Patent attributes
Embodiments of the invention provide a falsification detection method which is capable of recognizing the substance of a falsification, applicable to not only a specific file system, but any arbitrary application writing data with a logical stricture, usable in a standalone environment and able to prevent its performance from deteriorating even for a very large data size. In one embodiment, data stored in the storage medium employed in a disk drive is divided into meta information expressing a data structure and contents. At a step, time transients of the meta information are analyzed whereas, at other steps, time transients of the contents are analyzed. By analyzing the data at two stages in this way, replacement of a file and replacement of contents of the file can be detected whereas the substance of a falsification can be recognized in the case of a file system. By providing every block in the storage medium employed in the disk drive with a flag area that can be updated by the disk drive but only referred to by a host, a falsification can be detected even if the falsification results from a write operation carried out by using an illegal access path.
