Research on technology of data recovery in computer forensics
Shidong Wang · Journal of Chongqing University of Posts and Telecommunications · 2010
To solve data recovery problems in computer forensics,this paper proposed a new method for data recovery based on NTFS(new technology file system).By analyzing the structure of MFT(master file table),MFT file record,the three file attributes(attribute of standard_information,attribute of file_name,attribute of data)and the change of the attribute value in the head of the file record after file deletion,implementation of the new data recovery method was illustrated in detail,Experimental results show that the designed software in the search volume and efficiency has been improved significantly.