	US 12,259,872 B2
	Computer system and method for evaluating integrity and parsing of a file system and parsing implementation
Jad John Saliba, Waterloo (CA); and James David Schroering, Jr., Arvada, CO (US)
Assigned to Magnet Forensics Inc., Waterloo (CA)
Filed by Magnet Forensics Inc., Waterloo (CA)
Filed on Sep. 21, 2023, as Appl. No. 18/471,902.
Claims priority of provisional application 63/410,472, filed on Sep. 27, 2022.
Prior Publication US 2024/0104085 A1, Mar. 28, 2024
Int. Cl. G06F 16/23 (2019.01); G06F 16/13 (2019.01)

CPC G06F 16/2365 (2019.01) [G06F 16/13 (2019.01)]

19 Claims

1. A system for evaluating integrity and parsing of a file system and parsing implementation, the file system comprising file system objects, each file system object comprising at least one block, each block uniquely associated with a block identifier, the system comprising:

a processor for evaluating the integrity and the parsing of the file system;

a memory communicatively connected to the processor and storing computer- executable instructions that, when executed by the processor, cause the system to:

read an allocation tracker indicating allocation of each block identifier;

create an allocated blocks collection of each block identifier within the allocation tracker that is indicated to be currently allocated, the allocated blocks collection including an allocated blocks array;

create a reference anomaly blocks collection, the reference anomaly blocks collection including a reference anomaly blocks array;

initialize each entry of the allocated blocks array to 0;

initialize each entry of the reference anomaly blocks array to 0;

create a reference differences collection, the reference differences collection including a reference differences array;

for each file system object, for each block referenced by the file system object, determine that the associated block identifier is present in the allocated blocks collection or determine that the associated block identifier is not present in the allocated blocks collection;

where the file system uses the associated block identifier to reference the block, assign a value of 1 to the corresponding entry in the allocated blocks collection;

where the file system does not use the associated block identifier to reference the block, do not assign a value of 1 to the corresponding entry in the allocated blocks collection;

for each file system object, for each block referenced by the file system object, increment the value of the corresponding entry in the reference anomaly blocks array by 1;

for each entry in the reference differences array, assign a value equal to the value of the corresponding entry in the allocated blocks array minus the corresponding entry in the reference anomaly blocks array;

determine that each entry in the reference differences array is equal to 0, or determine that at least one entry in the reference differences array is less than 0;

where each entry in the reference differences array is equal to 0, indicate a successful evaluation; and

where at least one entry in the reference differences array is less than 0, determine that the corresponding entry in the allocated blocks array is equal to 0 or determine that the corresponding entry is equal to 1;

where the corresponding entry is equal to 0, indicate an unsuccessful evaluation because the block associated with the corresponding entry is under-allocated;

where the corresponding entry is equal to 1, indicate an unsuccessful evaluation because the block associated with the corresponding entry is over-allocated.