CN-114996046-B - Disk scanning acceleration method and device for windows system

CN114996046BCN 114996046 BCN114996046 BCN 114996046BCN-114996046-B

Abstract

The present disclosure provides a disk scanning acceleration method and device for windows system, and relates to the field of computers, the method comprises the steps of opening a main file table, wherein the main file table comprises file records; the method comprises the steps of determining data attributes of files corresponding to each file record, extracting block numbers of file blocks of files with data attributes of being very resident based on the file records to obtain a block number set, extracting logical block numbers of each block number based on the block number set, generating a logical block number list based on the logical block numbers, and reading file contents based on the logical block number list to finish disk scanning. In the method and the system, the logical block numbers in the file records of the main file table are sequentially arranged in the disk scanning process, so that the magnetic head can sequentially read on the disk sector, the disk scanning speed is improved, and the disk scanning time is saved.

Inventors

LI BIN
LIU CHANGXI
ZHU NENGFEI
WU KE

Assignees

北京网藤科技有限公司

Dates

Publication Date: 20260505
Application Date: 20220805

Claims (5)

1. A disk scan acceleration method for windows system, comprising the steps of: Opening a main file table, wherein the main file table comprises file records; determining the data attribute of the file corresponding to each file record; Based on the file record, extracting the block number of the file block of the file with the data attribute of being very resident to obtain a block number set; extracting a logic block number of each block number based on the block number set; generating a logic block number list based on the logic block number; reading file content based on the logic block number list to finish disk scanning; reading a file record of a file with the data attribute of resident in the file record, and finishing the file reading with the data attribute of resident; Wherein the data attributes include resident and very resident; The logic block number list is generated based on the logic block numbers, and specifically comprises the steps of sorting the logic block numbers from small to large to obtain the logic block number list; the reading of the file content based on the logical block number list, completing the disk scanning, specifically includes: Calculating each logical block number in the logical block number list to obtain a corresponding disk offset address; Reading the file based on the disk offset address to finish disk scanning; The disk offset address is calculated by the following equation, A=LCN×S×512 Wherein A is a disk offset address, LCN is a logical block number, and S is the number of sectors contained in a file block.
2. The method for accelerating the scanning of the disk for the windows system according to claim 1, wherein the step of reading the file based on the disk offset address to complete the scanning of the disk comprises the following steps: and performing magnetic head addressing according to the disk offset addresses, reading file contents of files corresponding to the disk offset addresses, and finishing disk scanning.
3. A disk scan acceleration apparatus for windows systems, comprising: The opening unit is used for opening a main file table, wherein the main file table comprises file records; A determining unit, configured to determine a data attribute of a file corresponding to each file record; The first extraction unit is used for extracting the block number of the file with the data attribute of being very resident based on the file record to obtain a block number set; a second extracting unit for extracting a logical block number of each block number based on the set of block numbers; a generating unit, configured to generate a logic block number list based on the logic block number; the scanning unit is used for reading file contents based on the logical block number list and finishing disk scanning; the reading unit is used for reading the file record of the file with the resident data attribute in the file record and finishing the reading of the file with the resident data attribute; Wherein the data attributes include resident and very resident; The logic block number list is generated based on the logic block numbers, and specifically comprises the steps of sorting the logic block numbers from small to large to obtain the logic block number list; the reading of the file content based on the logical block number list, completing the disk scanning, specifically includes: Calculating each logical block number in the logical block number list to obtain a corresponding disk offset address; Reading the file based on the disk offset address to finish disk scanning; The disk offset address is calculated by the following equation, A=LCN×S×512 Wherein A is a disk offset address, LCN is a logical block number, and S is the number of sectors contained in a file block.
4. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the steps of the method according to any of claims 1-2 when the computer program is executed.
5. A computer readable storage medium storing a computer program, characterized in that the computer program when executed by a processor implements the steps of the method according to any one of claims 1 to 2.

Description

Disk scanning acceleration method and device for windows system Technical Field The present disclosure relates to the field of computers, and in particular, to a method and apparatus for accelerating disk scanning in windows systems. Background The concept of the industrial control system network security white list is provided on the basis of the industrial control system network security white environment by combining the characteristics of frequency, communication and data of industrial control system software and equipment update aiming at the strict requirements of the industrial control system on reliability, stability and service continuity from the aspect of industrial control system security. In industrial control system software such as an industrial white list, disk scanning is performed, all files need to be traversed in a full disk, a hash algorithm is adopted to generate characteristic values of the files, and the software needs to provide a function of searching based on the characteristic values. In this process, it may take several tens of minutes or even hours to access a slower mechanical hard disk or the like to complete, due to the need to traverse all files in full disk. File access takes a significant portion of the time when traversing all files through the disk. For a mechanical hard disk, because of randomness of file storage positions, when a file is opened and read, a magnetic head needs to be continuously moved to position a disk sector for positioning, so that the magnetic head addressing operation in the file access process is most time-consuming and labor-consuming, and becomes a performance bottleneck for accessing the mechanical hard disk. Currently, an NTFS file system is a mainstream file system used by a Windows-series operating system, in which an application program interface (Application Programming Interface, API) provided by a calling system accesses files on a disk, and the files must pass through the file system, and in this case, the problem of low disk scanning speed cannot be solved. When the read data attribute is a resident file, the application layer of the file system calls a CreateFile, the CreateFile function call NTCREATEFILE, NTCREATEFILE is trapped into a kernel call ZwCreateFile function through sysenter instructions, the ZwCreateFile function initiates IRP (Interrupt Request Packet) and sends the CreateFile function to a file driver, the file driver analyzes IRP to an object manager to locate the file, a kernel object of the file is created in a kernel, a handle of the kernel object is returned, and then the application layer calls a readFile to read file content. It can be found that file reading of a file with a data attribute of resident file has the problems of complicated process and time consumption. Disclosure of Invention In order to solve the above problems in the prior art, the present disclosure provides a method and an apparatus for accelerating disk scanning of windows system, which can bypass a file system to directly access a disk, and adopts the following technical scheme: the present disclosure provides a disk scan acceleration method for windows system, comprising the steps of: s1, opening a main file table, wherein the main file table comprises file records; S2, determining the data attribute of the file corresponding to each file record; s3, extracting block numbers of file blocks of the file with the data attribute of being very resident based on the file record to obtain a block number set; s4, extracting the logic block number of each block number based on the block number set; S5, generating a logic block number list based on the logic block numbers; S6, reading file contents based on the logic block number list, and finishing disk scanning. Further, data attributes include resident and very resident. Further, based on the logical block numbers, a logical block number list is generated, which specifically includes: And sorting the logic block numbers from small to large to obtain a logic block number list. Further, reading file content based on the logical block number list to complete disk scanning, which specifically includes: calculating each logical block number in the logical block number list to obtain a corresponding disk offset address; and reading the file based on the disk offset address to finish disk scanning. Further, the disk offset address is calculated by the following equation, A=LCN×S×512 Wherein A is a disk offset address, LCN is a logical block number, and S is the number of sectors contained in a file block. Further, reading the file based on the disk offset address to complete disk scanning, which specifically includes: And performing magnetic head addressing according to the disk offset addresses, and reading file contents of files corresponding to the disk offset addresses to finish disk scanning. Further, the method for accelerating the scanning of the disk for the windows system further comprises the