SYSTEM AND METHOD FOR DIGITAL EVIDENCE ANALYSIS AND AUTHENTICATION

• US 20110264677A1
• Filed: 10/27/2010
• Published: 10/27/2011
• Est. Priority Date: 04/22/2010
• Status: Active Grant

• Current Assignee: United States Postal Service (Government of the United States of America)
• Original Assignee: United States Postal Service (Government of the United States of America)
• Inventors: Steadman, Jeffrey A., Picciano, Gerry, Padres, Jill, Nguyen, Steve D., Privette, Kennon F., Hermitage, Suzanne
• Granted Patent: US 9,147,003 B2
• Time in Patent Office: Days
• US Class Current: 707/758
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 40/106 Display of layout of documents; Previewing
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

The system disclosed provides an efficient mechanism for acquiring email and other data from remote systems in a forensically sound manner. Email for users can be requested by investigators from email servers across the country. It is then be automatically acquired and made available to the examiner, subject to approval, and any others he deems have a need-to-know on a web based system. The data can be searched and bookmarked, and the bookmarks shared. Data can also be uploaded manually and combined with email data in the searching, bookmarking, and sharing.

Claims

1. A method for acquiring email and other data from computers and providing a secure and productive environment for the investigation of that data comprising:

accepting, in a computer system, a request from a requester for a set of data files containing email for a first specific person;

accepting, in the computer system, a request from the requester for authorization for the request for the first set of data files;

transmitting the request for authorization to a set of authorizers;

receiving an authorization from one of the set of authorizers for the request for the first set of data files in response to the request for authorization, thereby creating a first authorization request;

transmitting the first authorization request over a data communications network to a first server system containing the first set of data files;

receiving the first set of data files over the data communications network from the first server system at the computer system in response to transmitting the first authorization request; and

making the first set of data files from the first server system available in the computer system to the requester as one of a set of authorized reviewers of the first set of data files.

2. The method in claim 1 wherein the first server system is an email server.

3. The method in claim 2 wherein:

the first server system is a Microsoft Exchange server; and

the first set of data files comprise a PST file containing at least one email message.

4. The method in claim 1 wherein:

the first set of data files are made available on a need-to-know basis.

5. The method in claim 1 which further comprises:

receiving a request from the requester to make the first set of data files available to at least one other user; and

making the first set of data files available to the at least one other user as one of the set of authorized reviewers in response to receiving the request from the requester.

6. The method in claim 1 which further comprises:

accepting a bookmark request for a selected file in the first set of data files by one of the set of authorized reviewers;

creating a bookmark in response to the bookmark request; and

sharing the bookmark with all of the set of authorized reviewers.

7. The method in claim 1 which further comprises:

verifying at least one unique identifier for the first set of data files received from the first server system before accepting them and making them available to the requester.

8. The method in claim 7 wherein:

the at least one unique identifier is a hash from a set consisting of MD5 and SHA1 hashes.

9. The method in claim 1 which further comprises:

calculating a unique identifier for each of the first set of data files; and

maintaining the unique identifier for each of the first set of data files in association with the file it uniquely identifies.

10. The method in claim 1 which further comprises:

accepting an association of the first set of data files with a specific case.

11. The method in claim 10 which further comprises:

receiving a request from the requester to make the specific case available to at least one other user; and

making the specific case and the first set of data files available to the at least one other users as one of a set of authorized reviewers in response to receiving the request from the requester.

12. The method in claim 10 wherein:

the first set of data files is required to be associated with the specific case before the first request for authorization is transmitted to the set of authorizers.

13. The method in claim 10 which further comprises:

accepting, in a computer system, a request from the requester for a second set of data files containing email for a second specific person;

accepting an association of the second set of data files with the specific case;

accepting, in the computer system, a request from the requester for authorization for the request for the second set of data files;

transmitting the request for authorization for the second set of data files to the set of authorizers;

receiving an authorization from one of the set of authorizers for the request for the second set of data files in response to the request for authorization, thereby creating a second authorization request;

transmitting the second authorization request over a data communications network to a second server system containing the second set of data files;

receiving the second set of data files over the data communications network from the second server system at the computer system in response to transmitting the second authorization request; and

making the second set of data files from the second server system available in the computer system to the requester as one of a set of authorized reviewers of the second set of data files.

14. The method in claim 13 wherein:

the first server system is a different server than the second server system.

15. The method in claim 10 which further comprises:

loading a second set of data files onto the computer system; and

making the second set of data files available in the computer system to the requester as one of a set of authorized reviewers of the second set of data files.

16. The method in claim 1 which further comprises:

receiving a search request for files from the first set of data files;

performing a search in response to receiving the search request; and

providing the requester results from the search comprising a set of selected files.

17. The method in claim 16 wherein:

the search performed can be a Boolean search; and

the search performed can be a natural language search.

18. The method in claim 16 which further comprises:

receiving a bookmark request for one of the set of selected files; and

recording a bookmark for the one of the set of selected files in response to the bookmark request.

19. The method in claim 18 which further comprises:

displaying a list of bookmarks including the bookmark recorded to the requester.

20. The method in claim 1 which further comprises:

identifying the first server system based on a location for email for the first specific person.

21. A system for acquiring email and other data from computers and providing a secure and productive environment for the investigation of that data comprising:

a computer processor;

a memory containing computer instructions executable by the computer processor for;

accepting a request from a requester for a set of data files containing email for a first specific person;

accepting a request from the requester for authorization for the request for the first set of data files;

transmitting the request for authorization to a set of authorizers;

receiving an authorization from one of the set of authorizers for the request for the first set of data files in response to the request for authorization, thereby creating a first authorization request;

transmitting the first authorization request over a data communications network to a first server system containing the first set of data files;

receiving the first set of data files over the data communications network from the first server system in response to transmitting the first authorization request; and

making the first set of data files from the first server system available in the computer system to the requester as one of a set of authorized reviewers of the first set of data files.

22. A computer readable medium containing computer executable instructions for acquiring email and other data from computers and providing a secure and productive environment for the investigation of that data, said computer executable instructions comprising computer instructions for:

accepting a request from a requester for a set of data files containing email for a first specific person;

accepting a request from the requester for authorization for the request for the first set of data files;

transmitting the request for authorization to a set of authorizers;

receiving an authorization from one of the set of authorizers for the request for the first set of data files in response to the request for authorization, thereby creating a first authorization request;

transmitting the first authorization request over a data communications network to a first server system containing the first set of data files;

receiving the first set of data files over the data communications network from the first server system in response to transmitting the first authorization request; and

making the first set of data files from the first server system available in the computer system to the requester as one of a set of authorized reviewers of the first set of data files.