Systems and methods for digital forensic triage
Inventors
Frecks, JR., Austin P. • Curry, Anthony W. • Lynn, JR., Donald Gene • Bland, Christopher J.
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-9621597-B2
Publication Date
2017-04-11
Expiration Date
Abstract
In one embodiment, a method for forensic triage may include coupling, communicatively, a computer and a mobile device. The computer can be booted with machine readable instructions stored on the one or more mobile memory modules of the mobile device. A search data set can be received with one or more mobile processors of the mobile device. One or more processors of the computer, the one or more mobile processors, or both, can execute, automatically, the machine readable instructions stored on the one or more mobile memory modules of the mobile device to search one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The triage data can be transmitted via one or more communication modules of the mobile device.
Core Innovation
The invention provides a system for forensic triage that uses a mobile device and a cloud computing device to perform triage against a computer. The system includes a mobile device with one or more mobile processors, one or more mobile memory modules, and one or more communication modules, and a cloud computing device with one or more cloud processors and one or more cloud memory modules. A search data set is stored on the one or more mobile memory modules, the one or more cloud memory modules, or both, and machine readable instructions are stored on the mobile and/or cloud memory modules.
When the communication modules of the mobile device is communicatively coupled to a computer, the machine readable instructions configure the processors to boot the computer according to the machine readable instructions. The processors are also configured to search the one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The system further configures the processors to compare the triage data, the search data set, or both to a data archive that is protected by a firewall.
The system controls match-based access to the firewall-protected data archive by allowing the receipt of data indicative of a match between the triage data and the data archive, between the search data set and the data archive, or both. In addition, the system denies the receipt of predefined segments of the data archive. As refinements, the system can include synchronization of the search data set between mobile and cloud, and can associate image data with triage data stored in the mobile and/or cloud memory modules.
Claims Coverage
The patent includes one independent claim defining the core triage system, with dependent claims further specifying access control workflow, search-data synchronization, image-data association, and the composition of the search data set.
Mobile-cloud forensic triage system with stored search data set and executable boot and read-only memory search
A system for forensic triage comprising a mobile device with mobile processors, mobile memory modules, and communication modules; a cloud computing device with cloud processors and cloud memory modules; a search data set stored on the mobile memory modules, the cloud memory modules, or both; and machine readable instructions stored on the mobile memory modules, the cloud memory modules, or both, wherein the instructions configure processors to boot a computer and search memory modules in a read only mode for triage data that corresponds to the search data set.
Firewall-protected archive comparison with allow match and deny predefined segments
The system wherein cloud processors, mobile processors, or both execute the machine readable instructions to compare the triage data, the search data set, or both to a data archive protected by a firewall; allow receipt of data indicative of a match between the triage data and the data archive, the search data set and the data archive, or both; and deny receipt of predefined segments of the data archive.
Search data set synchronization across mobile and cloud memory modules
The system wherein cloud processors and/or mobile processors execute instructions to synchronize the search data set between one or more mobile memory modules and one or more cloud memory modules.
Associating image data with triage data
The system wherein cloud processors and/or mobile processors execute instructions to associate image data with triage data stored in the mobile memory modules and/or the cloud memory modules.
Search data set defined as keyword list, hash list, and system resource instance search list
The system wherein the search data set includes a keyword list of pluralities of keywords of interest, a hash list of pluralities of hashes based on a cryptographic hash function, and a search list including pluralities of identifiers for instances of a system resource.
Overall claim coverage centers on a mobile-and-cloud forensic triage workflow: booting a computer with machine readable instructions, performing a read-only memory search for triage data matching a stored search data set, and comparing results to a firewall-protected archive with match-only receipt and denial of predefined archive segments, with further refinements for synchronization, image-data association, and the composition of the search data set.
Stated Advantages
Allows receipt of data indicative of a match between the triage data and a firewall-protected data archive, the search data set and the data archive, or both.
Denies receipt of predefined segments of a firewall-protected data archive.
Associates image data with triage data stored in mobile memory modules and/or cloud memory modules.
Documented Applications
Digital forensic triage using a mobile device and cloud computing to search a computer’s memory/storage in a read only mode for triage data corresponding to a search data set, and to compare results to a firewall-protected data archive with controlled match-based receipt.
Coordinating a search data set across mobile memory modules and cloud memory modules via synchronization.
Associating image data with triage data collected/stored in the mobile device and/or cloud computing device.
Interested in licensing this patent?