Abstract: Forensic analysis of computer data is facilitated by analyzing data as it is being read from a target storage (10), rather than from a restored bit stream back-up file. In some embodiments, multiple processors (16) or threads run different analyses simultaneously. In some embodiments, the analyses are performed on very small amounts of data, with additional data being read when necessary to determine whether the first data meets the analysis criteria.

Abstract: Ambient data is data created or retained as an artifact of a computer system, rather than by the intention of the user. Ambient data typically includes both textual and binary, i.e., non-textual, data. Ambient data can include information of which the user is unaware and that is of interest to an investigator. Most of the information in the ambient data is not useful, and the large amount of ambient data on a typical computer system can require significant time to review. The system excludes most of the non-useful ambient data by searching for punctuation marks, and then comparing the characters near the punctuation mark with a list of common words in English or another language. The occurrence of words in proximity to punctuation suggests the presence of meaningful, grammatical sentences, which are copied to a second file. The non-textual data is replaced with spaces, so that the second file can be viewed with a commercial word processor.

Abstract: Ambient data is data created or retained as an artifact of a computer system, rather than by an intention of the user. Ambient data typically includes both textual and binary, i.e., non-textual, data. Ambient data can include information of which the user is unaware, and an investigator can review ambient data to learn about the Internet-related activity performed on the computer. Most of the information in the ambient data is not useful, and the large amount of ambient data on a typical computer system can require significant time to review. The invention locates useful internet-related information in the ambient data and outputs the information in a useful database format, excluding non-textual data and text that is unrelated to Internet activity. The system locates internet-related information of interest using proximity rules, that is, the system writes output when only when certain characters appear in the ambient data within a specified proximity to other characters.

Abstract: Ambient data is data created or retained as an artifact of a computer system, rather than by the intention of the user. Ambient data typically includes both textual and binary, i.e., non-textual data. Ambient data can include information of which the user is unaware and that is of interest to an investigator. Most of the information in the ambient data is not useful, and the large amount of ambient data on a typical computer system can require significant time to review. The system excludes most of the non-useful ambient data and isolates full names from the ambient data by comparing the characters in the ambient data with a list of first names and nicknames. If a listed first name or nickname is found, the located name and data surrounding the name is saved to a second file. The amount of data saved is sufficient to capture a full name, regardless of whether the last name is located before or after the first name.