Abstract: Apparatus, systems and methods are provided that leverage plugin modules supplemented by machine learning to create a robust and adaptable forensic investigation tool that obtains data from one or more data sources, separates the data into smaller units of data (e.g., deconstructs the data into its smallest logical data items/fields) determines common data types within the smaller units, creates “edges” that match data from the one or more data sources with data already in the system, then determines potentially overlapping clusters of information to identify potential connections between investigations and displays the information on a display in link form or grid form.

Abstract: Apparatus, systems and methods are provided that create an improved forensic investigation graph. Nodes of connected data are clustered according to a maximal nearest neighbor algorithm to create maximal nearest neighbor clusters. A first node of data is directly connected to at least a second node of data and indirectly connected to a third node of data through the second node. The nearest neighbor includes only sets of nodes that are directly connected. A cluster of data includes combinations of connected nodes. A cluster of nearest neighbors only includes combinations of nodes that are directly connected to each other. The maximal nearest neighbor clusters are created by determining all clusters or nearest neighbors and removing all nearest neighbor clusters that are subsets of another nearest neighbor cluster. The maximal nearest neighbor clusters re then displayed on a display. The maximal nearest neighbor clusters represent data acquired in the performance of a forensic investigation.

Abstract: A multi-core processor includes a tree-like structure having a plurality of computing cores arranged in hierarchical levels, the cores all having the same logical architecture. Each core can include computing, interconnecting, and/or storage elements. The functionality of an individual element can be supplied by an entire core in a lower level. A method for programming the processor includes hierarchically decomposing an application into interconnected sub-functions, mapping the sub-functions onto groups of cores at appropriate levels of the processor, and interconnecting the mapped sub-functions so as to hierarchically compose the complete application. Sub-functions can be sequential, concurrent, and/or pipelined. Interconnections can be static or dynamically switchable under program control. Interconnect elements can also be used to implement flow control as needed in pipelined operations to maintain data coherency.