US 11,940,982 B2
Systems and methods for locating application specific data
Jad John Saliba, Puslinch (CA)
Assigned to Magnet Forensics Investco Inc., Waterloo (CA)
Filed by Magnet Forensics Investco Inc., Waterloo (CA)
Filed on Mar. 19, 2021, as Appl. No. 17/206,178.
Application 17/206,178 is a continuation of application No. 14/928,013, filed on Oct. 30, 2015, granted, now 11,036,714.
Application 14/928,013 is a continuation of application No. 13/711,902, filed on Dec. 12, 2012, granted, now 9,177,011, issued on Nov. 3, 2015.
Claims priority of provisional application 61/579,325, filed on Dec. 22, 2011.
Prior Publication US 2021/0311927 A1, Oct. 7, 2021
Int. Cl. G06F 16/00 (2019.01); G06F 7/00 (2006.01); G06F 16/23 (2019.01); G06F 16/245 (2019.01); G06F 16/9535 (2019.01); G06F 21/57 (2013.01); G06F 21/64 (2013.01); G06F 21/78 (2013.01); G06Q 10/10 (2023.01); G06Q 50/00 (2012.01); H04L 9/40 (2022.01)
CPC G06F 16/2365 (2019.01) [G06F 16/245 (2019.01); G06F 16/9535 (2019.01); G06F 21/57 (2013.01); G06F 21/64 (2013.01); G06F 21/78 (2013.01); G06Q 10/10 (2013.01); G06Q 50/01 (2013.01); H04L 63/308 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method of searching for application-specific data from among unidentified data stored on at least one data storage device, the method comprising executing via a computing device comprising at least one processor:
generating and displaying a first user interface (UI) including a plurality of selectable search types, wherein each of the plurality of search types conducts a search at a subset of sectors or data storage addresses of the at least one data storage device, the subset of sectors or data storage addresses associated with the selectable search type, the association being defined without input from a user;
receiving a selection of at least one search type from the plurality of selectable search types via the first UI;
generating and displaying a second UI including a plurality of selectable applications, wherein receiving a selection of at least one application causes the at least one processor to execute a search for application-specific data of the at least one selected application according to the at least one selected search type;
receiving a selection of the at least one application via the second UI;
executing the search, comprising:
for each of the at least one selected search type, searching the unidentified data of the at least one data storage device at the subset of sectors or data storage addresses associated with the selected search type to locate the application-specific data associated with the at least one selected application, wherein the searching comprises:
examining the unidentified data at the associated subset of sectors or data storage addresses to detect at least one application-specific data pattern indicative of the at least one selected application; and
for each application-specific data pattern detected in the unidentified data, executing an application validation process on a subset of the unidentified data for the at least one selected application to determine that the subset of the unidentified data comprises valid data associated with the at least one selected application, executing the application validation process further comprising checking data surrounding the subset of the unidentified data to determine that the subset of the unidentified data is not associated with another application; and
generating a report indicative of the application-specific data;
wherein at least determining that the subset of unidentified data comprises valid data associated with the at least one selected application and determining that the subset of the unidentified data is not associated with another application are executed in parallel.