Patent Document ID: 9465694
Application ID: 14547248

Base Claim:
1. A method for recovering a partition based on file system metadata, comprising: determining, by an unallocated area determination unit, an unallocated area in a disk or an evidence image; collecting, by a Master File Table (MFT) entry collection unit, MFT entries from the unallocated area; generating, by an MFT entry analysis unit, MFT partition candidate information by analyzing the MFT entries; and creating, by an MFT partition creation unit, information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries, wherein creating the tree structure comprises: reading the MFT partition candidate information and then accessing a corresponding sector; analyzing MFT entries of the corresponding sector and calculating a location of a boot record; if the location of the boot record has been calculated, calculating a total size of a volume using an MFT entry corresponding to a metadata file; determining whether the calculated volume size satisfies a preset minimum size; parsing the collected MFT entries if it is determined that the calculated volume size satisfies the preset minimum size; and restoring parsed results to a tree structure.

---

Claim 4:
4. The method of claim 1 , wherein calculating the location of the boot record comprises: analyzing MFT entry #0 of $MFT; accessing $DATA attributes of the MFT entry #0; calculating a file size of $MFT from a non-resident attribute header of the $DATA attributes by using a real attribute size item; analyzing a Cluster Run List from the non-resident attribute header of the $DATA attributes and obtaining a location value of a starting cluster of the $MFT and a total size value of clusters; and calculating a location of the boot record using the location value of the starting cluster of the $MFT and the total size value of the clusters.