The large scale and distribution of cloud computing storage have become the major challenges in cloud forensics for file extraction. Current disk forensic methods do not adapt to cloud computing well and the forensic research on distributed file system is inadequate. To address the forensic problems,this paper uses the Hadoop distributed file system(HDFS)as a case study and proposes a forensic method for efficient file extraction based on three-level(3L)mapping. First,HDFS is analyzed from overall architecture to local file system. Second,the 3L mapping of an HDFS file from HDFS namespace to data blocks on local file system is established and a recovery method for deleted files based on 3L mapping is presented. Third,a multi-node Hadoop framework via Xen virtualization platform is set up to test the performance of the method. The results indicate that the proposed method could succeed in efficient location of large files stored across data nodes,make selective image of disk data and get high recovery rate of deleted files. The large scale and distribution of cloud computing storage have become the major challenges in cloud forensics for file extraction. Current disk forensic methods do not adapt to cloud computing well and the forensic research on distributed file system is inadequate. To address the forensic problems, this First, HDFS is analyzed from an overall architecture to local file system. Second, the 3L mapping of an HDFS file from HDFS namespace to data blocks on local file system is established and a recovery method for deleted files based on 3L mapping is presented. Third, a multi-node Hadoop framework via Xen virtualization platform is set up to test the performance of the method. The results said that the proposed method could succeed in efficient location of large files stored across data nodes, make selective image of disk data and ge t high recovery rate of deleted files.