37 results about "Computer forensics" patented technology

Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Forensic signatures are created including a digital fingerprint and other information associated with a file. In one aspect, informational signatures are created, which may assist in determining what information is included in a file. In another aspect, the digital fingerprint may represent contents of the file and is resistant to minor modification of the file. In another aspect, fingerprints can be compared in parallel on different computers.

The invention provides an SQLite data recovery method applicable to merging of non-integral primary keys and free blocks and relates to the field of computer forensics. The method includes the steps of 1), starting from a root page and a file header to search all the free blocks and free pages; 2), analyzing difference of cell layout of integral primary keys and the non-integral primary keys as well as difference of meanings of bytes, temporarily assuming each free block contains one cell, calculating information of types covered, analyzing the type information and a data field and performing data recovery; 3), for the free blocks cannot pass the step 2), believing that each of the free blocks contains multiple cell, pre-estimating length of the cells stored in the free blocks is from 4 to free block length on the basis of splitting and verifying, and judging pre-estimated values with a single free block extraction module; 4), in response to decreasing of the free blocks due to B+tree reorganization, extracting the data from the free pages collected in the step 1). With the method, the data deleted can be easily recovered from SQLite3 database files, and the data is provided for follow-up electronic forensics work.

The invention discloses a method for extracting a text data file from a physical memory image. The method comprises the following steps of: searching an eprocess structure of a notepad.exe progress by utilizing characteristic values of the eprocess structure and offset between the characteristic values, and acquiring a page directory base address of the progress; and acquiring text data description information and labeling information in memory, and accurately acquiring the text data in the notepad.exe progress through the principle of converting the address of an operating system. The method can be used for data recovery, data extraction, computer forensic and the like.