Patent ID: 11868212
Assignee: MAGNET FORENSICS INVESTCO INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. A method of identifying unknown data associated with a forensic event according to reference time data, the method comprising:
storing reference time data corresponding to the forensic event;
accessing data from a data storage device comprising unknown data of an unknown application type;
determining that the unknown data is suggestive of a database source, based on the unknown data comprising at least one table with at least one column;
in response to determining that the unknown data is suggestive of a database source, for a column of a table in database information of the unknown data:
determining if a column identifier of the column comprises a keyword associated with a particular application type;
retrieving a content sample data record that is within the column;
determining if a subset of the content sample data record matches dictionary data, the dictionary data predetermined based on expected content associated with the particular application type;
if the column identifier comprises the keyword, identifying data stored in the database information as stored by an application that is of the particular application type by:
converting the data in the column in the data record to each of a plurality of date/time formats to obtain converted data;
flagging converted data entries of the converted data that are greater than a threshold time away from the reference time data;
comparing the converted data entries in the converted data that are unflagged, in each respective date/time format, to each other to determine which of the converted data entries is closest to the reference time data; and
for the converted data entry that is closest to the reference time data, identifying the date/time format of the converted data entry as the date/time format of the data in the column of the table.