Systems and methods for locating and recovering key populations of desired data

1. A computer-implemented method for investigating at least one data storage device to locate suspect data portions on the at least one data storage device, the method comprising:

determining, at a processor, a prioritized queue of populations of data to be searched for the suspect data portions on the at least one data storage device, the prioritized queue of populations determined based on at least one prioritization criterion, a first population of the prioritized queue of populations having the closest match with the at least one prioritization criterion, the first population being located on the at least one data storage device;

accessing, at the processor, a first data portion of the first population on the at least one data storage device;

examining, at the processor, the first data portion to determine whether the first data portion includes content-specific data matching at least one suspect criterion, the at least one suspect criterion including a threshold of skin tone pixels, and the examining including determining whether the first data portion meets the threshold of skin tone pixels; and

if it is determined that the first data portion includes the content-specific data matching the at least one suspect criterion, then;

identifying, via the processor, the first data portion as a suspect data portion; and

recovering, via the processor, the first data portion at the at least one data storage device.

2. The method of claim 1 , wherein the method further comprises determining, at the processor, whether the first population meets at least one population criterion;

if it is determined that the first population meets the at least one population criterion, then

accessing and examining, at the processor, the at least one second data portion to determine whether the at least one second data portion includes data matching the at least one suspect criterion; and

if it is determined that the first population does not meet the at least one population criterion, then

removing, at the processor, the first location population from the prioritized queue of location populations.

3. The method of claim 1 , wherein the method further comprises

Determining, at the processor, at least one child population based on proximity to the first population and

Replacing, at the processor, the first population of the prioritized queue of populations with the at least one child population.

4. The method of claim 1 , wherein the threshold of skin pixels comprises a percentage of skin tone pixels.

5. The method of claim 2 , wherein the population criterion comprises a percentage of skin tone pixels within the accessed and examined data portions of the first population.

6. The method of claim 2 , wherein the population criterion comprises a maximum number of data portions of the first population to be accessed and examined.

7. The method of claim 2 , wherein the population criterion comprises a maximum number of determined suspect data portions in the first population.

8. The method of claim 3 , wherein determining the child population is based on whether the first data portion includes content-specific data matching the at least one suspect criterion.

9. The method of claim 3 , wherein determining the child population is based on a location proximity to the suspect data portion.

10. The method of claim 1 , further comprising

providing at least one user-selectable option to select a maximum number of data portions to be accessed and examined in the first population;

after the maximum number of data portions have been accessed and examined, removing, at the processor, the first population from the prioritized queue.

11. The method of claim 1 , wherein the at least one prioritization criterion comprises at least one time period.

12. The method of claim 1 , wherein the data portion is a data file.

13. The method of claim 1 , wherein the data portion is a fragment of an unallocated space data.

14. The method of claim 1 , wherein the data portion is a data chunk.

15. A non-transitory computer-readable medium storing computer program instructions, the instructions executable by a processor to perform a method of investigating at least one data storage device to locate suspect data portions portions on the at least one data storage device, the method comprising:

determining, at a processor, a prioritized queue of populations of data to be searched for the suspect data portions on at least one data storage device, the prioritized queue of populations determined based on at least one prioritization criterion, a first population of the prioritized queue of populations having the closest match with the at least one prioritization criterion, the first population being located on the at least one data storage device;

accessing, at the processor, a first data portion of the first population on the at least one data storage device;

examining, at the processor, the first data portion to determine whether the first data portion includes content-specific data matching at least one suspect criterion, the at least one suspect criterion including a threshold of skin tone pixels, and the examining including determining whether the first data portion meets the threshold of skin tone pixels; and

if it is determined that the first data portion includes the content-specific data matching the at least one suspect criterion, then:

identifying, via the processor, the first data portion as a suspect data portion; and

recovering, via the processor, the first data portion at the at least one data storage device.