File Caving of Oracle Data File
WU Zhen-don · Jisuanji gongcheng · 2013
In the situation that the metadata of file system is distrusted or cannot be trusted, it is difficult to recovery the Oracle data files completely with the traditional method of data recovery. Rather than rely on the metadata of file system, Oracle control file and log file information, the file carving based on the characteristics of the Oracle data files' internal structure is realized. File carving strategies like ideas parallel unique path, bi-fragment gap carving, entropy and so on are adopted to detect the fragment of Oracle data files. It proposes a file caving algorithm based on the keywords of the file header and file addresses. Experimental results show that this algorithm can also extract Oracle data files effectively with no metadata of file system while it gets rid of the traditional data recovery dependences on the metadata of file system.