Phone Home Servlet in a Computer Investigation System
First Claim
1. In a data communications network including a server, an examining device, and a target device, a method for conducting forensic investigations of the target device over the data communications network, the method comprising:
- periodically receiving from the target device a request for connection, the request including identification information for the target device;
establishing connection with the target device in response to the request;
determining, in response to the connection with the target device, whether a request to investigate the target device is pending from the examining device; and
providing data for establishing a secure communication link between the examining device and the target device in response to the determination that the request to investigate is pending, the examining device being configured to forward an investigation command via the established secure communication link and receive an output from the target device via the secure communication link responsive to the investigation command.
7 Assignments
0 Petitions
Accused Products
Abstract
A system for conducting forensic investigations is provided which includes a target device, an examining device, and a server. The target device includes a phone home servlet which is configured to periodically transmit to the server a request for connection. The server grants the request for connection if there is an investigation request pending from the examining device for the requesting target device. If no such request is pending, the request is denied. The servlet is programmed with various phone home parameters for determining whether the target device should transmit the request for connection.
99 Citations
19 Claims
-
1. In a data communications network including a server, an examining device, and a target device, a method for conducting forensic investigations of the target device over the data communications network, the method comprising:
-
periodically receiving from the target device a request for connection, the request including identification information for the target device; establishing connection with the target device in response to the request; determining, in response to the connection with the target device, whether a request to investigate the target device is pending from the examining device; and providing data for establishing a secure communication link between the examining device and the target device in response to the determination that the request to investigate is pending, the examining device being configured to forward an investigation command via the established secure communication link and receive an output from the target device via the secure communication link responsive to the investigation command. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A server coupled to an examining device and a target device over a data communications network for conducting forensic investigations of the target device, the server comprising:
-
a processor; and a memory operably coupled to the processor and storing program instructions therein, the processor being operable to execute the program instructions, the program instructions including; periodically receiving from the target device a request for connection, the request including identification information for the target device; establishing connection with the target device in response to the request; determining, in response to the connection with the target device, whether a request to investigate the target device is pending from the examining device; and providing data for establishing a secure communication link between the examining device and the target device in response to the determination that the request to investigate is pending, the examining device being configured to forward an investigation command via the established secure communication link and receive an output from the target device via the secure communication link responsive to the investigation command. - View Dependent Claims (9, 10, 11)
-
-
12. An examining device coupled to a server and a target device over a data communications network for conducting forensic investigations of the target device, the examining device comprising:
-
a processor; and a memory operably coupled to the processor and storing program instructions therein, the processor being operable to execute the program instructions, the program instructions including; establishing a first connection with the server; transmitting to the server a request to investigate the target device, the request including identification information for the target device; waiting for the target device to establish a second connection with the server, the target device being configured to transmit a connection request to the server for establishing the second connection; establishing a secure communication link with the target device in response to the target device establishing the second connection with the server; transmitting an investigation command to the target device via the established secure communication link; and receiving an output from the target device via the secure communication link responsive to the investigation command. - View Dependent Claims (13, 14)
-
-
15. A target device coupled to a server and an examining device over a data communications network for being investigated by the examining device, the target device comprising:
-
a processor; and a memory operably coupled to the processor and storing program instructions therein, the processor being operable to execute the program instructions, the program instructions including; determining whether it is time to connect to the server; determining connection to the data communications network; transmitting a request to connect to the server if it is time to connect to the server and it is connected to the data communications network; and receiving a grant to the request to connect if a request from the examining device to investigate the target device is pending at the server. - View Dependent Claims (16, 17, 18, 19)
-
Specification