SYSTEMS AND METHODS FOR GRAPHICAL EXPLORATION OF FORENSIC DATA

• US 20180032518A1
• Filed: 09/15/2017
• Published: 02/01/2018
• Est. Priority Date: 05/20/2016
• Status: Active Grant

• Current Assignee: Royal Bank of Canada (The PNC Financial Services Group, Inc.)
• Original Assignee: Magnet Forensics Investco Incorporated
• Inventors: Kordasiewicz, Roman Czeslaw, MacKenzie, Michelle Elizabeth Allix, Windover, Jared Daniel, McIlveen, Samantha Jo
• Granted Patent: US 10,740,409 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/156 Query results presentation
• CPC Class Codes: G06F 16/338 Presentation of query results
• CPC Class Codes: G06F 16/367 Ontology
• CPC Class Codes: G06F 16/438 Presentation of query results
• CPC Class Codes: G06F 16/638 Presentation of query results
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/904 Browsing; Visualisation therefor for navigating the web G06F16/954; browsing optimisation for the web G06F16/957
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

Methods and apparatus for examining digital forensic data using a viewer computer. Forensic data collections are provided to the viewer computer, which can format the data artifacts according to a variety of display types and presentation formats, to facilitate review and reporting by a user. A relation graph presentation format is provided for visual exploration of data relationships.

Claims

1. A method of examining digital forensic data using a viewer computer comprising a memory and a processor, the digital forensic data extracted from at least one target device by a forensic data retrieval application, the method comprising:

receiving, at the viewer computer, a data collection generated by the forensic data retrieval application, the data collection comprising a plurality of data items extracted from the at least one target device;

scanning the data collection to identify a plurality of data artifacts; and

for a first artifact in the plurality of artifacts, determining a first attribute associated with the first artifact, and creating a first ontological set associated with the first attribute.

2. The method of claim 1, wherein the first artifact comprises an ontological definition, and wherein the first attribute is determined based on the ontological definition.

3. The method of claim 2, wherein the ontological definition comprises a subject definition, an object definition and a predicate definition.

4. The method of claim 3, wherein the first ontological set is identified as a subject ontological set, based on the subject definition.

5. The method of claim 4, further comprising determining a second attribute, and creating a second ontological set associated with the second attribute.

6. The method of claim 5, wherein the second ontological set is identified as an object ontological set, based on the object definition.

7. The method of claim 6, further comprising identifying a predicate association between the subject ontological set and the object ontological set.

8. The method of claim 7, wherein the second attribute comprises a plurality of discrete attributes, the method further comprising creating a plurality of normalized ontological sets corresponding to the plurality of discrete attributes, wherein each of the normalized ontological sets inherits the predicate association of the second attribute.

9. The method of claim 8, further comprising identifying at least one duplicate ontological set in the plurality of normalized ontological sets, and merging the at least one duplicate ontological set with a pre-existing ontological set.

10. The method of claim 5, wherein the second attribute is associated with the first artifact.

11. The method of claim 5, wherein the second attribute is associated with a second artifact.

12. The method of claim 1, further comprising:

providing a forensic data investigation application to the viewer computer;

receiving a selection of the first ontological set in the forensic data investigation application;

determining that the first ontological set is related to the plurality of ontological sets;

displaying the first ontological set and the plurality of ontological sets in an ontological display in a graphical user interface.

13. The method of claim 12, wherein each of the plurality of ontological sets are displayed respectively as nodes in a graph.

14. The method of claim 13, further comprising, for each respective set in the plurality of ontological sets, determining a respective relationship between the first ontological set and the respective set, and displaying a respective edge connecting the first ontological set and the respective set.

15. The method of claim 14, further comprising displaying a respective label corresponding to each respective edge.

16. The method of claim 14, wherein each respective relationship is determined based on the predicate relationship.

17. The method of claim 12, further comprising:

receiving a user selection of a selected ontological set in the plurality of ontological sets via the graphical user interface;

determining a second plurality of ontological sets, wherein each of the second plurality of ontological sets is related to the selected ontological set; and

displaying the second plurality of ontological sets in the ontological display.

18. The method of claim 17, further comprising, prior to receiving the user selection, adding the first ontological set to a visited collection and, after receiving the user selection, adding the selected ontological set to the visited collection.

19. The method of claim 18, further comprising:

prior to receiving the user selection of the selected ontological set, receiving a pinning command associated with a subset of the plurality of ontological sets to determine a pinned subset of ontological sets; and

following determining the second plurality of ontological sets, removing from the graphical user interface any of the plurality of ontological sets that are not also members of the pinned subset of ontological sets, the visited collection or the second plurality of ontological sets.

20. The method of claim 1, further comprising:

receiving at least one filter input via the graphical user interface;

filtering the graphical user interface based on the at least one filter input; and

displaying an active filter indication to indicate that the graphical user interface is filtered based on the at least one filter input.

21. The method of claim 20, wherein the filtering comprises:

determining a filter criteria based on the at least one filter input;

applying the filter criteria to the plurality of ontological sets; and

based on the application of the filter criteria, removing from display at least one filtered ontological set.

22. The method of claim 21, wherein the filtering further comprises:

receiving at least one additional filter input via the graphical user interface;

re-determining the filter criteria based on the at least one additional filter input;

re-applying the filter criteria to the plurality of ontological sets; and

based on the re-application of the filter criteria, re-displaying at least one ontological set.

23. The method of claim 12, further comprising:

receiving a user selection of a subset of ontological sets in the plurality of ontological sets via the graphical user interface;

receiving a merge command selection via the graphical user interface;

merging the subset of ontological sets into a merged ontological set; and

displaying the second plurality of ontological sets in the ontological display.

24. The method of claim 1, wherein the ontological definition is user-defined.

25. A non-transitory computer-readable medium storing computer-executable instructions, the instructions when executed by a computer processor for causing the computer processor to carry out the method of claim 1.

26. A viewer computer comprising a memory and a processor, the processor configured to carry out the method of claim 1.