摘要
计算机操作系统中的文件存储基于文件目录,文件操作(如文件的增加、删除、修改、文件内容的编辑)会在存储介质上留下操作痕迹,这些痕迹可以用于在文件编辑后恢复先前的数据、恢复删除的文件、追寻文件的变迁过程、提取有关证据,对于数据恢复、案件侦查具有重要作用。
From user＇s opinion,anything on a storage media is referred to file.The storage system is based on file folders.The file operations（such as creating,deleting and editing） always leave some trails on storage media.These trails ate important for data recovery and forensic evidence,because they can be used to restore data,catch the process of changing,and collect evidence.
出处
《计算机工程与应用》
CSCD
北大核心
2007年第7期233-235,共3页
Computer Engineering and Applications
基金
江苏省公安厅项目
关键词
数据恢复
计算机取证
电子证据
痕迹
data recovery
computer forensic
electronic evidence
electronic trail
