Systems and methods for locating and recovering key populations of desired data

• US 10,437,862 B1
• Filed: 09/29/2016
• Issued: 10/08/2019
• Est. Priority Date: 09/29/2015
• Status: Active Grant

• Current Assignee: Royal Bank of Canada (The PNC Financial Services Group, Inc.)
• Original Assignee: Magnet Forensics, Inc.
• Inventors: Cosentino, Nicholas Bruce Alexander, Uzun, Tayfun
• Primary Examiner(s): Pham, Tuan A
• Application Number:
  US15/280,286
• Time in Patent Office: 1,104 Days
• Field of Search: None
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/29 Geographical information databases
• CPC Class Codes: G06F 16/583 using metadata automatically derived from the content
• CPC Class Codes: G06F 16/5838 using colour

Abstract

A system and a method for locating populations of content-specific data portions. The method includes determining a current population of data portions to be searched based on at least one prioritization criterion; accessing the current population of data portions; examining at least one data portion of the current population of data portions and extracting content-specific data; comparing the content-specific data to at least one suspect criterion; determining whether the current population meets at least one population criterion by analyzing the content-specific data; determining at least one next population of data portions to be searched based on proximity to the current population; and determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

Claims

1. A computer-implemented method for locating populations of content-specific data portions, the method comprising:

determining, at a processor, a current population of data portions to be searched based on at least one prioritization criterion, the current population of data portions being located on at least one data storage device;

determining, at the processor, a prioritized queue of populations to be searched based on the at least one prioritization criterion;

accessing, at the processor, the current population of data portions;

examining, at the processor, at least one data portion of the current population of data portions and extracting content-specific data;

comparing, at the processor, the content-specific data to at least one suspect criterion;

determining, at the processor, whether the current population meets at least one population criterion by analyzing the content-specific data;

if it is determined that the current population meets the at least one population criterion, then determining at least one next population of data portions to be searched based on proximity to the current population, the at least one next population of data portions being located on the at least one data storage device and the proximity to the current population based on the location of next population of data portions to the location of the current population; and

if it is determined that the current population does not meet the at least one population criterion, then determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

2. The method of claim 1, further comprising determining, at the processor, whether the current population of data portions comprises at least one content-specific data portion.

3. The method of claim 2, wherein the current population is the first population of the prioritized queue of populations determined by comparing data of a plurality of locations of populations to at least one prioritization criterion, each location comprising one population.

4. The method of claim 3, wherein the data of the plurality of locations includes data on when each location from the plurality of locations has been accessed.

5. The method of claim 2, wherein the at least one population criterion comprises a maximum number of determined content-specific data portions in the current population.

6. The method of claim 2, further comprising recovering the at least one content-specific data portion.

7. The method of claim 1, further comprising determining, at the processor, a prioritized queue of populations to be searched based on the at least one prioritization criterion, a first population of the prioritized queue of populations having the closest match with the at least one prioritization criterion and the last population of the prioritized queue of populations having the least match with the at least one prioritization criterion.

8. The method of claim 1, wherein determining the at least one next population based on the proximity to the current population further comprises determining, at the processor, the at least one next population located on the at least one data storage device within a user-defined child proximity radius.

9. The method of claim 1, wherein determining the next population based on the proximity to the current population further comprises determining at least one population which is adjacent to the current population.

10. The method of claim 1, wherein determining the next population based on the proximity to the current population further comprises analyzing historical data of a location of the current population and comparing it to historical data of a plurality of locations.

11. The method of claim 1, wherein the at least one prioritization criterion comprises at least one time period.

12. The method of claim 1, wherein the at least one population criterion comprises a percentage of skin tone pixels within the accessed and examined data portions of the current population.

13. The method of claim 1, wherein the at least one population criterion comprises a maximum number of data portions of the current population to be accessed and examined.

14. The method of claim 1, wherein the content-specific data comprises a percentage of skin tone pixels.

15. The method of claim 1, wherein the data portion is a data file.

16. The method of claim 1, wherein the data portion is a fragment of an unallocated space data.

17. The method of claim 1, wherein the data portion is a data chunk.

18. A system for locating content-specific data comprising:

a) at least one data storage device, having unidentified data stored therein;

b) at least one processor operatively coupled to the at least one data storage device, the at least one processor configured to;

i) determine a current population of data portions to be searched based on at least one prioritization criterion, the current population of data portions being located on at least one data storage device;

ii) determine a prioritized queue of populations to be searched based on the at least one prioritization criterion;

iii) access the current population of data portions;

iv) examining at least one data portion of the current population of data portions and extracting content-specific data;

v) compare the content-specific data to at least one suspect criterion;

vi) determine whether the current population meets at least one population criterion by analyzing the content-specific data;

vii) if it is determined that the current population meets the at least one population criterion, then determine at least one next population of data portions to be searched based on proximity to the current population, the at least one next population of data portions being located on the at least one data storage device and the proximity to the current population based on the location of next population of data portions to the location of the current population; and

viii) if it is determined that the current population does not meet the at least one population criterion, then determine the at least one next population of data portions to be searched based on the at least one prioritization criterion.