1. An apparatus for digital forensics, comprising: a page file extractor for extracting a page file stored in a target storage medium; a stored-page feature extractor for extracting features of pages stored in the extracted page file; a page classifier for comparing the extracted features of the pages with at least one predetermined classification criterion, and classifying the pages according to the comparison results; and a digital forensics unit for performing digital forensics according to the classified pages, wherein the features of the pages correspond to binary data distribution characteristics according to memory addresses in the pages.