Downloads: 137 | Views: 313
M.Tech / M.E / PhD Thesis | Computer Science & Engineering | India | Volume 5 Issue 5, May 2016 | Popularity: 6.6 / 10
Recovering Deleted Files from NTFS
Rincy Roy Oommen, Princy Sugathan
Abstract: Recovering lost and deleted information is one of the main part in Digital Forensics. Data recovery is a process which finds and recover data, in which there may be some risks happens, for no all situations can be defined or arranged previously. Data recovery also retrieves lost, deleted, unusable or inaccessible data that lost for various reasons. In computer forensics, the main source of evidence is the data which is stored in the file. The file system is used to manage all files present on the disk. A suspect can remove evidence by deleting evidence containing files. So, it is important for forensic investigator to get back the deleted evidences. This paper described the structure of the NTFS file system and proposed a method to recover deleted files from the system by analysing the MFT entry and also detects the directory from which the file was deleted.
Keywords: Forensics, Data Recovery, File System, NTFS, MFT Entry
Edition: Volume 5 Issue 5, May 2016
Pages: 205 - 208
DOI: https://www.doi.org/10.21275/NOV163235
Please Disable the Pop-Up Blocker of Web Browser
Verification Code will appear in 2 Seconds ... Wait