Abstract: The invention relates to computer-implemented systems and methods that perform forensic investigations including detecting system executable abnormalities. An embodiment of the present invention may be applied to various operating systems, such as Windows, Mac, Linux, etc. Operating systems may represent a collection of programs that coordinate the operation of computer hardware and software and provide common services for computer programs. An embodiment of the present invention recognizes that certain files such as OS catalogs identify known good files and may be filtered out. The OS catalog identifies what executables are expected and further supports what type of files should not be part of the install. An embodiment of the present invention also identifies unique executable properties that relate to a specific operating system. These properties may identify operating system specific characteristics that may be used to filter known good executables.

Abstract: The invention relates to computer-implemented systems and methods that perform forensic investigations including detecting system executable abnormalities. An embodiment of the present invention may be applied to various operating systems, such as Windows, Mac, Linux, etc. Operating systems may represent a collection of programs that coordinate the operation of computer hardware and software and provide common services for computer programs. An embodiment of the present invention recognizes that certain files such as OS catalogs identify known good files and may be filtered out. The OS catalog identifies what executables are expected and further supports what type of files should not be part of the install. An embodiment of the present invention also identifies unique executable properties that relate to a specific operating system. These properties may identify operating system specific characteristics that may be used to filter known good executables.