The Application Of Data Recovery Technology In Electronic Evidence Identification

With the computer and the Internet as an important tool of communication and the main mode of digital life,high-tech crime or digital crime has become a new means of crime.In order to fight against the public security organs to investigate,to avoid theblow of the law,criminals tend to remove the digital or extreme means of physical destruction of hard disk,U disk and other digital storage devices.With the strengthening trend of evidence information,electronic evidence in the computer system and network system based on the prayer of the more and more important role in the process of proving the case fact,electronic evidence is its inherent attributes,characteristics of existence status of objective proof of the existence of the facts or traces of electronic information.Therefore,data recovery technology is of great significance in electronic evidence.At present,the most frequently encountered in the investigation is that the DBR sector of the digital storage device is damaged,the data is cleared or the disk is formatted and so on.So in the process of data recovery technology research,we mainly research and implement the data recovery of two formats of FAT system and NTFS system.According to the actual network investigation,this paper will in-depth analysis of files in the file system and the storage principle of the system,and two kinds of formatted recovery method and error recovery method and Realization of deleted files,deleted file implementation problems and how to correctly recover the file name and file path and file the contents of the.In view of the shortcomings of the existing data recovery tools,some suggestions are put forward in this paper.First of all,for the restoration of short file system first byte,the subject of the use of the statistical method to restore it;secondly,the slice storage files in a file system,this topic use method for recovery of recombinant sorting;finally,the related technical means this paper also studied the memory information read and read the history of network.