Systems and methods for locating application specific data
AssigneeMagnet Forensics Inc.
InventorJad John Saliba
Life of this patent
Estimating the term…
Abstract
A system and a method for locating application-specific data that has been previously deleted and located in an address of the data storage device marked as being available for storing new data. The method includes accessing unidentified data from at least one data storage device; examining the unidentified data to detect at least one application-specific data pattern associated with at least one application; for each detected application-specific data pattern, executing an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application; and if it is determined that the unidentified data includes valid data associated with the corresponding application, then recovering the valid data.
Claims16
A system for locating for application-specific data comprising:
- (a) at least one data storage device, having unidentified data stored therein;
- (b) at least one processor operatively coupled to the at least one data storage device, the at least one processor configured to:
- provide a user-definable strictness level indicative of a tolerable amount of unacceptable characters
- access unidentified data from at least one data storage device;
- examine the unidentified data to detect at least one application-specific data pattern associated with at least one application;
- for each detected application-specific data pattern, execute an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application, wherein the application-specific validation process comprises:
- determining an amount of unacceptable characters present in a portion of the unidentified data, the unacceptable characters being indicative of data that is not associated with any desired application, wherein the unacceptable characters are null characters, and wherein the amount of unacceptable characters is determined based on a percentage of null characters present in the portion of the unidentified data;
- and
- determining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters and the strictness level;
- and
- if it is determined that the unidentified data includes valid data associated with the corresponding application, then recover the valid data.
A computer-implemented method for locating application-specific data, the method comprising:
- providing a user-definable strictness level indicative of a tolerable amount of unacceptable characters;
- accessing unidentified data from at least one data storage device;
- examining the unidentified data to detect at least one application-specific data pattern associated with at least one application;
- for each detected application-specific data pattern, executing an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application, wherein the application-specific validation process comprises:
- determining an amount of unacceptable characters present in a portion of the unidentified data, the unacceptable characters being indicative of data that is not associated with any desired application, wherein the unacceptable characters are null characters, and wherein the amount of unacceptable characters is determined based on a percentage of null characters present in the portion of the unidentified data;
- and
- determining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters and the strictness level;
- and
- if it is determined that the unidentified data includes valid data associated with the corresponding application, then recovering the valid data.
Dependencies are inferred from the claim text.