LRK Patent Law Firm
Method and apparatus for recovering partition based on file system metadata
A method and apparatus for recovering a partition based on file system metadata, which calculate core information necessary for the recovery of a partition using only the MFT entry information of $MFT and recover a deleted partition when an MBR and a GPT that correspond to the partition configuration information of a disk and a BR and a BBR that store the configuration information of a volume are deleted or destroyed. The method includes determining an unallocated area in a disk or an evidence image, collecting MFT entries from the unallocated area, generating MFT partition candidate information by analyzing the MFT entries, and creating information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries.
ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE
G G G G G G G
G06F G06F G06F G06F G06F G06F G06F
additional additional inventional inventional inventional inventional inventional
Kibom Hyunuk Seungyong
Kim Hwang Lee