摘要
文章介绍了在实际取证工作中,常用的文档恢复技术的现有情况,提出了一种基于编码方式的文档恢复技术,利用文档的编码方式进行搜索,对已丢失文件签名、文件结束字符等特征的文档文件进行恢复,可恢复出未被其他文件覆盖的各种文字信息,能够有效解决对文件中间的碎片恢复问题。
With the development of information technology, the capacity of media is rapidly increasing. During digital investigation, investigators need to recover all kinds of documents. Recovery of documents mainly depends on the file header and footer （file signature）. Fragmented documents without header and footer are hard to be recovered. This article describes the technology to solve this issue.
出处
《信息网络安全》
2011年第9期156-158,共3页
Netinfo Security
关键词
编码
文档碎片
数据挖掘
文档恢复
coding
fragmented document
file carving
document recovery
