Systems and methods for digital forensic triage

Inventors

Frecks, JR., Austin P. • Curry, Anthony W. • Lynn, JR., Donald G. • Bland, Christopher J.

Assignees

ACES AND EIGHTS CORP

Abstract

In one embodiment, a method for forensic triage may include coupling, communicatively, a computer and a mobile device. The computer can be booted with machine readable instructions stored on the one or more mobile memory modules of the mobile device. A search data set can be received with one or more mobile processors of the mobile device. One or more processors of the computer, the one or more mobile processors, or both, can execute, automatically, the machine readable instructions stored on the one or more mobile memory modules of the mobile device to search one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The triage data can be transmitted via one or more communication modules of the mobile device.

Core Innovation

The invention relates to digital forensic triage using a mobile device that boots a computer with machine-readable instructions stored on the mobile device. The mobile device is communicatively coupled to the computer, and the computer comprises one or more processors and memory modules, while the mobile device comprises one or more mobile processors, mobile memory modules, and one or more communication modules.

The method receives a search data set at the mobile device, where the search data set comprises a keyword list, a hash list, and a search list. The keyword list comprises keywords of interest, the hash list comprises hashes that correspond to output from a cryptographic hash function, and the search list comprises identifiers that correspond to an instance of a system resource.

The mobile device executes the machine-readable instructions to search memory modules of the computer in a read only mode for triage data that corresponds to the search data set. After the read only search, the mobile device couples to a cloud computing device over a cellular network and transmits the triage data via the mobile device communication modules over the cellular network.

Claims Coverage

The independent claim set includes one independent method claim. The inventive features center on booting a computer using machine-readable instructions stored on a mobile device, performing an automated read-only triage search in memory modules using a search data set containing keywords, hashes, and system-resource identifiers, and transmitting triage results to a cloud computing device over a cellular network.

Across the independent claim, the core coverage is the combination of mobile-device-controlled boot of the computer, automated read-only triage searching driven by a search data set comprising keywords, hashes, and system-resource identifiers, and transmission of resulting triage data to cloud computing devices over a cellular network. Dependent claims refine how triage data is stored and handled in mobile and cloud memory modules, add cloud-to-mobile pushing of search data sets, and introduce optional capture and association of image data with triage data.

Stated Advantages

Documented Applications