摘要
分析了NTFS文件系统的物理结构和逻辑框架,提出了计算机取证软件的开发需要先解决元数据的读取和碎片文件的恢复等问题,并编程实现了信息收集模块,为计算机取证软件的设计提供了一种方案。
Through analysising the physical structure and logical framework of NTFS file system,servral problems which are reading the metadata and the recovery of fragmented files have been proposed for the development of computer forensic software.The implementation of information collection module has provided a solving way for the development of computer forensic software.
出处
《电脑编程技巧与维护》
2011年第4期98-100,共3页
Computer Programming Skills & Maintenance
