Computer Forensics Research and Implementation Based on NTFS File System
Naiqi Liu, Wang Zhongshan, Hao Yujie, QinKe · 2008
Based on NTFS file system, this paper proposed an algorithm of reconstructing directory tree above deleted files. Further more, by analyzing the internal structure of the NTFS file system in detailed, the storage principle of Data Runs in attribute 80 of MFT is clarified. Author analyzed some exceptions occurred during deleting files and compared the self-researched data recovery software named SmoothRecovery with the EasyRecovery appeared in the market. The result shows SmoothRecovery is more excellent than EasyRecovery on the efficiency of implementation.