Patent ID: 8224848

Claim:
In a computer forensic investigation system including an examining machine coupled to one or more target machines over a data communications network, a method for identifying one or more files in the one or more target machines that are a near-match to a reference file, the method comprising: determining a first weighted entropy value of the reference file, wherein the first weighted entropy value represents an entropy of the reference file weighted based on a size of the reference file; determining a second weighted entropy value of a target file stored in the one or more target machines, wherein the second weighted entropy value represents an entropy of the target file weighted based on a size of the target file; determining a likeness of content in the target file to content in the reference file based on the first and second weighted entropy values; identifying a tolerance threshold; determining a near-match between the target file and the reference file if the likeness of the target file to the reference file is within the tolerance threshold; and displaying on a display, information on the target file in response to the determining of a near-match.