METHOD AND SYSTEM FOR COLLECTING AND ORGANIZING DATA CORRESPONDING TO AN EVENT

• US 20090198670A1
• Filed: 02/01/2008
• Published: 08/06/2009
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Butler, James, Villadsen, Peter, Helvey, Eric, Hogsten, Scott, Cunningham, Sean, Frazier, Matthew, Shiffer, Jason
• Granted Patent: US 8,949,257 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence

Abstract

A system and method for analyzing data from a plurality of computer environments. The computer environments are authenticated and data is imported to a memory location. The data is converted into a uniform format to enable expedited searching by one or more authenticated users. The data may be marked so that a user may determine which computer environment provided the data. The system may also create one or more indexes of the data to assist one or more users in searching the data.

Claims

1. A method of organizing and presenting data gathered in response to an event comprising:

(a) authenticating a plurality of memory sources;

(b) importing stored data from a plurality of memory sources into a first memory;

(c) converting the stored data into a specified format to produce uniform data;

(d) providing an interface to a user through which the user may access the uniform data; and

(e) presenting one or more subsets of the uniform data to the user in response to a request from the user.

2. The method of claim 1 wherein the plurality of memory sources are coupled to the first memory through a network.

3. The method of claim 1 wherein the plurality of memory sources are servers.

4. The method of claim 1 wherein the specified format is extensible markup language.

5. The method of claim 1 wherein the specified format is plain text format.

6. The method of claim 1 further comprising allowing the user to search the uniform data through the interface.

7. The method of claim 1 wherein the interface is provided on a computer coupled to a network and the first memory is also coupled to the network.

8. The method of claim 1 wherein the uniform data is stored in a database.

9. The method of claim 1 wherein the stored data comprises both content and metadata.

10. The method of claim 1 wherein the interface is provided to a plurality of users through a network.

11. A method of analyzing stored data comprising:

(a) searching for a plurality of storage devices coupled to a network;

(b) copying the stored data on the plurality of storage devices to a memory location;

(c) converting the stored data to uniform data comprising a single format;

(d) providing an interface to a user through which the user may access the uniform data; and

(e) presenting one or more subsets of the uniform data to the user in response to a request from the user.

12. The method of claim 11 wherein the plurality of storage devices comprise servers.

13. The method of claim 11 wherein the plurality of storage devices comprise disk drives.

14. The method of claim 11 wherein the memory location is a disk drive.

15. The method of claim 11 wherein the single format is extensible markup language.

16. The method of claim 11 further comprising presenting the user with a list of the plurality of storage devices coupled to the network and allowing the user to select which of the plurality of storage devices to copy stored data from.

17. The method of claim 11 further comprising presenting the user with a list of data types present on the plurality of storage devices coupled to the network and allowing the user to select which of the data types to copy.

18. The method of claim 17 wherein the list of data types comprises content and metadata.

19. The method of claim 11 further comprising adding the single format data to a database.

20. The method of claim 19 further comprising providing the user with access to the database through an interface.

21. A system for analyzing data comprising:

(a) means for searching a network for storage devices;

(b) means for identifying the storage devices to a user;

(c) means for allowing the user to choose selected storage devices;

(d) means for copying the data from the selected storage devices;

(e) means for converting the data to a converted data having a single format; and

(f) means for providing access to the user to the converted data for analysis.

22. A method of searching data using one or more indexes comprising:

(a) identifying a plurality of computer environments coupled to a network;

(b) searching the plurality of computer environments for data that matches a first predetermined criterion;

(d) copying the matching data to a memory location;

(e) converting the matching data to a uniform format;

(f) creating one or more indexes of the matching data; and

(g) providing an interface to a user that allows the user to search the matching data using the one or more indexes.

23. The method of claim 22 wherein the creating one or more indexes of the matching data comprises creating one or more search documents containing information about the matching data.

24. The method of claim 23 wherein the one or more search documents are created in a predetermined format.

25. The method of claim 24 wherein the search documents are stored in a database.

26. The method of claim 22 wherein creating one or more indexes of the matching data comprises searching the matching data for particular term and creating a search document including a list of documents containing the particular term.

27. The method of claim 26 wherein the list of documents containing the particular term further comprises the storage location of those documents.

28. The method of claim 26 wherein the one or more indexes rank a plurality of particular terms based on the relevance of the particular terms.

29. The method of claim 22 wherein the creating one or more indexes comprises creating an index of content and an index of metadata.

