1. A method for recovering a partition based on file system metadata, comprising: determining, by an unallocated area determination unit, an unallocated area in a disk or an evidence image; collecting, by a Master File Table (MFT) entry collection unit, MFT entries from the unallocated area; generating, by an MFT entry analysis unit, MFT partition candidate information by analyzing the MFT entries; and creating, by an MFT partition creation unit, information enabling a layout of a partition to be reconfigured based on the MFT partition candidate information, and creating a tree structure using the created information and the MFT entries.