System and method for generating a minimal forensic image of a dataset of interest

A system for generating a minimal forensic image (MFI) of a target dataset of a target device to reduce upload demand, the system comprising:

• a cloud server to store the minimal forensic image;
• a target device including a memory storing a target dataset;
• an investigator device including a processor communicatively coupled to a memory, the investigator device configured to:
• store a set of criteria for determining which target data files of the target dataset will be included in the minimal forensic image, wherein the set of criteria includes a plurality of file types and at least a first upload format for each file type in the plurality of file types;
• locate target data files of the plurality of file types in the target dataset using the set of criteria;
• transfer the target data files to the cloud server;
• wherein transferring the target data files includes:
• storing a representation of each target data file in the minimal forensic image in an upload format determined according to the set of criteria;
• uploading the minimal forensic image to the cloud server.

A method of prioritized uploading of forensically relevant data from a target dataset stored on a target device, the method comprising:

• generating a minimal forensic image of the target dataset using an investigator device;
• generating a complete forensic image of the target dataset using the investigator device;
• initiating an upload of the minimal forensic image and an upload of the complete forensic image from the investigator device to a cloud server;
• and
• prioritizing the upload of the minimal forensic image over the upload of the complete forensic image.