Analysing electronic trail on storage media by file operating for FAT file system
Huang Bu-gen · Computer Engineering and Applications Journal · 2007
From user's opinion,anything on a storage media is referred to file.The storage system is based on file folders.The file operations(such as creating,deleting and editing) always leave some trails on storage media.These trails are important for data recovery and forensic evidence,because they can be used to restore data,catch the process of changing,and collect evidence.