IEEE - Institute of Electrical and Electronics Engineers, Inc. - Computer Forensics Research and Implementation Based on NTFS File System

2008 ISECS International Colloquium on Computing, Communication, Control, and Management (CCCM)

Author(s): Liu Naiqi ; Wang Zhongshan ; Hao Yujie ; QinKe
Publisher: IEEE - Institute of Electrical and Electronics Engineers, Inc.
Publication Date: 1 August 2008
Conference Location: Guangzhou, China
Conference Date: 3 August 2008
Volume: 1
Page(s): 519 - 523
ISBN (Paper): 978-0-7695-3290-5
DOI: 10.1109/CCCM.2008.236
Regular:

Based on NTFS file system, this paper proposed an algorithm of reconstructing directory tree above deleted files. Further more, by analyzing the internal structure of the NTFS file system in... View More

Advertisement