System and method for collecting electronic evidence data

• US 20040006588A1
• Filed: 07/08/2002
• Published: 01/08/2004
• Est. Priority Date: 07/08/2002
• Status: Active Grant

• Current Assignee: DTI of Washington LLC
• Original Assignee: John H. Jessen
• Inventors: Jessen, John H.
• Granted Patent: US 7,370,072 B2
• Time in Patent Office: Days
• US Class Current: 709/202
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising

Abstract

A system and method for automatically locating, identifying, and collecting electronic evidence data stored in a number of computers. In one embodiment, a method of the present invention collects electronic evidence data from a plurality of computers and stores the collected data on a server. The method first provides an agent software application to the plurality of computers. The agent software application is configured and arranged with predefined criteria that allows the agent software application to identify data that is characteristic of electronic evidence. The agent software application is also configured and arranged to transmit the identified data to the server. In response to receiving the identified data, the server stores the identified data on a memory device of the server.

Claims

1. A method for collecting electronic evidence data from one or more computers, wherein the method comprises:

providing an agent software application to the one or more computers, wherein the agent software application includes criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured to transmit the identified electronic evidence data to the server;

executing the agent software application on at least one computer, wherein the execution of the agent software application identifies data that is characteristic of electronic evidence;

transmitting the identified data from at least one computer executing the agent software application to the server;

receiving the identified data at the server, wherein the identified data is received from at least one computer executing the agent software application; and

storing the identified data on a memory device of the server.

2. The method of claim 1, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a data file name.

3. The method of claim 1, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a plurality of keywords.

4. The method of claim 1, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a variable indicative of a predetermined time period in which the data files were last modified.

5. The method of claim 1, wherein the predefined criteria is configured to identify data that is characteristic of electronic data by the use of a variable indicative of a predetermined time period in which the data files were created.

6. The method of claim 1, wherein the identified data is a list of files stored on a memory device on at least one computer.

7. The method of claim 1, wherein the agent software application is provided to the one or more computers by transmitting the agent software application in an email sent from the server to the one or more computers.

8. The method of claim 1, wherein the agent software application is provided to the one or more computers by transmitting the agent software application from the server to the one or more computers by the use of a file transfer protocol.

9. The method of claim 1, wherein the agent software application is configured and arranged to automatically execute at a first predetermined time, and wherein the agent software application is configured and arranged to transmit the identified data at a second predetermined time.

10. The method of claim 1, wherein the agent software application is configured to transmit the identified data by:

transmitting the identified data from at least one computer to the server;

determine if the transmission of the identified data has failed;

if the transmission of the identified data has failed, terminate the transmission of the identified data; and

retransmit the of the identified data from at least one computer to the server at a predetermined time.

11. A computer-readable medium containing computer-readable instructions which, when executed by a computer, perform the method of claim 1.

12. A method for collecting electronic evidence data from a computer, wherein the method comprises:

obtaining an agent software application, wherein the agent software application includes predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured to transmit the identified data to a server;

executing the agent software application; and

transmitting the identified data from the computer to the server.

13. The method of claim 12, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a file name.

14. The method of claim 12, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a plurality of predefined keywords.

15. The method of claim 12, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a variable indicative of a predetermined time period in which the data files were last modified.

16. The method of claim 12, wherein the predefined criteria is configured to identify data that is characteristic of electronic evidence by the use of a variable indicative of a predetermined time period in which the data files were created.

17. The method of claim 12, wherein the specific data is a list of files stored on a memory device on at least one computer of the plurality of computers.

18. The method of claim 12, wherein the agent software application is provided to the plurality of computers by transmitting the agent software application in an email sent from the server to the plurality of computers.

19. The method of claim 12, wherein the agent software application is provided to the plurality of computers by transmitting the agent software application from the server to the plurality of computers by the use of a file transfer protocol.

20. The method of claim 12, wherein the agent software application is configured to automatically execute at a first predetermined time, and wherein the agent software application is configured and arranged to transmit the identified data at a second predetermined time.

21. The method of claim 12, wherein the agent software application is configured to transmit the identified data by:

transmitting the identified data from the computer to the server;

determine if the transmission of the identified data has failed;

if the transmission of the identified data has failed, terminate the transmission of the specific data; and

retransmit the of the identified data from the computer to the server at a predetermined time.

22. A computer-readable medium containing computer-readable instructions which, when executed by a computer, perform the method of claim 12.

23. A computer system for collecting electronic evidence on a server from a plurality of computers, wherein the computer system comprises:

means for providing an agent software application to the plurality of computers, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the server;

means for executing the agent software application on at least one computer of the plurality of computers;

means for receiving the identified data at the server, wherein the identified data is received from at least one computer of the plurality of computers; and

means for storing the identified data on a memory device of the server.

24. A computer system for collecting electronic evidence on a server from a computer, wherein the computer system comprises:

means for receiving an agent software application, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the server;

means for executing the agent software application; and

means for transmitting the identified data from the computer to the server.

25. A computer-readable medium having computer-executable components for collecting electronic evidence data, wherein the components comprise:

a template data component operable to define a criterion that instructs a software application to identify and collect information describing a plurality of hardware components of a computer executing the software application;

an identification data component operable to define a criterion that instructs a software application to access secured data stored in the computer executing the software application; and

a transfer data component operable to define a criterion that instructs a software application to transmit the secured data stored in the computer and the data that is identified in the template component.

26. The computer-readable medium of claim 25, further comprising a scheduling data component operable to define a criterion that instructs a software application to transfer the secured data stored in the computer and the data that is identified in the template component in accordance with a predetermined time period.

27. A computer system comprising a plurality of computers and a collection server, wherein the computer system is configured for collecting electronic evidence data from the plurality of computers and storing the electronic evidence data on the collection server, the system comprises:

means for generating an agent software application, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the collection server;

means for transmitting the agent software application to the plurality of computers;

means for executing the agent software application, wherein the execution of the agent software application produces identified data that is characteristic of electronic evidence; and

means for transmitting the identified data from the plurality of computers to the collection server.

28. A method for collecting electronic evidence data from a computer, wherein the method comprises:

obtaining an agent software application, wherein the agent software application includes predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured to transmit the identified data to a server;

executing the agent software application; and

storing the identified data on a computer-readable medium.