系统还原原理（System restore principle）.docVIP

系统还原原理（System restore principle） Restore the wizard, freezing point, shadow system and other restore products in the key technical principles, there is no essential difference, are in the disk filter driver layer of a particular sector IO re positioning processing. This article will give a brief analysis of this technology, and provide a practical implementation of the source code. The implementation of multi-point restore is much different from the previous ones. Virtual restore data protection technology We all know that when the system is installed in the disk restore software and activate after the write operation: create, modify and delete all the files of the application layer, and a variety of changes in the system settings, registry, including partition format, after a system restart is completely restored to the state when activated to restore software. Behind this recovery image, there is not really any mechanism that helps us to rollback the various operations of the file system to the original state. In fact, once the reduction software is activated, it is no longer valid we all write operations on the file, all wrote some temporary space on the disk, such as unused clusters or pre assigned specific storage file, and the disk partition has effective distribution sector to files, a will not be written! Because of the lower file system driver is restored by a relocation table in memory, help us to maintain links between these dirty data writes the new fast and upper file system structure, so we still feel a variety of file operations are normal. However, when the system restarts, the non persistent relocatable table disappears in memory, the driver is initialized, and more importantly, the original allocation of the active portion of the file system has not changed! So the disk partition structure we see through the file system is not changed (actually, it changes, and the files you write before the system restarts are on disk, unallocated clusters, or tem