Research On The File Recovery Technology Of Damaged NTFS

With the popularization of information technology,computers have entered the household and brought great convenience to people's lives.However,while using computers,due to all causes important files might be deleted or destroyed,causing irreparable damages.When electronic media are in the condition of malfunction or internal information storage medium cannot display correctly,data recovery is a technical means to recover the information out of losing.It has become a very important supporting technology in the field of computer forensics.Based on the NTFS file system on windows platform,referring to the damage caused by file deletion and disk formatting,this paper proposed a new file recover method based on restoring $MFT.And accordingly an improved fast recovery algorithm for new version of Office based on carving technique is designed and implemented.First,the basic structure of the NTFS file system,storage principle,principle of deleting and restoring files are introduced.And the major data recovery techniques are summarized and analyzed.Then,we proposed a method based on the $MFT repair data recovery,which can achieve restoration without metafiles.In most scenarios this strategy can obviously improve the recovery efficiency.Finally,based on this method,this paper proposed an improved file recovery algorithm,for the latest Office2007 version of the document,based on file carving technology.For the characteristics of DOCX,PPTX,XLSX document structure,the algorithm locates the non-critical parts of the content directly from disk or mirror and extracted data sheet,which reorganizes sheet information for file recovery.The experiments show that this algorithm can quickly and efficiently locate damaged fragments in damaged MSOffice electronic document and restructure.And it can achieve file recovery without reducing the accuracy of the premise,with a shorten recovery time.