Abstract: Provided is a computer system, method and storage medium for determining a platform type of a forensic image. The method includes storing in a memory a mapping data structure mapping at least one predetermined data marker type to at least one platform type and automatically determining the platform type by scanning the forensic image for the at least one predetermined data marker type. The method further includes, where at least one data marker is detected, mapping the at least one data marker to at least one platform type using the mapping data structure. The method further includes, where at least one data marker is not detected, examining the forensic image to identify a set of present data elements, determining, according to at least one encoded rule, a most likely platform type. The method further includes assigning the platform type or the most likely platform type as the determined platform type.