Patent ID: 7865493

Claim:
An apparatus for searching for digital forensic data, comprising: an imaging module for generating an image file from a data source; a file system analysis module for determining and analyzing a file system of the image file to generate file system analysis information, wherein the file system analysis module is configured to determine whether the file system is an NTFS file system, to determine whether the file system is a FAT12 file system, to determine whether the file system is a FATE file system, to determine whether the file system is a FAT 32 file system, to determine whether the file system is an EXT2 file system, to determine whether the file system is an EXT3 file system, to determine whether the file system is a UFS file system, and to determine whether the file system is an ISO9660 file system; a search module for determining a search character encoding type based on the file system analysis information and searching for the data using the search character encoding type; and a user interface for receiving a command related to a search from a user, transmitting the received command to the file system analysis module and the search module, and outputting the search results to the user.