Minimal Forensic Image Generation via Selective File Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital forensic methods are inefficient in transferring large datasets from devices of interest to investigator devices, leading to delayed forensic investigations due to insufficient upload speeds, especially in time-sensitive cases like missing persons or public safety threats.
Innovation Solution
The method generates a minimal forensic image by selecting specific file types and formats for upload, using criteria such as file types, upload formats, and threshold sizes to reduce the dataset size, allowing for quicker transfer of prioritized data to a cloud server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files from the target dataset are transferred to initiate forensic investigation, then complete forensic analysis can be performed, but upload time becomes excessively long due to insufficient upload speeds
Solution Approach 1:
The patent extracts only the most forensically relevant files from the complete target dataset based on pre-configured criteria (file types, time ranges, file sizes). This selective extraction creates a minimal forensic image that contains sufficient data to initiate investigations without requiring transfer of the entire terabyte-scale dataset, thus resolving the contradiction between data completeness and upload time.
Solution Approach 2:
The patent segments the forensic data transfer process into two phases: first transferring a minimal forensic image with prioritized files to enable immediate investigation initiation, then optionally transferring remaining files later. This segmentation allows investigators to start work with critical data while avoiding the bottleneck of transferring all files upfront.
2Loss of time
If compression algorithms are applied to reduce dataset size, then upload time decreases, but compression processing time and computational resources increase
Solution Approach 1:
The patent performs file selection and filtering actions before the upload process begins. By pre-configuring criteria and identifying target files in advance, the system avoids the need for complex real-time compression during upload, instead using simple filtering and selective copying operations that are computationally less intensive.
3Productivity
If only essential files are selected for transfer to reduce upload time, then upload speed improves, but completeness of forensic data may be compromised
Solution Approach 1:
The patent applies different selection criteria to different file types and locations within the dataset. File type criteria, time range criteria, and file size criteria are configured to identify locally relevant files that are most likely to contain forensic evidence. This local quality approach ensures that the minimal forensic image contains appropriately targeted data for the specific investigation context.
4Reliability
If the entire target dataset is stored and transferred, then all possible evidence is available for analysis, but storage requirements and transfer bandwidth consumption increase significantly
Solution Approach 1:
The patent extracts a representative subset of files that contain the most likely forensic evidence based on configured criteria. This extraction creates a minimal forensic image that reduces data volume from terabytes to a manageable size while maintaining the availability of critical evidence needed to initiate investigations.
Data Source
AI summary
What is provided is a method of generating a minimal forensic image of a target dataset to reduce upload demand. The method includes storing a set of criteria in an investigator device, wherein the set of criteria determines target data files of the target dataset which are to be included in the minimal forensic image, and wherein the set of criteria includes a plurality of file types and at least a first upload format for each file type in the plurality of file types, locating the target data files of the plurality of file types in the target dataset using the set of criteria, storing a representation of each target data file in the minimal forensic image in an MFI upload format determined according to the set of criteria, and transferring the minimal forensic image to a cloud server.