Magnet Forensics Inc.

James David Schroering

Jad John Saliba

Provided are a system and method for evaluating integrity of a parsed file system. The system includes a processor and a memory communicatively connected to the processor and storing computer-executable instructions that cause the system to read an allocation tracker, create an allocated blocks collection of each block identifier within the allocation tracker indicated to be currently allocated, create an initially empty reference anomaly blocks collection, for each block of each file system object referenced by the file system object, determine that the associated block identifier is present in the allocated blocks collection or not, respectively remove the block identifier from the allocated blocks collection or add the block identifier to the reference anomaly blocks collection, determine that the allocated blocks collection and the reference anomaly blocks collection are empty or not empty and respectively indicate a successful evaluation or an unsuccessful evaluation.

Growing community of inventors

Arvada, CO, United States of America

James David Schroering