Methods for searching and presentation of the results in digital forensics and apparatus thereof

摘要

A methods for performing a searching operation and presenting the search results in a digital forensics and an apparatus thereof are provided to enable an inspector to search all information and perform the evaluation for the searching result by showing the desirable information in the front portion of the search result list. An attribute information extracting unit(500) converts forensic images of bitstream state into logic level data based on a search preprocess, and extracts and stores the attribute information and the metadata for the attribute information of the forensic image. A search unit(400) searches a query extended through a query extension unit(300) in a physical level. A priority determining unit(600) generates an intrinsic structure that stores the attribute information as to each file in the search list, and determines the priority of the file based on the evaluation of the structure according to the defined evaluation standard. A result output unit(700) arranges the files in the search list based on the determined priority and provides a user with the files.