Methods for File Recovery on NTFS File System
XU Guo-tia · Xingshi jishu · 2015
Objective In practice,such situations are often encountered that the files have not been restored because of the incorrect recovery tools and/or varied restoring methods.In this paper,three data recovery modes used with NTFS storage device were analyzed and their effects were tested and compared.Methods For the same NTFS storage device,we used NTFS log inspection software developed from previous research to test the recovery choice based on NTFS log file,utilized the quick scan function of Final Data to test the recovery choice based on MFT,and used the full scan function of Final Data to test the recovery choice based on characteristic value.Finally we compared the effect of the three choices and analyzed their recovery principles.Results The recovery choices based on NTFS log file and MFT could obtain comprehensive information but were not suitable for files deleted long before.Though the recovery choice based on characteristic value played poor effect on restoring either the non-contiguous files or the file names and file-creating time,it could restore the files deleted long before albeit time consuming.Conclusions Three methods can be applied in casework with their integrative utilization.