System and method for data preservation and retrieval

• US 8,793,278 B2
• Filed: 03/28/2011
• Issued: 07/29/2014
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Frazier, Matthew, Shiffer, Jason, Merkel, David, Mandia, Kevin, Pepe, Matthew
• Primary Examiner(s): Mofiz, Apu
• Assistant Examiner(s): Khoshnoodi, Fariborz
• Application Number:
  US13/073,357
• Publication Number:
  US 20110173213A1
• Time in Patent Office: 1,219 Days
• Field of Search: 707/781, 707/791
• US Class Current: 707/781
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

Claims

1. A method for gathering data comprising:

searching for storage devices coupled to a computer environment by communicating with an agent discovery service;

receiving from the agent discovery service network configuration information for enabling communication with at least one of the storage devices;

authenticating the at least one of the storage devices based on a first predetermined criterion;

searching the authenticated at least one of the storage devices for data;

sorting the data using a second predetermined criterion;

binding matching data to an entity that collected the matching data; and

presenting a user with a list of sorted data.

2. The method of claim 1 wherein the computer environment is a network.

3. The method of claim 1 wherein the first predetermined criterion is a digital certificate.

4. The method of claim 1 wherein the first predetermined criterion is a public key.

5. The method of claim 1 further comprising determining whether the user is authorized to access the storage devices.

6. The method of claim 1 wherein the storage devices are disk drives.

7. The method of claim 1 wherein the second predetermined criterion comprises a file type.

8. The method of claim 1 wherein the second predetermined criterion comprises data created by an application defined by the user.

9. The method of claim 1 wherein the second predetermined criterion comprises the at least one of the storage devices upon which the data was found.

10. The method of claim 1 further comprising allowing the user to define the first predetermined criterion.

11. The method of claim 1 wherein the second predetermined criterion is metadata.

12. The method of claim 1 wherein the first predetermined criterion is a plurality of criteria.