System and method for conducting searches at target devices

• US 9,350,532 B2
• Filed: 01/10/2011
• Issued: 05/24/2016
• Est. Priority Date: 06/20/2002
• Status: Active Grant

• Current Assignee: Open Text Holdings, Inc. (Open Text Corporation)
• Original Assignee: Guidance Software Incorporated (Open Text Corporation)
• Inventors: McCreight, Shawn, Weber, Dominik, Garrett, Matthew
• Primary Examiner(s): KUDDUS, DANIEL A
• Application Number:
  US12/987,953
• Publication Number:
  US 20110106852A1
• Time in Patent Office: 1,961 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network.

Claims

1. In a networked computer investigation system including a client device coupled to a target device over a data communications network, a method for conducting computer investigations of a storage device coupled to the target device, the method comprising:

identifying by the client device a file stored in the storage device;

transmitting by the client device to an application in the target device over the data communications network, a search key;

transmitting by the client device to the application in the target device over the data communications network, file extents associated with the identified file, wherein the application in the target device, in response to receipt of the search key and the file extents, is configured to search for the search key at portions of the data store corresponding to the file extents and generate a search result based on the search;

receiving the search result from the application in the target device; and

displaying the search result on a display device.

2. The method of claim 1, wherein the search key is a keyword.

3. The method of claim 1, wherein the search key is a digital fingerprint.

4. The method of claim 1, wherein the storage device is a hard disk.

5. The method of claim 4, wherein the file extents identify sectors of the hard disk.

6. The method of claim 5, wherein the search result identifies one or more sectors of the hard disk producing a match of the search key.

7. The method of claim 1, wherein the search of the file extents avoids changing file stamps associated with the file.

8. The method of claim 1, wherein the search of the file extents avoids invoking operating system utilities of the target device.

9. The method of claim 1, wherein the client device and the target device each includes a separate processing unit, and the data communications network is a local area network, wide area network, or the Internet.

10. The method of claim 1, wherein the search result identifies a location of the storage device producing a match of the search key, the method further comprising:

transmitting by the client device to the application in the target device over the data communications network, in response to the receipt of the location, a command to get data stored in the identified location, wherein in response to the command, the application in the target device is configured to read data in the identified location and return the read data to the client device;

receiving by the client device over the data communications network, the data read by the application in the target device; and

examining the received data by the client device.

11. The method of claim 1, wherein the application in the target device is a servelet software.

12. In a networked computer investigation system, a client device for conducting, over a data communications network, computer investigations of a storage device coupled to a target device, the client device comprising:

a display device;

a processor;

a memory coupled to the processor and storing program instructions therein, the processor being configured to execute the program instructions, the program instructions including;

identifying a file stored in the storage device;

transmitting to an application in the target device over the data communications network, a search key;

transmitting to the application in the target device over the data communications network file extents associated with the identified file, wherein the application in the target device, in response to receipt of the search key and the file extents, is configured to search for the search key at portions of the data store corresponding to the file extents and generate a search result;

receiving the search result from the application in the target device; and

displaying the search result on the display device.

13. The client device of claim 12, wherein the search key is a keyword.

14. The client device of claim 12, wherein the search key is a digital fingerprint.

15. The client device of claim 12, wherein the storage device is a hard disk.

16. The client device of claim 15, wherein the file extents identify sectors of the hard disk.

17. The client device of claim 16, wherein the search result identifies one or more sectors of the hard disk producing a match of the search key.

18. The client device of claim 12, wherein the search of the file extents avoids changing file stamps associated with the file.

19. The client device of claim 12, wherein the search of the file extents avoids invoking operating system utilities of the target device.