摘要
本文首先介绍HFS+磁盘的文件系统结构,然后介绍了HFS+文件系统存储和删除数据时的工作流程;在此基础上针对HFS+文件系统存储文件时的特点,对在其环境下恢复文件的可能性进行了探讨,通过对进入废纸篓文件的恢复、完全删除的文件的恢复以及对磁盘的关键字搜索和虚拟内存的搜索这三方面初步证明了在HFS+的系统中对文件进行数据恢复是可行的。
In this paper, the construction of HFS＋ is introduced firstly, and the workflow of HFS＋ to store and delete data is presented; based on the characteristics of HFS＋ to store data, an investigation of data recovery is discussed. Finally it＇ s proved that the data recovery in HFS＋ is possible according to research of the recovery of files in trashes or completely deleted and the research of keywords search in disks and virtual memories.
关键词
数据恢复
分层文件系统
电子物证
data recovery
hierarchical file system
computer forensics
