Abstract: In one aspect of the present invention, a software component for conducting digital forensic searches is described. The software component has a header; one or more search markup language programs, and a data features section. The software component, also referred to as a search pack, enables a first entity, such as a federal investigation agency, to share its suspect and sensitive data with a second entity, such as another investigative agency in a manner that allows the second agency to utilize the suspect data while not revealing the actual content of the sensitive data to the second agency. The second agency can perform comparisons and other operations on the sensitive data without having to know the actual content of the data. The search pack allows an investigative agency to define an investigative strategy for a particular case via the search markup language programs and by the data features that it includes in the search pack.

Abstract: A method of automatically identifying relevant or suspect data during a digital forensic investigation is described. Software accepts as input raw data which are extracted from various digital data sources. The software or digital forensic and data identification application determines to which one or more identification modules the unknown raw data should be delivered to for processing. This determination is based on the type of data in the extracted raw data coming into the application. Suspect or relevant data that are identified includes that data that are identical to or similar to the extracted unknown raw data. If there are suspect data, the application transmits a message or alert to interested parties or stores the findings/report on an a storage device. In this manner, the suspect data are identified automatically, without intervention by a human being.