SYSTEM AND METHOD FOR DATA PRESERVATION AND RETRIEVAL

• US 20110173213A1
• Filed: 03/28/2011
• Published: 07/14/2011
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Frazier, Matthew, Shiffer, Jason, Mandia, Kevin, Merkel, David, Pepe, Matthew
• Granted Patent: US 8,793,278 B2
• Time in Patent Office: Days
• US Class Current: 707/752
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

Claims

1. A method for gathering data comprising:

(a) searching for storage devices coupled to a computer environment;

(b) authenticating storage devices based on a first predetermined criterion;

(c) searching authenticated storage devices for data;

(d) sorting the data using a second predetermined criterion;

(e) binding the matching data to an entity that collected the matching data; and

(f) presenting a user with a list of sorted data.

2. The method of claim 1 wherein the computer environment is a network.

3. The method of claim 1 wherein the first predetermined criterion is a digital certificate.

4. The method of claim 1 wherein the first predetermined criterion is a public key.

5. The method of claim 1 further comprising determining whether the user is authorized to access the storage devices.

6. The method of claim 1 wherein the storage devices are disk drives.

7. The method of claim 1 wherein the second predetermined criterion comprises a file type.

8. The method of claim 1 wherein the second predetermined criterion comprises data created by an application defined by the user.

9. The method of claim 1 wherein the second predetermined criterion comprises the storage devices upon which the data was found.

10. The method of claim 1 further comprising allowing the user to define the first predetermined criterion.

11. The method of claim 1 wherein the second predetermined criterion is metadata.

12. The method of claim 1 wherein the first predetermined criterion is a plurality of criteria.