SYSTEM AND METHOD FOR DIGITAL EVIDENCE ANALYSIS AND AUTHENTICATION

• US 20160021044A1
• Filed: 09/28/2015
• Published: 01/21/2016
• Est. Priority Date: 04/22/2010
• Status: Active Grant

• Current Assignee: United States Postal Service (Government of the United States of America)
• Original Assignee: United States Postal Service (Government of the United States of America)
• Inventors: Hermitage, Suzanne, Nguyen, Steve D., Steadman, Jeffrey A., Privette, Kennon F., Picciano, Gerry, Padres, Jill
• Granted Patent: US 9,853,930 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 40/106 Display of layout of documents; Previewing
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

The system disclosed provides an efficient mechanism for acquiring email and other data from remote systems in a forensically sound manner. Email for users can be requested by investigators from email servers across the country. It is then be automatically acquired and made available to the examiner, subject to approval, and any others he deems have a need-to-know on a web based system. The data can be searched and bookmarked, and the bookmarks shared. Data can also be uploaded manually and combined with email data in the searching, bookmarking, and sharing.

Claims

1. A method for investigating data, the method comprising:

receiving a plurality of data files at a server from a first remote computing device associated with a first user, the data files including data concerning a plurality of email messages, the email messages each associated with a plurality of email users;

granting to a second remote computing device associated with a second user access to the data files received from the first remote computing device;

receiving from the second remote computing device a selection of data concerning an email message from among the data concerning the plurality of email messages;

generating a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with the selected email message data; and

transmitting the graphical representation the email transmission relationships to the second remote computing device.

2. The method of claim 1, wherein the second user is an authorized examiner.

3. The method of claim 1, further comprising receiving from the second remote computing device a request to create a bookmark associated with at least one email transmission relationship from among the plurality of email transmission relationships represented in the graphical representation.

4. The method of claim 3, further comprising adding the requested bookmark associated with the email transmission relationship to the graphical representation.

5. The method of claim 4, further comprising transmitting the bookmarked graphical representation to the first remote computing device for subsequent review by the first user.

6. A non-transitory computer-readable storage medium having a computer program embodied thereon, the program executable to perform a method for investigating data, the method comprising:

receiving a plurality of data files at a server from a first remote computing device associated with a first user, the data files including data concerning a plurality of email messages, the email messages each associated with a plurality of email users;

granting to a second remote computing device associated with a second user access to the data files received from the first remote computing device;

receiving from the second remote computing device a selection of data concerning an email message from among the data concerning the plurality of email messages;

generating a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with the selected email message data; and

transmitting the graphical representation of the email transmission relationships to the second remote computing device.

7. The non-transitory computer-readable storage medium of claim 6, wherein the second user is an authorized examiner.

8. The non-transitory computer-readable storage medium of claim 6, wherein the method further includes receiving from the second remote computing device a request to create a bookmark associated with at least one email transmission relationship from among the plurality of email transmission relationships represented in the graphical representation.

9. The non-transitory computer-readable storage medium of claim 8, wherein the method further includes adding the requested bookmark associated with the email transmission relationship to the graphical representation.

10. The non-transitory computer-readable storage medium of claim 9, further comprising transmitting the bookmarked graphical representation to the first remote computing device for subsequent review by the first user.

11. A data investigation system, the system comprising:

a first remote computing device associated with a first user;

a second remote computing device associated with a second user, the second remote computing device communicatively coupled to the first remote computing device by a network; and

a server that receives a plurality of data files from the first remote computing device and executions instructions stored in memory, the server communicatively coupled to the first and second remote computing devices by the network, the data files including data concerning a plurality of email messages, and the email messages each associated with a plurality of email users, wherein execution of the instructions;

grants to the second remote computing device access to the data files received from the first remote computing device;

generates a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with a portion of selected email message data identified in a selection of data received from the second remote computing device; and

transmits the graphical representation of the email transmission relationships to the second remote computing device.

12. The system of claim 11, wherein the second user is an authorized examiner.

13. The system of claim 11, wherein the server further receives from the second remote computing device a request to create a bookmark associated with at least one email transmission relationship from among the plurality of email transmission relationships represented in the graphical representation.

14. The system of claim 13, wherein the server further adds the requested bookmark associated with the email transmission relationship to the graphical representation.

15. The system of claim 14, wherein the server further transmits the bookmarked graphical representation to the first remote computing device for subsequent review by the first user.