Analysis of Traces on Storage Media by File Operation for NTFS File System
Huang Bu-gen · Jisuanji gongcheng · 2007
Computer users access data by file system.File and folder operation(such as creation,deletion,and edition) may leave some traces on storage media.These traces are related to file system.NTFS file system allocates and revokes the storage by cluster.It manages by MFT.This paper,from the point of computer forensics,analyzes the method of accessing file for NTFS file system and the traces of the file or folder operating,and compares it with traces of FAT.