被入侵或遭受攻击后的计算机系统，其磁盘数据往往会遭到篡改、删除等恶意修改，而这些数据通常是非常宝贵的，因此数据恢复技术尤为重要。现有的数据恢复技术在很多方面存在不足，这是因为主流文件系统其设计本身并不利于数据恢复。针对上述问题，发现日志式文件系统设计有利于实施高效的数据恢复算法，从理论上分析了它有利于进行数据恢复的原因，设计了基于日志式文件系统的数据恢复算法模型，并在开发的日志式文件系统模拟器和真实环境中分别进行了算法测试。实验表明，日志式文件系统可以容易地实现恢复迅速、对系统性能影响轻微、无需额外存储机制的数据恢复算法。

Data content stored in computer systems are more crucial than ever before. Compromised computer systems always suffer from data contaminations in both system and user files, therefore intrusion recovery methods are indispensable today. Existing intrusion recovery methods have shortcomings in certain aspects because, in our observation, the file systems on which these methods work are not inherently apt to realize recovery. In contrast, Log-Structured File System (LFS) is ideal to perform various intrusion recovery algorithms. We explain our claims theoretically, propose data recovery algorithm, validate it in SimuLFS, the LFS simulator we built, and test it in real LFS environment in FreeBSD. Experiment results indicate that even very simple recovery algorithm can achieve fast file recovery from almost any state of the disk, with little throughput degradation, guarantee accuracy, require no extra storage requirements and minimal changes to any original LFS code.