A DIgital Evidence Collection Technology Based on NTFS File System
YE Xian-liang · Computer Programming Skills & Maintenance · 2011
Through analysising the physical structure and logical framework of NTFS file system,servral problems which are reading the metadata and the recovery of fragmented files have been proposed for the development of computer forensic software.The implementation of information collection module has provided a solving way for the development of computer forensic software.