METHOD AND APPARATUS FOR FORENSIC ANALYSIS OF INFORMATION STORED IN COMPUTER-READABLE MEDIA

Ambient data is data created or retained as an artifact of a computer system, rather than by the intention of the user. Ambient data typically includes both textual and binary, i.e., non-textual, data. Ambient data can include information of which the user is unaware and that is of interest to an investigator. Most of the information in the ambient data is not useful, and the large amount of ambient data on a typical computer system can require significant time to review. The system excludes most of the non-useful ambient data by searching for punctuation marks, and then comparing the characters near the punctuation mark with a list of common words in English or another language. The occurrence of words in proximity to punctuation suggests the presence of meaningful, grammatical sentences, which are copied to a second file. The non-textual data is replaced with spaces, so that the second file can be viewed with a commercial word processor.