METHOD AND APPARATUS FOR CREATING DATA TABLE OF FORENSICS DATA

• US 20120166456A1
• Filed: 12/27/2011
• Published: 06/28/2012
• Est. Priority Date: 12/27/2010
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: KIM, Keonwoo, Hong, Do Won, Un, Sung Kyong, Kim, Youngsoo, Lee, Sang Su, Choi, Woo Yong, Lee, Jooyoung, Jo, Su Hyung, Gil, Youn-Hee, Cho, Hyun sook
• Application Number:
  US13/338,147
• Publication Number:
  US 20120166456A1
• Time in Patent Office: Days
• US Class Current: 707/754
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems

Abstract

An apparatus for creating a data table of a forensic data, includes a data parser configured to create primary data tables including unique attributes of the predetermined keywords by parsing the raw data having different formats for each forensics tool, each attribute having a unique standardized format. The apparatus further includes a data filter filtering specific fields or attributes from the primary data tables to newly create secondary data table. The apparatus further includes a data relation analyzer analyzing a relation between the data within the primary data tables to newly create secondary data tables.

Claims

1. An apparatus for creating a data table of a forensic data, the apparatus comprising:

a data parser configured to create primary data tables including unique attributes of the predetermined keywords by parsing the raw data having different formats for each forensics tool, each attribute having a unique standardized format.

2. The apparatus of claim 1, further comprising a data filter configured to filter specific fields or attributes from the primary data tables to newly create secondary data table.

3. The apparatus of claim 1, wherein the primary data tables includes a system start/end data table, a web visit/search/account data table, an USB connect data table, a processor execution data table, a command execution data table, a file search data table, a messenger data table, a document creation/modification/deletion data table, and a file creation/modification/deletion data table.

4. The apparatus of claim 1, further comprising a data relation analyzer configured to analyse a relation between the data within the primary data tables to newly create secondary data tables.

5. A method for creating a data table of a forensic data, the method comprising:

generating primary data tables including unique attributes of the predetermined keywords by parsing the raw data having different formats for each forensics tool, each attribute having a unique standardized format.

6. The method of claim 5, further comprising:

filtering specific fields or attributes from the primary data tables to newly create secondary data table.

7. The method of claim 5, wherein the primary data table includes a system start/end data table, a web visit/search/account data table, an USB connect data table, a processor execution data table, a command execution data table, a file search data table, a messenger data table, a document creation/modification/deletion data table, and a file creation/modification/deletion data table.

8. The method of claim 5, further comprising:

analyzing a relation between the data from the primary data table to newly create secondary data table.