Digital Evidence Bag
First Claim
1. A method of capturing digital data, the method comprising the steps of:
- copying digital data from a data source into one or more evidence files;
for each evidence file recording data descriptive of at least one of the source and the contents of the digital data in the evidence file;
recording, in a tag file, data indicative of provenance of the digital data in the one or more evidence files.
1 Assignment
0 Petitions
Accused Products
Abstract
Data structures, methods, programs for computers, apparatus and systems for capturing, and analysing digital data, especially in the context of digital evidence gathering and analysis. Digital evidence is captured in digital evidence bags having an index file and one or more evidence units, the evidence units each comprising an index file and an evidence file. The evidence files contain copies of raw captured data whilst the associated index files contain text details of the contents and structure of the evidence files. The tag file contains data descriptive of the source and/or provenance of the evidence units and/or the digital evidence bag as a whole. Index information and evidence data may be in the same or distinct files.
34 Citations
22 Claims
-
1. A method of capturing digital data, the method comprising the steps of:
-
copying digital data from a data source into one or more evidence files; for each evidence file recording data descriptive of at least one of the source and the contents of the digital data in the evidence file; recording, in a tag file, data indicative of provenance of the digital data in the one or more evidence files. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. Apparatus for capturing digital data, the apparatus comprising:
-
means for copying digital data from a data source into one or more evidence files; for each evidence file, means for recording data descriptive of at least one of the source and the contents of the digital data in the evidence file; means arranged to record, in a tag file, data indicative of provenance of the digital data in the one or more evidence files. - View Dependent Claims (15, 16, 17, 18)
-
-
14. A data structure for capturing digital data, the data structure comprising:
-
at least one evidence file for containing digital data copied from a data source; at least one index file containing data descriptive of at least one of the source and contents of the digital data in the at least one evidence files; a tag file containing data indicative of provenance of the digital data in the at least one evidence files. - View Dependent Claims (19, 20, 21)
-
-
22. (canceled)
Specification