CAJ | 학술논문

在NTFS文件系统中,视频监控文件在形成过程中被分割成大量非常小的块进行存储,通过多个索引表形成整个文件,删除该文件后,主索引表被丢弃,但扩展属性中的索引表还存在.针对该问题,提出根据文件的扩展属性恢复数据的方法,通过整合大量分散存储的碎片,能够恢复被删除的视频文件的大部分内容.
재NTFS문건계통중,시빈감공문건재형성과정중피분할성대량비상소적괴진행존저,통과다개색인표형성정개문건,산제해문건후,주색인표피주기,단확전속성중적색인표환존재.침대해문제,제출근거문건적확전속성회복수거적방법,통과정합대량분산존저적쇄편,능구회복피산제적시빈문건적대부분내용.
In the NTFS file system, video monitor file is divided into a large number of very small block for storage, the entire file is formed by the index tables, the main index table is missing when the file is deleted, but other index tables exist in the extended attributes. This paper proposes a method for recovering dam by the extended property according to file. This method can effectively combine many scattered fragments together and recover most of video monitor data which has already been deleted.