Computer Forensics Research and Implementation Based on NTFS File System

摘要

Based on NTFS file system, this paper proposed an algorithm of reconstructing directory tree above deleted files. Further more, On the basis of detailedly analyzing the theory of internal structure of the NTFS file system, this paper clarified the storage principle of Data Runs in attribute 80 of MFT. Finally, this paper analyzed some exceptions occurred during deleting files, and compared the self-researched data recovery software named SmoothRecovery with EasyReocvery appeared in the market. The result shows SmoothRecovery is more excellent than EasyReocvery on the efficiency of implementation.