| FAT系统文件操作痕迹特征分析 |
| |
| 引用本文： | 黄步根. FAT系统文件操作痕迹特征分析[J]. 计算机工程与应用, 2007, 43(7): 233-235 |
| |
| 作者姓名： | 黄步根 |
| |
| 作者单位： | 江苏警官学院,公安科技系,南京,210012 |
| |
| 摘 要： | 计算机操作系统中的文件存储基于文件目录，文件操作（如文件的增加、删除、修改、文件内容的编辑）会在存储介质上留下操作痕迹．这些痕迹可以用于在文件编辑后恢复先前的数据、恢复删除的文件、追寻文件的变迁过程、提取有关证据，对于数据恢复、案件侦查具有重要作用。
|
| 关 键 词： | 数据恢复 计算机取证 电子证据 痕迹 |
| 文章编号： | 1002-8331（2007）07-0233-03 |
| 修稿时间： | 2006-07-01 |
Analysing electronic trail on storage media by file operating for FAT file system |
| |
| HUANG Bu-gen. Analysing electronic trail on storage media by file operating for FAT file system[J]. Computer Engineering and Applications, 2007, 43(7): 233-235 |
| |
| Authors: | HUANG Bu-gen |
| |
| Affiliation: | Department of Forensic Science,Jiangsu Police Institute,Nanjing 210012,China |
| |
| Abstract: | From user's opinion,anything on a storage media is referred to file.The storage system is based on file folders.The file operations(such as creating,deleting and editing) always leave some trails on storage media.These trails are important for data recovery and forensic evidence,because they can be used to restore data,catch the process of changing,and collect evidence. |
| |
| Keywords: | data recovery computer forensic electronic evidence electronic trail |
| 本文献已被 CNKI 维普 万方数据 等数据库收录！ |
|
