Obtaining Complete Forensic Images Of Electronic Storage Media

• US 20100241977A1
• Filed: 03/18/2010
• Published: 09/23/2010
• Est. Priority Date: 03/20/2009
• Status: Active Grant

• Current Assignee: HSSK Forensics, Inc. (Ricoh Company Limited)
• Original Assignee: HSSK Forensics, Inc. (Ricoh Company Limited)
• Inventors: Greetham, David A.
• Granted Patent: US 9,087,207 B2
• Time in Patent Office: Days
• US Class Current: 715/764
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/0673 Single storage device
• CPC Class Codes: G06Q 50/00 Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism healthcare informatics G16H
• CPC Class Codes: G06Q 50/18 Legal services
• CPC Class Codes: G06Q 50/184 Intellectual property management

Abstract

In a method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media is part of a computer system. The method includes the steps of: (a) storing a data collection program on an external storage device; (b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device; (c) requiring the custodian to connect the external storage device to a computer system containing the storage media; (d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data; (e) authenticating the forensic image; and (f) preserving an exact copy of the forensic image without making changes to the forensic image.

Claims

1. A method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media being part of a computer system, the method comprising the steps of:

(a) storing a data collection program on an external storage device;

(b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device;

(c) requiring the custodian to connect the external storage device to a computer system containing the storage media;

(d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data;

(e) authenticating the forensic image; and

(f) preserving an exact copy of the forensic image without making changes to the forensic image.

2. The method according to claim 1, further including, after the step of connecting the external storage device to a computer system, requiring the custodian to enter his name and email address.

3. The method according to claim 1, further including, after the step of asking the custodian to enter his name and email address, then requiring the custodian to select which electronic storage media to image.

4. The method according to claim 1, further including, in the step of storing a data collection program on an external storage device, also encrypting the external storage device.

5. The method according to claim 1, further including, in the step of storing a data collection program on an external storage device, setting the switches on the data collection program to designate which storage media inside the computer system, or attached to the computer system, are to be forensically imaged.

6. The method according to claim 1, wherein the step of using the data collection program to forensically collect the electronic data further includes preventing the custodian from deselecting certain files, and preventing the custodian from deleting and spoiling data.

7. The method according to claim 1, wherein the step of storing a data collection program on an external storage device includes setting software switches in the data collection program so that the subsequent step of authenticating the forensic image includes collecting the following data into a file for later review:

(a) the make and model of the computer system;

(b) the make and model of the computer system'"'"'s storage media that was imaged;

(c) the size and available capacity of that storage media;

(d) the operating system install date and time;

(e) the user log on statistics; and

(f) the attached devices.

8. A computer-readable, encrypted portable data storage device encoded with a computer program containing a method of obtaining from a custodian of electronic data a complete forensic image of an electronic storage media containing the electronic data, the storage media being part of a computer system, the method comprising the steps of:

(a) creating a sector-by-sector forensic image of the storage media by calling a data collection program;

(b) storing the forensic image on the portable data storage device;

(c) verifying the integrity of the forensic image;

(d) performing an audit of the forensic image, and storing the resulting information in a file on the portable data storage device;

(e) displaying a message advising the custodian that (i) the process is completed, and (ii) the portable data storage device can now be disconnected from the computer system; and

(f) preserving an exact copy of the forensic image without making changes to the forensic image.

9. The portable data storage device according to claim 8, wherein the step of creating a sector-by-sector forensic image further includes preventing the custodian from deselecting certain files, and preventing the custodian from deleting and spoiling data.

10. The method according to claim 8, wherein the step of storing the forensic image further includes storing the forensic image in 2 GB files (or selected chunk size by the forensic expert) on the portable data storage device.

11. The method according to claim 8, wherein the step of verifying the integrity of the forensic image further includes verifying the integrity of the forensic image using a hash algorithm.

12. The method according to claim 8, wherein the step of verifying the integrity of the forensic image further includes verifying the integrity of the forensic image using an MD5 hash algorithm.

13. The portable data storage device according to claim 8, wherein the step of performing an audit includes collecting the following data into a file:

(a) the make and model of the computer system;

(b) the make and model of the computer system'"'"'s storage media that was imaged;

(c) the size and available capacity of that storage media;

(d) the operating system install date and time;

(e) the user log on statistics; and

(f) the attached devices.