Research on Technology of Recovery Algorithm based on File Feature in Computer Forensics
Gang Wang · Computers & Security · 2013
To solve data recovery problems in computer forensics,this paper proposed a new method for data recovery based on NTFS(new technology file system).By analyzing the structure of MFT(master file table),a recovery algorithm based on file feature,was presented in this paper.The algorithm identified the startand end sector of the lost file by scanning all sectors of the disk and matched them according to the head and foot feature codesof the lost files,then recovered the files by restoring the data between the start and the end sector.Experimental results show that the designed software in the search volume and efficiency has been improved significantly.