The file system reconstruction is an effective way of recovering the forensic data from Flash memory.However

the traditional reconstruction methods need a precondition that is there are both the logical image and the physical image of flash memory at the same time and that is usually not satisfied in practice.In this paper

we propose a method for reconstructing the File Allocation Table (FAT) file system of Flash device when only a physical image of Flash memory is acquired.After introducing the statistical methods to identify the logical address bytes and the page state byte from the physical image

we propose the new algorithm to reconstruct the newest FAT file system which is based on the newest value of the page state.At last

take the special flash devices with MTK6229 controllers as examples

we expound the methods related to reconstructing the FAT file system and verify the reconstruction algorithm.