基于EXT4文件系统的数据恢复方法研究  

The Research of File Recovery Method on EXT4 File System

作　　者：徐国天[1] 

机构地区：[1]中国刑警学院计算机犯罪侦查系,辽宁沈阳110854

出　　处：《信息网络安全》2011年第11期54-56,共3页Netinfo Security

摘　　要：研究EXT4文件系统中删除文件的恢复方法对计算机取证工作有重要意义。文章研究了在EXT4文件系统中通过日志中的备份信息进行数据恢复的方法。采用了实例式研究方法,分析了EXT4文件系统中extent树的构成,分析了文件被删除之后extent树的变化,研究了通过inode编号定位inode结点所在数据块的方法,研究了通过日志恢复被删除文件的方法。文章得出的结论是在日志文件和删除数据未被完全覆盖的情况下,可以通过日志有效恢复EXT4文件系统中被删除的文件。文章的研究成果可以应用在公安机关的电子数据鉴定工作中,也可用于公安院校的《电子物证检验》课程教学。The research of file recovery method on EXT4 file system was important for computer forensics.The recovery method on journal had been studied in detail.In this paper,specific examples were used to study.First,the composition of extent tree was analyzed.After the file was deleted,The change of extent tree was analyzed.According to the inode number,the method to locate the data block was studied.The way to restore deleted file had been discussed in detail.The conclusion was investigators could effectively restore deleted files on EXT4 file system by journal.The research results could be applied in computer forensics and ＂electronic evidence examination＂ courses.

关 键 词：EXT4 日志 extent树 恢复 

分 类 号：TP309.3[自动化与计算机技术—计算机系统结构]