Forensic Image Transfer via Skeleton Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for transferring and analyzing hard drive images over bandwidth-limited connections are inefficient, missing analytically significant information outside the file system and failing to provide a forensic duplicate, which hinders critical operations in law enforcement.
Innovation Solution
A method that generates a 'forensically sound' image by scanning for redundant data, creating a skeleton image excluding such data, and transmitting it over the network, allowing reconstruction using locally stored data, thereby minimizing unnecessary data transfer and ensuring a bit-for-bit copy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete forensically sound image is transmitted over the network, then forensic integrity is maintained, but bandwidth consumption increases and transfer time is excessive
Solution Approach 1:
The patent extracts and removes redundant data from the complete forensically sound image before transmission. By identifying and excluding duplicate files, empty spaces, and patterned areas that already exist at the receiving end, only the essential unique data is transmitted over the network, thereby reducing bandwidth consumption while preserving forensic integrity through the use of hash values for verification
Solution Approach 2:
The patent performs preliminary actions by pre-computing hash values of all files in the source image and comparing them with hash values of files already present at the receiving end. This preliminary analysis identifies redundant data that can be excluded from transmission, and prepares the minimized image structure in advance, reducing the actual data transfer required while maintaining forensic soundness
2Productivity
If redundant data is excluded from transmission, then bandwidth usage is reduced, but forensic completeness may be compromised
Solution Approach 1:
The patent creates a minimized copy of the forensically sound image that excludes redundant data. By using hash values as placeholders for excluded files and maintaining the structural integrity of the image, the patent produces a condensed representation that can be reconstructed at the receiving end to form a complete forensically sound image, thereby improving transfer speed without sacrificing forensic completeness
Solution Approach 2:
The patent incorporates feedback mechanisms by including hash values of excluded redundant files within the minimized image structure. The receiving system uses these hash values to verify and reconstruct the complete image by retrieving the original files from local storage, ensuring that forensic completeness is maintained despite the exclusion of redundant data during transmission
Data Source
AI summary
A forensically sound image of a computer readable storage medium can be transferred across a low bandwidth communications network. The method can include the step of scanning an image of the computer readable storage medium for redundant data, the redundant data duplicative of locally stored data. The method can also include generating a skeleton image based on the image of the computer readable storage medium by excluding the redundant data from the image of the computer readable storage medium. The method can include transmitting, by a transmitting device, the skeleton image over the communications network to a receiving device to enable reconstruction of an image copy of the computer readable storage medium using the skeleton image and the locally stored data. A receiving device can reconstruct a bit-for-bit copy of the image of the computer readable storage medium.