SYSTEMS AND METHODS FOR LOCATING APPLICATION SPECIFIC DATA

• US 20160048555A1
• Filed: 10/30/2015
• Published: 02/18/2016
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Royal Bank of Canada (The PNC Financial Services Group, Inc.)
• Original Assignee: Magnet Forensics, Inc.
• Inventors: Saliba, Jad John
• Granted Patent: US 11,036,714 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content

Abstract

A system and a method for locating application-specific data that has been previously deleted and located in an address of the data storage device marked as being available for storing new data. The method includes accessing unidentified data from at least one data storage device; examining the unidentified data to detect at least one application-specific data pattern associated with at least one application; for each detected application-specific data pattern, executing an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application; and if it is determined that the unidentified data includes valid data associated with the corresponding application, then recovering the valid data.

Claims

1. A system for locating for application-specific data comprising:

(a) at least one data storage device, having unidentified data stored therein;

(b) at least one processor operatively coupled to the at least one data storage device, the at least one processor configured to;

(i) access unidentified data from at least one data storage device;

(ii) examine the unidentified data to detect at least one application-specific data pattern associated with at least one application;

(iii) for each detected application-specific data pattern, execute an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application; and

(iv) if it is determined that the unidentified data includes valid data associated with the corresponding application, then recover the valid data.

2. The system of claim 1, wherein the unidentified data includes data that has been previously deleted and located in an address of the data storage device marked as being available for storing new data.

3. The system of claim 1, wherein the application-specific data pattern includes at least one user identifier for the at least one application, the user identifier being associated with at least one user of the data storage device.

4. The system of claim 3, wherein the at least one processor is configured to obtain the at least one user identifier by searching that data storage device at specific locations that are known to store user identifiers associated with the at least one application.

5. The system of claim 1, wherein the at least one processor is further configured to execute the application-specific validation process by:

(a) determining a date associated with a portion of the unidentified data located near that application-specific data pattern; and

(b) comparing the date against provided date ranges to filter out invalid data.

6. The system of claim 1, wherein the at least one processor is further configured to execute the application-specific validation process by:

(a) determining an amount of unacceptable characters present in a portion of the unidentified data, the unacceptable characters being indicative of data that is not associated with any desired application; and

(b) determining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters.

7. The system of claim 6, wherein the at least one processor is further configured to:

(a) provide a user-definable strictness level indicative of a tolerable amount of unacceptable characters; and

(b) determine whether the portion of the unidentified data is valid based upon the amount of unacceptable characters and the strictness level.

8. The system of claim 1, wherein the at least one processor is further configured to execute the application-specific validation process by determining whether expected data for the application is stored at expected locations for the application.

9. The system of claim 1, wherein the at least one processor is further configured to check whether the data stored in the expected locations includes non-readable characters to determine whether the portion of the unidentified data is valid.

10. The system of claim 1, wherein the at least one processor is further configured to execute the application-specific validation process by checking data surrounding the portion of the unidentified data to determine that that portion of data is not associated with another application.

11. The system of claim 1, wherein the at least one processor is further configured to limit the search to selected locations on the data storage device for application-specific data.

12. The system of claim 11, wherein the at least one processor is further configured to:

(a) provide a number of user-selectable options to select one or more applications to search; and

(b) determine the search locations based upon the options selected.

13. The system of claim 1, wherein the at least one processor is further configured to execute the application-specific validation process by conducting semantic error checking.

14. The system of claim 1, further comprising a second data storage device configured to removably connect with the at least one processor and provide computer-executable instructions to configure the at least one processor.

15. The system of claim 1, further comprising a third data storage device configured to removably connect with the at least one processor, wherein the at least one processor is configured to output the valid data to the third data storage device such that the valid data do not overwrite the unidentified data in the data storage device.

16. A computer-implemented method for locating application-specific data, the method comprising:

(a) accessing unidentified data from at least one data storage device;

(b) examining the unidentified data to detect at least one application-specific data pattern associated with at least one application;

(c) for each detected application-specific data pattern, executing an application-specific validation process to determine whether the unidentified data includes valid data associated with a corresponding application; and

(d) if it is determined that the unidentified data includes valid data associated with the corresponding application, then recovering the valid data.

17. The method of claim 16, wherein the application-specific validation process comprises:

(a) determining a date associated with a portion of the unidentified data located near that application-specific data pattern; and

(b) comparing the date against provided date ranges to filter out invalid data.

18. The method of claim 16, wherein the application-specific validation process comprises:

(a) determining an amount of unacceptable characters present in a portion of the unidentified data, the unacceptable characters being indicative of data that is not associated with any desired application; and

(b) determining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters.

19. The method of claim 18, further comprising:

(a) providing a user-definable strictness level indicative of a tolerable amount of unacceptable characters;

(b) determining whether the portion of the unidentified data is valid based upon the amount of unacceptable characters and the strictness level.

20. The method of claim 19, further comprising:

(a) providing a number of user-selectable options to select one or more applications to search;

(b) determining search locations based upon the options selected; and

(c) limiting the search to the determined search locations on the data storage device for application-specific data.