Apparatus and method for recovering partition using backup boot record information

A method for recovering a partition using backup boot record information, comprising:

• separating an unallocated area from a disk or an evidence image;
• searching the unallocated area for a location of a backup boot record;
• analyzing whether a backup boot record of a file system desired to be detected is present in found sectors;
• if the backup boot record is found to be the backup boot record of the file system desired to be detected as a result of the analysis, verifying whether the backup boot record is a boot record of a valid partition;
• and
• if it is verified that the backup boat record is the boot record of the valid partition, parsing a file system of a deleted partition using the backup boot record, and recovering a deleted, directory or file,
• wherein searching for the location of the backup boot record is configured to search for the backup boot record depending on a type of file system based on an input sector map table,
• wherein searching for the location of the backup boot record is configured to search the unallocated area while jumping the unallocated area by a unit of a cylinder or by a unit of 2048 sectors, and analyze whether a specific sector is the backup boot record, and
• wherein searching by the unit of the cylinder and searching by the unit of 2048 sectors are simultaneously performed in a form of threads.