10. An apparatus for recovering a partition based on file system metadata, comprising: an unallocated area determination unit for determining an unallocated area in a disk or an evidence image; a Master File Table (MFT) entry collection unit for collecting MFT entries from the unallocated area; an MFT entry analysis unit for generating MFT partition candidate information by analyzing the MFT entries; and an MFT partition creation unit for creating information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries, wherein the MFT partition creation unit is configured to analyze MFT entries of a corresponding sector by reading the MFT partition candidate information, calculate a location of a boot record, and calculate a total size of a volume using an MFT entry corresponding to a metadata file, and is configured to, if the calculated volume size satisfies a preset minimum size, parse the collected MFT entries and restore parsed results to a tree structure.
10. An apparatus for recovering a partition based on file system metadata, comprising: an unallocated area determination unit for determining an unallocated area in a disk or an evidence image; a Master File Table (MFT) entry collection unit for collecting MFT entries from the unallocated area; an MFT entry analysis unit for generating MFT partition candidate information by analyzing the MFT entries; and an MFT partition creation unit for creating information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries, wherein the MFT partition creation unit is configured to analyze MFT entries of a corresponding sector by reading the MFT partition candidate information, calculate a location of a boot record, and calculate a total size of a volume using an MFT entry corresponding to a metadata file, and is configured to, if the calculated volume size satisfies a preset minimum size, parse the collected MFT entries and restore parsed results to a tree structure. 11. The apparatus of claim 10 , wherein the MFT entry collection unit is configured to determine the MFT entries based on a signature of an $MFT file while reading the unallocated area on a sector basis, and collect the MFT entries while jumping by a size of MFT entries if the MFT entries are detected.