基于Thumbs.db文件的数据恢复技术研究与开发

The study and development of the data recovery based on Thumbs.db

应用软件层的数据恢复,是对某些特殊的文件做分析,解读文件内蕴含的重要信息,恢复出被犯罪嫌疑人删除的作案痕迹、证据等。针对应用软件层的数据恢复研究,以研究Thumbs.db文件格式为例,研究出了怎样在应用软件层,恢复已删除图片的缩略图。并开发出Thumbs.db文件分析软件,通过分析隐藏的系统文件Thumbs.db,可以浏览并保存该文件中记录的包括已删除图片在内的所有图片的缩略图信息。

The data recovery on the application software level refers to the analysis and interpretation of special files so as to recover the criminal deleted or destroyed traces and evidence. For the study of data recovery on the application software level, taking the analysis of Thumb.db file as an example, proposed a method of how to extract the thumbnails of deleted picture files on the application software level. And the analyzing tools, which could save the information of thumbnails, have been developed.