In order to solve data recovery problems in computer forensics,this paper proposes a new algorithm based on NTFS.

• 为解决计算机取证的数据恢复问题；提出了一种基于新技术文件系统(New technology file system；NTFS)的数据恢复算法.