发明名称 Systems and methods for locating application specific data
摘要 A system and a method for locating application-specific data that has been previously deleted and located in an address of the data storage device marked as being available for storing new data. The method includes accessing unidentified data from at least one data storage device; examining the unidentified data to detect at least one application-specific data pattern associated with at least one application; for each detected application-specific data pattern, executing an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application; and if it is determined that the unidentified data includes valid data associated with the corresponding application, then recovering the valid data.
申请公布号 US9177011(B2) 申请公布日期 2015.11.03
申请号 US201213711902 申请日期 2012.12.12
申请人 Magnet Forensics Inc. 发明人 Saliba Jad John
分类号 G06F17/30;G06F7/00;G06F21/57;G06F21/64;G06F21/78;G06Q10/10;G06Q50/00;H04L29/06 主分类号 G06F17/30
代理机构 Bereskin & Parr LLP 代理人 Bereskin & Parr LLP
主权项 1. A system for locating for application-specific data comprising: (a) at least one data storage device, having unidentified data stored therein; (b) at least one processor operatively coupled to the at least one data storage device, the at least one processor configured to: provide a user-definable strictness level indicative of a tolerable amount of unacceptable charactersaccess unidentified data from at least one data storage device;examine the unidentified data to detect at least one application-specific data pattern associated with at least one application;for each detected application-specific data pattern, execute an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application, wherein the application-specific validation process comprises: determining an amount of unacceptable characters present in a portion of the unidentified data, the unacceptable characters being indicative of data that is not associated with any desired application, wherein the unacceptable characters are null characters, and wherein the amount of unacceptable characters is determined based on a percentage of null characters present in the portion of the unidentified data; anddetermining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters and the strictness level; andif it is determined that the unidentified data includes valid data associated with the corresponding application, then recover the valid data.
地址 Waterloo, Ontario CA