File System Integrity Evaluation via Allocation Tracker
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional file system parsing methods often lead to errors, making it difficult to verify the integrity of the parsing process, especially in digital forensics, where incorrect parsing can result in missing files or unsearched memory areas, and these errors are hard to detect due to the vast permutations of user-provided data.
Innovation Solution
A system and method that evaluates the integrity of a file system by using an allocation tracker to create collections of allocated and anomaly blocks, comparing block identifiers, and performing searches to identify under- or over-allocation, providing real-time indications of corruption and allowing for post-processing to correct issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional parsing methods are used to parse a file system, then the parsing process is simple and fast, but errors occur during parsing causing allocated files and directories to be missing or not analyzed
Solution Approach 1:
The patent applies preliminary action by creating an allocation tracker before parsing begins, which pre-records all block allocations. During parsing, the system continuously compares actual block references against this pre-established tracker, enabling real-time error detection without adding significant complexity to the parsing workflow.
Solution Approach 2:
The patent implements feedback mechanisms through anomaly collections that continuously monitor and record discrepancies between expected and actual block allocations. This feedback loop allows the system to detect and report parsing errors in real-time, improving reliability while maintaining manageable system complexity through structured error tracking.
2Measurement precision
If secondary or tertiary tools are used to parse and compare results, then parsing verification is improved, but the process becomes more complex and time-consuming
Solution Approach 1:
The patent merges the verification function directly into the primary parsing system by integrating allocation tracking and anomaly detection within the same parsing process. This eliminates the need for separate secondary or tertiary verification tools, achieving high measurement precision while reducing the time loss associated with multiple sequential parsing passes.
Solution Approach 2:
The parsing system is designed with multi-functionality, simultaneously performing data extraction, integrity verification, and anomaly detection in a single pass. This universal approach consolidates multiple functions into one unified process, improving verification accuracy without requiring additional time-consuming separate tools.
3Reliability
If extensive testing is performed during development, then parsing errors are reduced, but it is not possible to test every possible permutation of user-provided data
Solution Approach 1:
The patent applies preliminary action by establishing a comprehensive allocation tracker before parsing begins, which pre-defines all expected block allocations. This preliminary structure enables the system to handle any permutation of user-provided data systematically, improving parsing robustness without requiring exhaustive testing of all possible data variations.
Solution Approach 2:
The system performs self-service through automatic anomaly detection and error reporting mechanisms that continuously monitor parsing operations. The allocation tracker and anomaly collections automatically identify discrepancies without requiring external testing interventions, enhancing reliability while avoiding the complexity of extensive manual testing protocols.
Data Source
AI summary
Provided are a system and method for evaluating integrity of a parsed file system. The system includes a processor and a memory communicatively connected to the processor and storing computer-executable instructions that cause the system to read an allocation tracker, create an allocated blocks collection of each block identifier within the allocation tracker indicated to be currently allocated, create an initially empty reference anomaly blocks collection, for each block of each file system object referenced by the file system object, determine that the associated block identifier is present in the allocated blocks collection or not, respectively remove the block identifier from the allocated blocks collection or add the block identifier to the reference anomaly blocks collection, determine that the allocated blocks collection and the reference anomaly blocks collection are empty or not empty and respectively indicate a successful evaluation or an unsuccessful evaluation.