Forensic system, forensic method, and forensic program

• US 8,799,317 B2
• Filed: 03/24/2011
• Issued: 08/05/2014
• Est. Priority Date: 03/29/2010
• Status: Active Grant

• Current Assignee: Ubic, Inc.
• Original Assignee: Ubic, Inc.
• Inventors: Morimoto, Masahiro, Shirai, Yoshikatsu, Takeda, Hideki
• Primary Examiner(s): PEACH, POLINA G
• Application Number:
  US13/514,966
• Publication Number:
  US 20120246185A1
• Time in Patent Office: 1,230 Days
• Field of Search: 707/603, 707/776
• US Class Current: 707/780
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: G06Q 50/10 Services
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

Embodiments of the inventive concept can extract digital document information related with a specific individual to achieve a work load reduction associated with evidentiary material preparation for litigation. A specific individual is selected from at least one individual included in user information. Only digital document information which was accessed by the specific individual is extracted based on access history information regarding the selected specific individual. Additional information indicating whether or not document files in the extracted digital document information are each related with the litigation is set, and a document file related with the litigation is outputted based on the additional information.

Claims

1. A forensic system configured to acquire digital information recorded on a plurality of computers or a server to analyze the acquired digital information, the forensic system comprising:

a digital information acquiring unit configured to acquire digital information containing digital document information composed of a plurality of document files, to acquire user information about users using the plurality of computers or the server, and to acquire access history information which shows a fact that the users accessed a document file recorded in the server;

a recording unit configured to record therein digital information acquired by the digital information acquiring unit;

a first display unit usable by a first operator configured to display the recorded digital information;

a second display unit usable by a second operator configured to display the recorded digital information;

a specific-individual selecting unit configured to select, via at least one of the first display unit or the second display unit, a specific first individual and a specific second individual from the users contained in the user information, wherein the first operator, the second operator, the specific first individual, and the specific second individual are different from each other;

a control unit including;

a digital document information extracting unit operable on a first server and configured to extract only digital document information which was accessed by the specific first individual and the specific second individual based on the access history information related with the selected specific first individual and the selected specific second individual;

a file analysis function configured to analyze a kind of document file which was accessed or possessed by the specific first individual and the specific second individual;

a kind selection function configured to cause the extraction unit to extract a particular kind of document file;

a preservation function configured to preserve the extracted document file as a separate file and to control the status thereof; and

a clock unit which, when newly acquiring digital information, is configured to clock a time and date of the acquisition of the digital information, the digital information further including folder information saving digital document information, wherein the digital information acquiring unit is configured to acquire the digital document information and the folder information which were produced after a time and date previously clocked by the clock unit, and wherein the digital information acquiring unit is configured to acquire user information and access history information related with the acquired digital document information and the folder information;

a first additional information setting unit usable by the first operator and a second additional information setting unit usable by the second operator configured to simultaneously set, via the first display unit and the second display unit, respectively, additional information indicating which document files in the extracted digital document information are each related with litigation, and which document files in the extracted digital document information are each not related with litigation;

the control unit further including;

a multi-language full-text searching unit operable on a second server and configured to perform a multi-language full-text search of the document files based on the extracted digital document information; and

a managing unit including an access right control function configured to set one or more rights for each account of a browser; and

an output unit configured to output a document file related with the litigation based on the additional information.

2. The forensic system according to claim 1, wherein

the digital information acquiring unit is configured to acquire second digital information including second digital document information, second user information and second access history information, the second digital information being recorded in a second server different from the server;

and

the forensic system is configured to use not only the digital information but also the second digital information, and to extract the second digital document information based on the second access history information.

3. The forensic system according to claim 1, further comprising:

a text information extracting unit configured to extract text information for each of the plurality of document files from the recorded digital document information;

a keyword selecting unit configured to select a keyword;

wherein;

the searching unit is configured to search a document file including the selected keyword based on the extracted text information, and

the first additional information setting unit and the second additional information setting unit are configured to set additional information to the searched document file.

4. The forensic system according to claim 1, further comprising:

a data converting unit configured to convert the document file in the digital document information recorded by the recording unit to a predetermined data format, wherein

the document file converted by the data converting unit is processed with the same data format as the converted data format in a period before being outputted by the output unit.

5. The forensic system according to claim 1, further comprising:

a statistical data producing unit configured to produce statistical data represented by data size for each data format of the acquired digital document information or statistical data represented by data size for each data format of the searched digital document information.

6. The forensic system according to claim 1, wherein

the forensic system further includes a plurality of servers,

the digital information extracting unit and the searching unit are separate from the servers, respectively, and

the separate digital information extracting unit, the searching unit, and the plurality of servers are connected to each other via a network.

7. The forensic system according to claim 1, wherein

the output unit is either one of a printer and a digital document producing device.

