Automated forensic document signatures
First Claim
Patent Images
1. A method of generating forensic evidence of a digital file, comprising:
- selecting a token indicating an informational object;
generating a digital fingerprint of the digital file using the selected token; and
creating the signature that includes the digital fingerprint and meta data of the digital file,wherein the informational object has semantic meanings, represents specific contents of the digital file and represents more information than a collection of computer-generated symbols, andwherein the signature is proactively generated for computer forensic evidence of the digital file and configured to allow a forensic analysis with the computer forensic evidence, andwherein a computer operation that changes the informational object causes proactive updating of the signature.
1 Assignment
0 Petitions
Accused Products
Abstract
Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Forensic signatures are created including a digital fingerprint and other information associated with a file. In one aspect, informational signatures are created, which may assist in determining what information is included in a file. In another aspect, the digital fingerprint may represent contents of the file and is resistant to minor modification of the file. In another aspect, fingerprints can be compared in parallel on different computers.
-
Citations
11 Claims
-
1. A method of generating forensic evidence of a digital file, comprising:
-
selecting a token indicating an informational object; generating a digital fingerprint of the digital file using the selected token; and creating the signature that includes the digital fingerprint and meta data of the digital file, wherein the informational object has semantic meanings, represents specific contents of the digital file and represents more information than a collection of computer-generated symbols, and wherein the signature is proactively generated for computer forensic evidence of the digital file and configured to allow a forensic analysis with the computer forensic evidence, and wherein a computer operation that changes the informational object causes proactive updating of the signature. - View Dependent Claims (7, 8)
-
-
2. A method of generating forensic evidence of a video, comprising
detecting scene changes of the video; -
segmenting the video into a plurality of segments corresponding to each scene change; extracting a representation from each segment forming a digital fingerprint based on the representations; and creating a signature by combining the digital fingerprint with predetermined metadata of the video, wherein the signature is proactively generated for computer forensic evidence of the video and configured to allow a forensic analysis with the computer forensic evidence, and wherein a computer operation the video causes proactive updating of the signature. - View Dependent Claims (3, 4, 5)
-
-
6. A method of generating forensic evidence for an audio file, comprising:
-
determining whether the audio includes music or speech; generating, if the audio includes speech, a transcript of the speech; extracting a representation from the transcript; forming a digital fingerprint based on the representation; and creating a signature by combining the digital fingerprint with predetermined metadata of the audio, wherein the signature is proactively generated for computer forensic evidence of the audio and configured to allow a forensic analysis with the computer forensic evidence, and wherein a computer operation that changes the audio file causes proactive updating of the signature.
-
-
9. A computer-readable non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence of a digital file, comprising :
-
selecting a token indicating an informational object; generating a digital fingerprint of the digital file using the selected token; and creating the signature that includes the digital fingerprint and meta data of the digital file, wherein the informational object has semantic meanings, represents specific contents of the digital file and represents more information than a collection of computer-generated symbols, and wherein the signature is proactively for computer forensic evidence of the digital file and configured to allow a forensic analysis with the computer forensic evidence, a computer operation that charges the informational object causes proactive updating of the signature.
-
-
10. A computer-readable non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence of a video, comprising:
-
detecting scene changes of the video; segmenting the video into a plurality of segments corresponding to each scene change; extracting a representation from each segment; forming a digital fingerprint based on the representation; and creating a signature by combining the digital fingerprint with predetermined metadata of the video, wherein the signature is proactively generated for computer forensic evidence of the video and configured to allow a forensic analysis with the computer forensic evidence, and a computer operation that changes the video causes proactive updating of the signature.
-
-
11. A computer-read-able non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence for an audio file, comprising:
-
determining whether the audio includes music or speech; generating, if the audio includes speech, a transcript of the speech; extracting a representation from the transcript; forming a digital fingerprint based on the representation; and creating a signature by combining the digital fingerprint with predetermined metadata of the audio, wherein the signature is proactively generated for computer forensic evidence of the audio and configured to allow a forensic analysis with the computer forensic evidence, a computer operation that changes the audio file causes proactive updating of the signature.
-
Specification