Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 7/21/2026 has been entered.
Response to Amendment
The Amendment filed July 21 2026 has been entered and considered. Claims 1, 5, 11, and 15-16 have been amended. In light of the amendment the prior art rejections of claims 1 and 11 are withdrawn as moot. The new grounds of rejection set forth in the present action were necessitated by Applicants’ claim amendments.
112 Rejections –
In view of the amendment, the rejections under 112(a) and 112(b) are withdrawn as moot.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Wang et al. (Previously cited) in view of Le et al. (US Patent No. 7,356,679 B1, published 2008).
Regarding claim 1, Wang teaches a computer system for determining a platform type of a forensic image using an initial conclusive platform identification analysis of the forensic image (Para. 56, “First of all, the present invention proposes a forensics method that supports multiple operating systems, which is used to obtain evidence for operating systems through portable storage devices.”), the computer system comprising: a memory comprising at least one storage device; and a processor configured to (Fig. 4, translated and reprinted below,
PNG
media_image1.png
292
282
media_image1.png
Greyscale
): store in the memory a mapping data structure including a mapping of a plurality of conclusive data marker types to respective platform types (Para. 65, “First obtain the file system type of the disk of the forensic object. The file system types include NTFS file system, APFS file system and HFS+ file system. The category of the NTFS file system can be known from the disk volume header. The NTFS file system is marked with NTFS in the 3rd to 6th bytes of the volume header.”, the mapping is known and stored in memory beforehand); automatically determine the platform type of the forensic image by (Para. 64, “The type of operating system that identifies the forensic object described here is determined by the type of file system.”): performing the initial conclusive platform identification analysis by: scanning at least a part of the forensic image for the plurality of conclusive data marker types (Para. 65, “First obtain the file system type of the disk of the forensic object. The file system types include NTFS file system, APFS file system and HFS+ file system.”); where a data marker of the plurality of conclusive data marker types is detected during the scan (Para. 65, “The category of the NTFS file system can be known from the disk volume header”): determining a platform type by mapping the data marker to a corresponding platform type using the mapping data structure; and assigning the corresponding platform type as a determined platform type for the forensic image (Para. 66, “Then determine the operating system type of the forensic object according to the file system type; if the file system type is NTFS file system, the operating system type of the forensic object is Windows operating system”); and where no data marker corresponding to any of the plurality of conclusive data marker types is detected during the initial conclusive platform identification analysis, performing an elimination analysis; and assigning the likely platform type as the determined platform type for the forensic image (Para. 66, “if the file system type is NTFS file system, the operating system type of the forensic object is Windows operating system; if the file system type is APFS file system or HFS+ file system, then the forensic object The operating system type is macOS; if the file system type is not any of the NTFS file system, APFS file system, and HFS+ file system, the operating system type of the forensic object is the Linux operating system.”).
Wang does not explicitly disclose performing a secondary heuristic platform determination analysis if no conclusive data marker is detected during the initial conclusive analysis. However, Wang simply does a process of elimination rather than further analysis.
Le teaches performing a heuristic platform determination analysis by: examining at least a part of the forensic image for a set of heuristic data element types to identify a set of present heuristic data elements, the present heuristic data elements being of at least one of the set of heuristic data element types (Col. 29, Lines 64-67, “The operating system itself is a set of program and configuration files; therefore a file analysis of a disk image containing an operating system can determine the operating system type, version, and settings.”); applying heuristic criteria, stored in the memory as at least one encoded rule, to the set of present heuristic data elements to collectively evaluate the present heuristic data elements and determine a likely platform type; and assigning the likely platform type as the determined platform type for the forensic image (Col. 85, Lines 1-15, “Before populating the destination disk with files from the source disk, the application first checks whether the source disk contains an operating system. The application can detect the presence of an operating system by checking for the presence of specific files installed by an operating system. For instance, a disk containing a Windows operating system generally consists of at least one disk partition marked active and that partition holds a file system containing a boot.ini file specifying the location of the operating system, expressed as a path name to a system folder. The P2V application could determine the system folder from the boot.ini file and then inspect the system files and registry hives under that folder to determine the operating system's system configuration, including type, version, patch level and hardware configuration.”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Wang to incorporate the teachings of Le to include performing a secondary heuristic platform determination analysis if no conclusive data marker is detected during the initial conclusive analysis. Wang discloses a method for determining an operating system by performing a conclusive analysis. However, if Wang does not detect a conclusive data marker, they simply determine the operating system using process of elimination. Le discloses a method for computer image capture, including a heuristic analysis of the disk in order to determine the operating system by checking system files and registries that correspond to a specific operating system. One of ordinary skill in the art would have recognized that analyzing heuristic data elements, such as files generally associated with a specific operating system, is a well-known method for determining an operating system, as disclosed by Le. The skilled artisan would have predictably supplemented the rudimentary process of elimination step disclosed by Wang with the file specific checking of Le to improve accuracy and provide redundancy to the task of operating system detection.
