Method and apparatus for controlling digital evidence

• US 20080098219A1
• Filed: 04/10/2007
• Published: 04/24/2008
• Est. Priority Date: 10/19/2006
• Status: Abandoned Application

• Current Assignee: Sumo Logic, Inc.
• Original Assignee: DF Labs
• Inventors: Forte, Dario V.
• Application Number:
  US11/784,794
• Publication Number:
  US 20080098219A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 50/18 Legal services
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method and apparatus for controlling digital evidence comprising creating a case record comprising information about an investigative case, electronically storing at least one piece of digital evidence into memory, and associating the stored at least one piece of evidence with the case record.

Claims

1. A method for controlling digital evidence, comprising:

creating a case record comprising information about an investigative case;

electronically storing at least one piece of digital evidence in memory; and

associating the stored at least one piece of evidence with the case record.

2. The method of claim 1 wherein the electronically storing the at least one piece of evidence further comprises creating a clone of the at least one piece of evidence.

3. The method of claim 2 wherein the creating a clone step further comprises generating a hash of the clone and the at least one piece of evidence.

4. The method of claim 3 wherein the hash is an MD5 hash.

5. The method of claim 1 wherein the case record is created in a relational database.

6. The method of claim 1 wherein the electronically storing the at least one piece of evidence further comprises creating an image of the at least one piece of evidence.

7. The method of claim 1 further comprising establishing roles for each person in a plurality of persons that are able to access the case record, where each role defines a level of access.

8. The method of claim 1 further comprising creating a unique identifier for the at least one piece of evidence.

9. The method of claim 1 wherein the at least one piece of evidence is at least one of contents of a digital media, a log file and a network dump.

10. The method of claim 1 further comprising uploading photographic evidence to the case record.

11. The method of claim 1 further comprising creating a timeline within the case record comprising a sequence of events that occurred during an investigation involving the at least one piece of evidence.

12. The method of claim 1 further comprising creating a chain of custody within the case record comprising identification of persons that have accessed the case record and interacted with the at least one piece of evidence.

13. The method of claim 1 further comprising storing cost information in the case record.

14. The method of claim 1 further comprising selectably creating at least one report regarding the case record.

15. Apparatus for controlling at least one piece of digital evidence, comprising:

a computer for establishing a case record within a database, where the case record comprises at least one piece of digital evidence and case information;

a memory, coupled to the computer, for storing the case record; and

at least one client workstation, coupled to the computer, for allowing the case record to be accessed during an investigation.

16. The apparatus of claim 15 wherein the computer creates a clone or image of the at least one piece of digital evidence.

17. The apparatus of claim 15 wherein the at least one piece of digital evidence is at least one of contents of a digital media, a log file and a network dump.

18. A computer readable medium comprising software that, when executed by a processor, causes the processor to perform a method comprising:

creating a case record comprising information about an investigative case;

electronically storing at least one piece of digital evidence on a digital media; and

associating the stored at least one piece of evidence with the case record.

19. The computer readable medium of claim 18 wherein the electronically storing step further comprises creating either a clone or an image of the at least one piece of digital evidence.

20. The computer readable medium of claim 18 further comprising tracking access to the case record.