Abstract:During data recovery, it would cost a lot of time to scan from begin to end, and most of the recovered data would be not required. Restoring the particular data files can be useful to save time and improve efficiency. Paper begins with presenting the principle of file reading and writing, and analyzes the OS' actions when the file is modified or deleted, as well as the changes of the File Associate Table (FAT) and File Directory Table (FDT). Aiming at the problem that the current data recovery method is not in effect for the lost files without continuous clusters, we can do the job for the particular file according to its clusters' distribution characteristics, and paper tests it in some experiment.