System and method for data preservation and retrieval

• US 7,937,387 B2
• Filed: 02/01/2008
• Issued: 05/03/2011
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Mandiant Co.
• Inventors: Frazier, Matthew, Shiffer, Jason, Mandia, Kevin, Merkel, David, Pepe, Matthew
• Primary Examiner(s): Wong; Don
• Assistant Examiner(s): HO, BINH VAN
• Application Number:
  US12/024,827
• Publication Number:
  US 20090198689A1
• Time in Patent Office: 1,187 Days
• Field of Search: 707/722
• US Class Current: 707/722
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

Claims

1. A method of collecting data comprising:

receiving at a controller a request from a user to run a job on at least one of a plurality of computer environments coupled to a network;

responsive to receiving the request from the user, identifying, by the controller, the at least one of the plurality of computer environments coupled to a network for performing said job by communicating with an agent discovery service, wherein the plurality of computer environments transmits network configuration information to the agent discovery service in response to authenticating the agent discovery service to ensure it is within a proper trust domain;

responsive to the controller receiving network configuration information of the at least one of the plurality of computer environments from the agent discovery service, communicating between the controller and the at least one of the plurality of computer environments for executing said job which includes searching the at least one of the plurality of computer environments for data that matches a first predetermined criterion specified by the user;

presenting a list of the matching data to the user;

receiving a user selection of which of the matching data is copied to a memory location binding the matching data to an identifier corresponding to an entity that collected the matching data; and

copying the matching data to a memory location, wherein the user is allowed to copy matching data from only selected computer environments.

2. The method of claim 1 wherein the at least one of the plurality of computer environments authenticates the controller before executing said job.

3. The method of claim 2 wherein authenticating is accomplished using a digital certificate.

4. The method of claim 1 further comprising the controller interacts with at least one additional controller for performing said job.

5. The method of claim 4 wherein one of the controller or the at least one additional controller acts as a master controller that provides instructions for all subordinate controllers.

6. The method of claim 1 wherein the plurality of computer environments comprise disk drives.

7. The method of claim 1 wherein the first predetermined criterion comprises a file type.

8. The method of claim 1 wherein the first predetermined criterion comprises metadata.

9. The method of claim 1 further comprising presenting a list of computer environments coupled to the network to the user.

10. The method of claim 1 further comprising identifying only computer environments that match a second predetermined criterion specified by the user.