METHOD OF RECOVERING DATA IN COW-BASED FILE SYSTEM USING DIGITAL FORENSIC TECHNOLOGY

摘要

The present invention relates to a method of recovering data in a COW-based file system of a Linux operating system by using a digital forensic technology. The method of recovering data in the COW-based file system by using the digital forensic technology includes the steps of: searching for a super block in a meta data reconstruction module (S100); reconstructing block group information in the meta data reconstruction module (S200); searching for a file system root in a block group search module (S300); receiving a recovery scheme from a user device through a user interface in a file system structure regeneration module (S400); determining the recovery scheme in the file system structure regeneration module (S500); carving-recovering for all block groups in the carving recovering module when the recovery scheme is a carving scheme using data chunk tracking (S600); and recovering the data through a generation number comparison in a generation number recovery module when the recovery scheme is a recovery scheme through generation number tracking (S700).;COPYRIGHT KIPO 2017