Regarding claim 2, Wang as modified teaches all of the elements of claim 1, as stated above, as well as to store in the memory a second mapping data structure including a mapping of the determined platform type to at least one forensic image processing tool; and map the determined platform type to the at least one forensic image processing tool using the second mapping data structure (Para. 70, “When the operating system type of the forensic object is the Windows operating system, start the Windows parsing module in the offline forensic system to obtain system traces and user traces, and start the mirroring module to make a mirror image of the data in the forensic object's disk, and calculate the hash correction of the disk at the same time”).
Regarding claim 3, Wang as modified teaches all of the elements of claim 2, as stated above, as well as wherein the at least one forensic image processing tool is configured to extract at least one data artifact type supported by the determined platform type from the forensic image (Para. 70, “start the Windows parsing module in the offline forensic system to obtain system traces and user traces”).
Regarding claim 4, Wang as modified teaches all of the elements of claim 2, as stated above, as well as wherein the processor is further configured to, in response to mapping the determined platform type to the at least one forensic image processing tool, automatically execute the at least one forensic image processing tool to process the forensic image (Para. 70, “When the operating system type of the forensic object is the Windows operating system, start the Windows parsing module in the offline forensic system to obtain system traces and user traces”).
Regarding claim 5, Wang as modified teaches all of the elements of claim 1, as stated above, as well as wherein the at least one data marker type includes a first marker type and a second marker type, and wherein the scanning for the second marker type is only executed if the first marker type is not detected by the scan for the first marker type (Para. 65, “The file system types include NTFS file system, APFS file system and HFS+ file system. The category of the NTFS file system can be known from the disk volume header. The NTFS file system is marked with NTFS in the 3rd to 6th bytes of the volume header. APFS file system and HFS+ file system are distinguished by the value of the attribute IOClass. If the value of the attribute 10 Class is Apple APFS Container Scheme, it means that the disk or partition of the forensic object uses the APFS file system. If the value of the attribute 10 Class is Core Storage Physical means that the disk or partition of the forensic object uses the HFS+ file system.”, if it is not NTFS, it will check the attribute IOClass for further determination).
Regarding claim 6, Wang as modified teaches all of the elements of claim 1, as stated above, as well as to store in the memory a heuristic determination data structure including a mapping of at least one predetermined element type to at least one platform type; and wherein the identified set of present heuristic data elements comprises a first element and a second element (Col. 85, Lines 1-10, “Before populating the destination disk with files from the source disk, the application first checks whether the source disk contains an operating system. The application can detect the presence of an operating system by checking for the presence of specific files installed by an operating system. For instance, a disk containing a Windows operating system generally consists of at least one disk partition marked active and that partition holds a file system containing a boot.ini file specifying the location of the operating system, expressed as a path name to a system folder.”); and wherein the applying the heuristic criteria, comprises: mapping the first element to a first platform type and the second element to a second platform type according to the heuristic determination data structure (Col. 85, Lines 6-10, “For instance, a disk containing a Windows operating system generally consists of at least one disk partition marked active and that partition holds a file system containing a boot.ini file specifying the location of the operating system, expressed as a path name to a system folder.”); and selecting the likely platform from the first platform type and the second platform type based on the at least one encoded rule (Col. 85, Lines 10-15, “The P2V application could determine the system folder from the boot.ini file and then inspect the system files and registry hives under that folder to determine the operating system's system configuration, including type, version, patch level and hardware configuration.”).
Regarding claim 7, Wang as modified teaches all of the elements of claim 1, as stated above, as well as wherein the encoded rule comprises a voting system based on how frequently a platform type is represented in the set of present heuristic data elements (Para. 66, “if the file system type is APFS file system or HFS+ file system, then the forensic object The operating system type is macOS; if the file system type is not any of the NTFS file system, APFS file system, and HFS+ file system, the operating system type of the forensic object is the Linux operating system.”; Col. 85, Lines 6-15, “For instance, a disk containing a Windows operating system generally consists of at least one disk partition marked active and that partition holds a file system containing a boot.ini file specifying the location of the operating system, expressed as a path name to a system folder. The P2V application could determine the system folder from the boot.ini file and then inspect the system files and registry hives under that folder to determine the operating system's system configuration, including type, version, patch level and hardware configuration.”), a determination of the operating system type is made based on the present data elements, indicating a type of voting system is used based on prior knowledge).
