The invention discloses a method for storing and quickly indexing restored files in a large-flow environment. According to the technical scheme, the method comprises the steps: a storage process of file content frame data is extracted based on a network flow capture module; a special storage structure and format are set in the storage process; the storage process of the file content frame data comprises the following steps: presetting a memory space for storing all files, presetting a main table structure, dynamically binding a main table with a sub-table index, dynamically binding a sub-tablewith a file ID and a file content frame data index, wherein the file content frame data index is a head address when the preset memory space stores frame data; and setting a special storage structureand format in the storage process, wherein the special storage structure and format comprise a main table type design, a sub-table type design and a memory space format design. According to the invention, the problems of large memory consumption and fragmentation when a traditional APT detection product restores a file in a high-flow environment are solved.