10. The forensic system according to claim 1, wherein the access right control function of the managing unit is configured to set a browser-only right.

11. The forensic system according to claim 1, wherein the access right control function of the managing unit is configured to set a manager right.

12. The forensic system according to claim 1, wherein the access right control function of the managing unit is configured to set an access right.

8. A forensic method for acquiring digital information recorded on a plurality of computers or a server to analyze the acquired digital information, the method comprising:

acquiring digital information containing digital document information composed of a plurality of document files, acquiring user information about users using the plurality of computers or the server, and acquiring access history information which shows a fact that the users accessed a document file recorded in the server;

recording the acquired digital information;

displaying, on a first display unit usable by a first operator, the recorded digital information;

displaying, on a second display unit usable by a second operator, the recorded digital information;

selecting, via at least one of the first display unit or the second display unit, a specific first individual and a specific second individual from the users contained in the user information, wherein the first operator, the second operator, the specific first individual, and the specific second individual are different from each other;

extracting, by an extracting unit operable on a first server, only digital document information which was accessed by the specific first individual and the specific second individual based on the access history information related with the selected specific first individual and the selected specific second individual;

analyzing, by a file analysis function, a kind of document file which was accessed or possessed by the specific first individual and the specific second individual;

causing the extraction unit, by a kind selection function, to extract a particular kind of document file;

preserving, by a preservation function, the extracted document file as a separate file and controlling the status thereof;

when newly acquiring digital information, clocking by a clock unit a time and date of the acquisition of the digital information, the digital information further including folder information saving digital document information;

acquiring, by the digital information acquiring unit, the digital document information and the folder information which were produced after a time and date previously clocked by the clock unit, and acquiring user information and access history information related with the acquired digital document information and the folder information;

simultaneously setting additional information, by a first additional information setting unit usable by the first operator via the first display unit and a second additional information setting unit usable by the second operator via the second display unit, indicating which document files in the extracted digital document information are each related with litigation, and which document files in the extracted digital document information are each not related with litigation;

searching, by a multi-language full-text searching unit operable on a second server, the full-text of the document files based on the extracted digital document information;

setting, by an access right control function of a managing unit, one or more rights for each account of a browser; and

outputting a document file related with the litigation based on the additional information.

13. The method of claim 8, wherein setting further includes setting a browser-only right.

14. The method of claim 8, wherein setting further includes setting a manager right.

15. The method of claim 8, wherein setting further includes setting an access right.

9. A non-transitory recording medium recording therein a forensic program which acquires digital information recorded on a plurality of computers or a server to analyze the acquired digital information, for causing a computer to execute:

a function of acquiring digital information containing digital document information composed of a plurality of document files, acquiring user information about users using the plurality of computers or the server, and acquiring access history information which shows a fact that the users accessed a document file recorded in the server;

a function of recording the acquired digital information;

a function of displaying, on a first display unit usable by a first operator, the recorded digital information;

a function of displaying, on a second display unit usable by a second operator, the recorded digital information;

a function of selecting, via at least one of the first display unit or the second display unit, a specific first individual and a specific second individual from the users contained in the user information, wherein the first operator, the second operator, the specific first individual, and the specific second individual are different from each other;

a function of extracting, by an extracting unit operable on a first server, only digital document information which was accessed by the specific first individual and the specific second individual based on the access history information related with the selected specific first individual and the selected specific second individual;

a function of analyzing, by a file analysis function, a kind of document file which was accessed or possessed by the specific first individual and the specific second individual;

a function of causing the extraction unit, by a kind selection function, to extract a particular kind of document file;

a function of preserving, by a preservation function, the extracted document file as a separate file and a function of controlling the status thereof;

when newly acquiring digital information, a function of clocking by a clock unit a time and date of the acquisition of the digital information, the digital information further including folder information saving digital document information;

a function of acquiring, by the digital information acquiring unit, the digital document information and the folder information which were produced after a time and date previously clocked by the clock unit, and a function of acquiring user information and access history information related with the acquired digital document information and the folder information;

a function of simultaneously setting additional information, by a first additional information setting unit usable by the first operator via the first display unit and a second additional information setting unit usable by the second operator via the second display unit, indicating which document files in the extracted digital document information are each related with litigation, and which document files in the extracted digital document information are each not related with litigation;

a function of searching, by a multi-language full-text searching unit operable on a second server, the full-text of the document files based on the extracted digital document information;

a function of setting, by an access right control function of a managing unit, one or more rights for each account of a browser; and

a function of outputting a document file related with the litigation based on the additional information.

16. The non-transitory recording medium of claim 9, wherein the function of setting further includes a function of setting a browser-only right.

17. The non-transitory recording medium of claim 9, wherein the function of setting further includes a function of setting a manager right.

18. The non-transitory recording medium of claim 9, wherein the function of setting further includes a function of setting an access right.