Systems and methods for enterprise-wide data identification data sharing and management

• US 20070085711A1
• Filed: 12/23/2005
• Published: 04/19/2007
• Est. Priority Date: 10/19/2005
• Status: Active Grant

• Current Assignee: ADA Solutions Incorporated (Surewerx, Inc.)
• Original Assignee: Advanced Digital Forensic Solutions, Inc.
• Inventors: Bousquet, Raphael, Wallia, J.J.
• Granted Patent: US 7,941,386 B2
• Time in Patent Office: Days
• US Class Current: 341/50
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method of automatically identifying relevant or suspect data during a digital forensic investigation is described. Software accepts as input raw data which are extracted from various digital data sources. The software or digital forensic and data identification application determines to which one or more identification modules the unknown raw data should be delivered to for processing. This determination is based on the type of data in the extracted raw data coming into the application. Suspect or relevant data that are identified includes that data that are identical to or similar to the extracted unknown raw data. If there are suspect data, the application transmits a message or alert to interested parties or stores the findings/report on an a storage device. In this manner, the suspect data are identified automatically, without intervention by a human being. The identification modules are invoked in a search markup language interpreter and the one or more identification modules are expressed in a search markup language specifically for digital forensics and receives parameters from the search language for processing.

Claims

1. A method of automatically identifying relevant data during a digital forensic investigation, the method comprising:

extracting raw data from one or more digital data sources, thereby producing extracted unknown raw data;

determining which ones of a plurality of one or more identification modules, the unknown raw data should be delivered to for processing wherein the determination is based on categories of data comprising the extracted unknown raw data;

within the determined ones of the identification modules, any relevant data in the extracted unknown raw data, wherein relevant data are one of data identical to and similar to the extracted unknown raw data; and

transmitting a signal if there is any suspect data, whereby relevant data are identified are automatically, without intervention by a human being.

2. A method as recited in claim 1 wherein the one or more identification modules are invoked in a search language interpreter.

3. A method as recited in claim 1 wherein the one or more identification modules are expressed in a search language specifically for digital forensics and receives parameters from the search language for processing.