The Research of File Recovery Method on EXT3 File System
XU Guo-tian · Xinxi wangluo anquan · 2011
The research of file recovery method on EXT4 file system was important for computer forensics.The recovery method on journal had been studied in detail.In this paper,specific examples were used to study.First,the composition of extent tree was analyzed.After the file was deleted,The change of extent tree was analyzed.According to the inode number,the method to locate the data block was studied.The way to restore deleted file had been discussed in detail.The conclusion was investigators could effectively restore deleted files on EXT4 file system by journal.The research results could be applied in computer forensics and electronic evidence examination courses.