is a FAT file system or a TAT file system according to file signature information.
If it is determined as a FAT file system, it checks the size of the saved video file and if the video file size has a certain value, it is determined as a format free file system. And determining the TAT file system after confirming the existence of the map information when the determination is made as the TAT file system. The method of claim 1,
The zero sector detection step detects MBR (Main Boot Recorder) data among the data stored in the black box, checks the signature recorded at a specific position of the detected data, detects the presence or absence of partition information, and detects the MBR. The black box file system check and image storage area check method, characterized in that if the data is abnormal, black box file system reading is stopped. The method of claim 1,
In the partition table reading step, the presence or absence of a primary TAT file system may be detected by reading a partition table detected in the zero sector detection step and reading partition related information such as the number and capacity of black box data. To check the black box file system and the image storage area. The method of claim 1,
When the TAT signature reading step is determined as a TAT file system in the partition table reading step, the presence or absence of a TAT signature is determined in units of sectors. If the TAT signature does not exist, characterized in that it is determined that the TAT file system, black box file system check and image storage area check method. The method of claim 1,
In the step of reading the map information, when it is determined by the TAT file system, the map information is moved to a sector where the map information is stored and the map information is detected. And a parking recording area, a manual recording area, and the like, and checking the size of the corresponding area and the presence or absence of image data. The method of claim 1,
The determining of the file system may include determining three types of FAT (File Allocation Table), TAT, and Format Free (FAT). delete

Images