Abstract: From user’s opinion, anything on a storage media is referred to file. The storage system are based on file folders. The file operating (such as creating, deleting, and editing) are always left some trails on storage media. These trails are important for data recovery and forensic evidence, because they can be used to restore data, catch the process of changing, and collect evidence.

摘要： 计算机操作系统中的文件存储基于文件目录，文件操作（如文件的增加、删除、修改、文件内容的编辑）会在存储介质上留下操作痕迹，这些痕迹可以用于在文件编辑后恢复先前的数据、恢复删除的文件、追寻文件的变迁过程、提取有关证据，对于数据恢复、案件侦查具有重要作用。