Deleted data restoration method and device of BTRFS file system

The invention belongs to the technical field of information security and computer application and particularly relates to a deleted data restoration method and device of a BTRFS file system. The method includes the following steps that S1, super block content of a disk partition is acquired, through magic number information in super blocks, whether the partition is a BTRFS file system partition or not is judged, if yes, the step 2 is executed, or else it is over; S2, through a file tree pointer in the super block information, a normal file tree is analyzed; S3, a region whether metadata is stored is acquired through a tree pointer of a main data storage region in the super bloc information; S4, the metadata region is searched for a root node of the file tree, and the file tree root node is stored; S5, the file tree root node is analyzed, a file tree of the root node is read and compared with the normal file tree, and redundant file information is mounted in the normal file tree; S6, whether non-analyzed file