Research on key technologies of data recovery in forensic system
Ni Cheng · Jisuanji yingyong yanjiu · 2008
The style of deleted file's storage was consecutive storage or scattered storage before recovered by other files.This paper proposed an algorithm of match first cluster's high-16 bit accurately.Further more,emphasized to analyse scattered fragments of disk files,proposed a modal of reassembling deleted file fragments based on PPMC algorithm and α-β pruning technology.Employed prediction by partial matching(PPM) to build a context model and compute candidate probabilities of the possible adjacency of two document fragments,and adopted α-β pruning technology to prune some impossible tree one bye one,then reassemble a complete file.