System and Methods for Keyword Searches in Unallocated Spaces

Abstract

There are many situations where it is desirable for law enforcement or security officials, and others, to perform a Keyword search on a confiscated memory device. Keyword searches on undeleted files are well known in the art. Often files are deleted in an effort to hinder prosecution. When a file is deleted, the information that connects one chunk of memory to another is often lost. The file is now considered to be in “unallocated space” as the operating system is not tracking the chunks that made up the file anymore. When the information that connects one chunk of memory to another is lost there is no way to perform a keyword search across multiple chunks of memory in the art. The current invention rectifies this situation by providing ways to perform keyword searches across unallocated chunks. Additional the current invention provides methods to reconstruct files that have been deleted.

Dependencies are inferred from the claim text.