SYSTEM AND METHOD FOR CONDUCTING SEARCHES AT TARGET DEVICES

• US 20110106852A1
• Filed: 01/10/2011
• Published: 05/05/2011
• Est. Priority Date: 06/20/2002
• Status: Active Grant

• Current Assignee: Open Text Holdings, Inc. (Open Text Corporation)
• Original Assignee: Guidance Software Incorporated (Open Text Corporation)
• Inventors: McCreight, Shawn, Garrett, Matthew, Weber, Dominik
• Granted Patent: US 9,350,532 B2
• Time in Patent Office: Days
• US Class Current: 707/780
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network.

Claims

1. In a networked computer investigation system including a client device and a target device, a method for conducting computer investigations of a storage device coupled to the target device, the method comprising:

identifying by the client device a file stored in the storage device;

transmitting to the target device a search key;

transmitting to the target device file extents associated with the identified file, wherein the target device, in response to receipt of the search key and the file extents, searches for the search key at portions of the data store corresponding to the file extents and generates a search result;

receiving the search result from the target device; and

displaying the search result on a display device.

2. The method of claim 1, wherein the search key is a keyword.

3. The method of claim 1, wherein the search key is a digital fingerprint.

4. The method of claim 1, wherein the storage device is a hard disk.

5. The method of claim 4, wherein the file extents identify sectors of the hard disk.

6. The method of claim 5, wherein the search result identifies one or more sectors of the hard disk producing a match of the search key.

7. The method of claim 1, wherein the search of the file extents avoids changing file stamps associated with the file.

8. The method of claim 1, wherein the search of the file extents avoids invoking operating system utilities of the target device.

9. In a networked computer investigation system, a client device for conducting computer investigations of a storage device coupled to a target device, the client device comprising:

a display device;

a processor;

a memory operably coupled to the processor and storing program instructions therein, the processor being operable to execute the program instructions, the program instructions including;

identifying a file stored in the storage device;

transmitting to the target device a search key;

transmitting to the target device file extents associated with the identified file, wherein the target device, in response to receipt of the search key and the file extents, searches for the search key at portions of the data store corresponding to the file extents and generates a search result;

receiving the search result from the target device; and

displaying the search result on the display device.

10. The client device of claim 9, wherein the search key is a keyword.

11. The client device of claim 9, wherein the search key is a digital fingerprint.

12. The client device of claim 9, wherein the storage device is a hard disk.

13. The client device of claim 12, wherein the file extents identify sectors of the hard disk.

14. The client device of claim 13, wherein the search result identifies one or more sectors of the hard disk producing a match of the search key.

15. The client device of claim 9, wherein the search of the file extents avoids changing file stamps associated with the file.

16. The client device of claim 9, wherein the search of the file extents avoids invoking operating system utilities of the target device.