Entropy-Based Data Block Filtering for Forensic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Forensic investigations are inefficient due to the need to process all sectors and blocks of data from storage devices, including those that do not contain useful data, which can include patterns or empty blocks, leading to unnecessary analysis and reduced processing speed.
Innovation Solution
A method and system that identify and assign entropy values to data blocks based on their randomness, allowing only blocks within a user-defined meaningful range to be processed, thereby skipping non-meaningful blocks such as those with patterns or empty data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all sectors and blocks of the data storage device are processed during forensic investigation, then complete data coverage is achieved, but processing time and computational resources are unnecessarily consumed
Solution Approach 1:
The system performs preliminary analysis of data blocks before full forensic processing by calculating entropy values and identifying blocks with meaningful data patterns. This preliminary filtering action eliminates obviously useless blocks (empty blocks, pattern blocks) before they enter the main processing pipeline, thereby reducing overall processing time while maintaining complete coverage of potentially useful data
Solution Approach 2:
The forensic investigation process is segmented into multiple stages: initial entropy-based filtering, meaningful block identification, and detailed analysis only of identified blocks. This segmentation allows the system to apply different processing strategies to different portions of data, processing only relevant blocks in detail while quickly skipping irrelevant ones
2Reliability
If all blocks are analyzed in detail, then no meaningful data is missed, but the analysis speed and efficiency are reduced
Solution Approach 1:
The system applies different quality levels of analysis to different blocks based on their characteristics. Blocks identified as having meaningful data receive thorough detailed analysis, while blocks identified as empty or containing simple patterns receive minimal or no analysis. This local differentiation of analysis quality maintains reliability for important data while dramatically improving overall analysis speed
3Measurement precision
If non-meaningful blocks (patterns, empty blocks) are processed, then complete data review is ensured, but unnecessary computational resources are consumed
Solution Approach 1:
Before consuming significant computational resources on full block analysis, the system performs preliminary entropy calculation and pattern recognition to identify and filter out blocks that are guaranteed to be meaningless (empty blocks, blocks with simple repeating patterns). This preliminary action prevents wasteful consumption of computational resources on obviously useless data while ensuring that all potentially meaningful blocks are preserved for detailed analysis
Data Source
AI summary
A system and method for processing data stored in data storage devices is described. A computing processor acquires blocks of data from a target machine and computes an entropy value associated with each block of the acquired data. The computing processor checks the entropy values of each block to determine whether or not the particular block is deemed to contain useful data, before that block is analyzed.