Regarding claim 8, Wang as modified teaches all of the elements of claim 1, as stated above, as well as wherein the applying the heuristic criteria further comprises: determining a candidate likely platform type based on the set of present heuristic data elements (Col. 85, Lines 6-10, “For instance, a disk containing a Windows operating system generally consists of at least one disk partition marked active and that partition holds a file system containing a boot.ini file specifying the location of the operating system, expressed as a path name to a system folder.”); determining a confidence level associated with the determination of the candidate likely platform type (Col. 85, Lines 10-15, “The P2V application could determine the system folder from the boot.ini file and then inspect the system files and registry hives under that folder to determine the operating system's system configuration, including type, version, patch level and hardware configuration.”, determining a confidence level is inherent to determining a file system based on known file system information); comparing the confidence level to a confidence level threshold; and where the confidence level meets the confidence level threshold, assigning the candidate likely platform as the most likely platform type and terminating the examining of the forensic image (Para. 66, “Then determine the operating system type of the forensic object according to the file system type; if the file system type is NTFS file system, the operating system type of the forensic object is Windows operating system; if the file system type is APFS file system or HFS+ file system, then the forensic object The operating system type is macOS; if the file system type is not any of the NTFS file system, APFS file system, and HFS+ file system, the operating system type of the forensic object is the Linux operating system.”; Col. 85, Lines 10-15, “The P2V application could determine the system folder from the boot.ini file and then inspect the system files and registry hives under that folder to determine the operating system's system configuration, including type, version, patch level and hardware configuration.”, determining a file system based on known file system information is analogous to determining a confidence level. Determining the operating system type according to the determined file system type is analogous to a threshold for assigning a most likely candidate).
Regarding claim 9, Wang as modified teaches all of the elements of claim 1, as stated above, as well as wherein automatically determining the platform type is performed for each of a plurality of partitions of the forensic image to determine a partition platform type for each of the plurality of partitions (Para. 65, “If the value of the attribute 10 Class is Core Storage Physical means that the disk or partition of the forensic object uses the HFS+ file system.”, partitions are also considered).
Regarding claim 10, Wang as modified teaches all of the elements of claim 1, as stated above, as well as to store in the memory a mapping data structure including a mapping of the determined platform type to a digital forensic investigation workflow stored in the memory (Para. 46, “By judging the file system type, identifying the type of operating system contained in the forensic object, and then launching the corresponding forensic module for forensics, solving the problem of not being able to support Windows, Linux, and macOS for forensics at the same time.”), the digital forensic investigation workflow including a plurality of operations to be performed by the processor on the forensic image or on data extracted from the forensic image (Para. 69, “There are three main modules in the offline forensics system: Windows parsing module, macOS parsing module and mirroring module.”); map the determined platform type to the digital forensic investigation workflow; and execute at least a portion of the digital forensic investigation workflow (Para. 70, “When the operating system type of the forensic object is the Windows operating system, start the Windows parsing module in the offline forensic system to obtain system traces and user traces, and start the mirroring module to make a mirror image of the data in the forensic object's disk, and calculate the hash correction of the disk at the same time”, See Paras. 71 and 72 where the digital forensic investigation workflow is also performed on macOS and Linux).
Claim 11 corresponds to claim 1 and is rejected under the same analysis.
Claim 12 corresponds to claim 2 and is rejected under the same analysis.
Claim 13 corresponds to claim 3 and is rejected under the same analysis.
Claim 14 corresponds to claim 4 and is rejected under the same analysis.
Claim 15 corresponds to claim 5 and is rejected under the same analysis.
Claim 16 corresponds to claim 6 and is rejected under the same analysis.
Claim 17 corresponds to claim 7 and is rejected under the same analysis.
Claim 18 corresponds to claim 8 and is rejected under the same analysis.
Claim 19 corresponds to claim 9 and is rejected under the same analysis.
Claim 20 corresponds to claim 10 and is rejected under the same analysis.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DAVID A WAMBST whose telephone number is (703)756-1750. The examiner can normally be reached M-F 9-6:30 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Gregory Morse can be reached at (571)272-3838. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DAVID ALEXANDER WAMBST/Examiner, Art Unit 2663
/GREGORY A MORSE/Supervisory Patent Examiner, Art Unit 2698
Prosecution Insights