Importance

Loading Importance Indicators...

Abstract

Ambient data is data created or retained as an artifact of a computer system, rather than by an intention of the user. Ambient data typically includes both textual and binary, i.e., non-textual, data. Ambient data can include information of which the user is unaware, and an investigator can review ambient data to learn about the Internet-related activity performed on the computer. Most of the information in the ambient data is not useful, and the large amount of ambient data on a typical computer system can require significant time to review. The invention locates useful internet-related information in the ambient data and outputs the information in a useful database format, excluding non-textual data and text that is unrelated to Internet activity. The system locates internet-related information of interest using proximity rules, that is, the system writes output when only when certain characters appear in the ambient data within a specified proximity to other characters. The characters can include including symbols, abbreviations, or words, specified either individually or on a pre-compiled list. Exclusionary rules can also eliminate firewall aliases, internet identifiers that are less useful to an investigator. By applying such rules, an output file including only textual data representing useful Internet addresses and URL is presented to an investigator.

Loading the Abstract Image...

First Claim