Forensic analysis method and system for document files

The present invention is a file reception step of receiving a file, to perform, more specifically, it relates to the forensic analysis of forensic analysis method and system of the document file; Receiving a file area determining step to determine whether the file is within the normal region or the non-assigned area exists; File search step of searching a composite document file, which exists in the normal region or the non-allocated area of ​​the file; Verification step of performing verification of the composite document file; And a data recovery method comprising: performing the recovery of the unassigned area within the data of the composite document file; includes. Forensic analysis of the document file of the present invention and the system has an effect capable of easily recover the data that was stored in the non-allocation area is not assigned the data is corrupted, the composite document file, or a compound document file.