文件恢复是一种从被损坏或删除的文件中恢复有价值数据的方法,在保障信息安全、数据取证方面有很重要的应用价值。当重要数据丢失或损毁时,也可以挽救部分数据,使损失降到最低。FAT32是微软公司开发的著名文件系统,已经被广泛用于桌面计算机系统中。本文提出一种FAT32文件系统中的文件数据恢复方法,通过文件系统提供的特征信息进行关联比对,以恢复普通格式化和高级格式化所删除的文件。
File recovery is a method to recover valuable data from broken or deleted files. It has important application value on informa- tion security and data forensics. When important data is lost or damaged, file recovery can rescue partial data, which makes the loss to a minimum. FAT32 is a famous Microsoft developed file system and has been widely used in desktop computers. This paper presents a method for FAT32 file system to recover data. This method is able to recover files deleted by both ordinary format and advanced format using characteristic information provided by file system.