SYSTEM AND METHOD FOR DATA PRESERVATION AND RETRIEVAL

• US 20090198689A1
• Filed: 02/01/2008
• Published: 08/06/2009
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant Corporation (Alphabet Inc.)
• Inventors: Frazier, Matthew, Shiffer, Jason, Mandia, Kevin, Merkel, David, Pepe, Matthew
• Granted Patent: US 7,937,387 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

Claims

1. A method of collecting data comprising:

(a) identifying a plurality of computer environments coupled to a network;

(b) searching the plurality of computer environments for data that matches a first predetermined criterion;

(c) presenting a list of the matching data to a user;

(d) binding the matching data to an identifier corresponding to an entity that collected the matching data; and

(e) copying the matching data to a memory location.

2. The method of claim 1 wherein the binding the matching data to an identifier further comprises authenticating the entity that collected the matching data.

3. The method of claim 2 wherein the authenticating the entity that collected the matching data is accomplished using a digital certificate.

4. The method of claim 1 further comprising receiving the first predetermined criterion from the user.

5. The method of claim 1 wherein the plurality of computer environments comprise servers.

6. The method of claim 1 wherein the plurality of computer environments comprise disk drives.

7. The method of claim 1 wherein the first predetermined criterion comprises a file type.

8. The method of claim 1 wherein the first predetermined criterion comprises metadata.

9. The method of claim 1 further comprising allowing the user to select which matching data is copied to the memory location.

10. The method of claim 1 further comprising presenting a list of computer environments coupled to the network to the user.

11. The method of claim 9 comprising allowing the user to copy matching data from only selected computer environments.

12. The method of claim 1 further comprising identifying only computer environments that match a second predetermined criterion specified by the user.

13. A method for gathering data comprising:

(a) searching for storage devices coupled to a computer environment;

(b) authenticating storage devices based on a first predetermined criterion;

(c) searching authenticated storage devices for data;

(d) sorting the data using a second predetermined criterion;

(e) binding the matching data to an entity that collected the matching data; and

(f) presenting a user with a list of sorted data.

14. The method of claim 13 wherein the computer environment is a network.

15. The method of claim 13 wherein the first predetermined criterion is a digital certificate.

16. The method of claim 13 wherein the first predetermined criterion is a public key.

17. The method of claim 13 further comprising determining whether the user is authorized to access the storage devices.

18. The method of claim 13 wherein the storage devices are disk drives.

19. The method of claim 13 wherein the second predetermined criterion comprises a file type.

20. The method of claim 13 wherein the second predetermined criterion comprises data created by an application defined by the user.

21. The method of claim 13 wherein the second predetermined criterion comprises the storage devices upon which the data was found.

22. The method of claim 13 further comprising allowing the user to define the first predetermined criterion.

23. The method of claim 13 wherein the second predetermined criterion is metadata.

24. The method of claim 13 wherein the first predetermined criterion is a plurality of criteria.

25. A system for gathering data comprising:

means for searching a computer network for storage devices;

means for authenticating the storage devices;

means for searching the storage devices for data that meets a defined criterion;

means for authenticating a user;

means for binding the data to an entity that collected the data;

means for presenting the user with a list of authenticated data;

means for copying the data to a memory location; and

means for converting the data into a uniform format.

26. The system of claim 25 wherein the means for authenticating the storage devices comprises utilizing a public key infrastructure.