DATA RECOVERING METHOD FOR NEW TECHNOLOGY FILE SYSTEM

摘要

PURPOSE: A method for recovering data on a computer installing a Windows OS(Operating System) is provided to correctly recover data to an original position by executing the data recovery in a folder unit after collecting the folder information by reading a data region of an HDD(Hard Disk Drive) in a sector unit, and recovering a folder in a tree structure by confirming a relation of each folder. CONSTITUTION: An MFT(Master File Table) entry is confirmed by sequentially reading a whole sector of the HDD, and is temporarily stored in a virtual array(S10-S12). The MFT entry is classified into the folder information and the file information(S15). If an attribute value of the MFT entry is Ox20 or Ox90, an MFT number is generated by reading a parent MFT number from the child MTF information(S19). If the attribute value of the MFT entry is OxA0, the MFT number is read and stored by reading an index root cluster and reading the MFT number from an index entry of an index root. If the attribute value of the MFT entry is Ox05, the MFT entry is added to a root set. If the MFT number does not exist in the stored MFT entry, the MFT entry is added to the root set as the parent MFT number.