30. The method of claim 22 wherein the creating one or more indexes comprises indexing only a predetermined portion of a document.

31. The method of claim 30 wherein the predetermined portion comprises the title.

32. The method of claim 22 wherein the creating one or more indexes comprises indexing only a predetermined file type.

33. The method of claim 22 further comprising ranking documents in an index based on predetermined criteria.

34. The method of claim 33 wherein the predetermined criteria is the number of times a particular document has been viewed.

35. A method of searching files comprising:

(a) identifying a plurality of computer environments coupled to a network;

(b) searching the plurality of computer environments for files that match a predetermined criteria;

(c) converting matching files to a predetermined format;

(d) creating one or more indexes of the matching files; and

(e) providing an interface to a user allowing the user to search the matching files using the one or more indexes.

36. The method of claim 35 wherein the predetermined criteria is a file type.

37. The method of claim 35 wherein the one or more indexes comprises a content index.

38. The method of claim 37 wherein the one or more indexes comprises a metadata index.

39. The method of claim 35 wherein the index contains each word included in each file.

40. The method of claim 35 wherein the index includes predetermined terms.

41. The method of claim 40 wherein the index further includes each file containing predetermined terms and the storage location of that file.

42. The method of claim 35 wherein the creating one or more indexes of matching files comprises creating a search document for each matching file containing data about each matching file.

43. The method of claim 35 further comprising ranking terms in an index.

44. A system for searching data comprising:

(a) means for identifying a plurality of computer environments coupled to a network;

(b) means for searching the plurality of computer environments for data;

(d) means for copying the data to a memory location;

(e) means for creating one or more indexes of the data; and

(f) means for searching the data using the one or more indexes.

45. A method of collecting data comprising:

(a) identifying a plurality of computer environments coupled to a network;

(b) searching the plurality of computer environments for data that matches a first predetermined criterion;

(c) copying matching data to a memory location;

(d) creating one or more indexes of the matching data; and

(e) updating the indexes at a predetermined interval.

46. The method of claim 45 wherein the updating of the indexes comprises creating one or more new indexes based on recently discovered data.

47. The method of claim 45 wherein the updating the indexes comprises deleting one or more indexes based on recently deleted data.

48. The method of claim 45 wherein the updating the indexes comprises creating one or more new indexes based on one or more searches requested by a user.

49. The method of claim 45 wherein updating the indexes comprises deleting one or more indexes based on one or more searches requested by the user.

50. The method of claim 49 wherein the deleting one or more indexes based on one or more searches requested by the user comprises deleting one or more indexes if the indexes have not been utilized by the system within a predetermined period of time.

51. The method of claim 45 wherein updating the indexes at a predetermined interval comprises merging two or more indexes.

52. The method of claim 45 wherein updating the indexes at a predetermined interval comprises creating a temporary index for a new amount of data when the new amount of data has been detected during the searching of the plurality of computer environments.

53. The method of claim 52 wherein the temporary index is merged into a second index once the temporary index has reached a predetermined size.

54. The method of claim 52 wherein the temporary index is merged into a second index at a predetermined time interval.

55. The method of claim 45 wherein the predetermined interval is a time interval.

56. A method of searching for data in a computer environment comprising a number of storage devices, the method comprising:

(a) presenting a list of storage devices to a user;

(b) allowing the user to select storage devices;

(c) searching for stored data on the selected storage devices;

(d) creating a plurality of indexes of the stored data; and

(e) executing a search of the stored data based on the indexes.

57. The method of claim 56 further comprising allowing a user to define a criteria and searching only for stored data on the selected storage devices that meet the criteria.

58. The method of claim 56 further comprising copying the stored data to a single memory location.

59. The method of claim 56 wherein the plurality of indexes are tables which include a number of variables and the files in the stored data that correspond to the variables.

60. The method of claim 59 wherein the variables comprise file types.

61. The method of claim 59 wherein the variables comprise file creation dates.

62. The method of claim 59 wherein the tables further comprise the location of the stored data on the selected storage devices.

63. The method of claim 56 wherein the indexes are saved to a storage device.

64. The method of claim 56 wherein the indexes are periodically updated upon the discovery of a predetermined amount of unindexed data.

65. A system for collecting data comprising:

(a) means for identifying a plurality of computer environments coupled to a network;

(b) means for searching the plurality of computer environments for data that matches a first predetermined criterion;

(d) means for copying the matching data to a memory location;

(e) means for creating one or more indexes of the matching data; and

(f) means for updating the indexes at a predetermined interval.