CONFIGURABLE INVESTIGATIVE TOOL

• US 20120210427A1
• Filed: 02/10/2011
• Published: 08/16/2012
• Est. Priority Date: 02/10/2011
• Status: Active Grant

• Current Assignee: Architecture Technology Corporation
• Original Assignee: Architecture Technology Corporation
• Inventors: Bronner, Derek P., Joyce, Robert A., Donovan, Matthew P., Baker, Julia A.
• Granted Patent: US 10,057,298 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

This disclosure provides example techniques to invoke one or more tools, with an investigative tool. The investigative tool provides a common framework that allows investigators to invoke their own trusted tools or third-party generated tools. The investigative tool described herein seamlessly and transparently invokes the tools in accordance with an investigative profile created by the investigator.

Claims

1. A method comprising:

storing an investigative profile that identifies a plurality of tools and defines a manner in which an investigative tool invokes the identified tools for an investigation of a target computing device;

configuring the investigative tool on an investigative device for the investigation based on the investigative profile to provide a common execution framework for selective execution of the plurality of tools identified by the investigative profile;

transferring, with the investigative device upon execution of the investigative tool, one or more of the identified tools and a remote agent to the target computing device;

executing, with the investigative device upon execution of the investigative tool, the remote agent on the target computing device to execute the identified tools on the target computing device in the manner defined by the investigative profile; and

receiving, with the investigative tool executing on the investigative device, data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile.

2. The method of claim 1, wherein the investigative profile comprises a first investigative profile, the plurality of tools comprise a first plurality of tools, and the investigation of the target computing device comprises a first investigation of a first target computing device, the method further comprising:

storing a second investigative profile that identifies a second plurality of tools and defines a manner in which the investigative tool invokes the second plurality of tools for a second investigation of a second target computing device; and

configuring the investigative tool for the second investigation based on the second investigative profile.

3. The method of claim 1, wherein the investigative profile identifies the plurality of tools and defines the manner in which the investigative tool invokes the identified tools for an investigation of a plurality of target computing devices, and wherein the target computing device is one of the plurality of target computing devices.

4. The method of claim 3, wherein the investigative profile defines whether the investigation of the plurality of target computing devices occurs sequentially or in parallel.

5. The method of claim 1, wherein the manner in which the investigative tool invokes the identified tools comprises defining, with the investigative profile, at least one of a sequence in which the investigative tool executes the one or more identified tools, a duration of the investigation of the target computing device, and a frequency of the investigation of the target computing device.

6. The method of claim 5, wherein the frequency of the investigation comprises real-time monitoring of the target computing device.

7. The method of claim 1, wherein executing the remote agent comprises temporarily invoking a service that includes the remote agent on the target computing device.

8. The method of claim 1, wherein receiving data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile comprises receiving at least one of encrypted and compressed data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile.

9. The method of claim 1, wherein receiving data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile comprises receiving the acquired data in raw format or extensible markup language (XML) format.

10. The method of claim 1, wherein the manner in which the investigative tool invokes the identified tools comprises defining actions to be performed when the investigative tool encounters an error on the target computing device.

11. The method of claim 1, wherein storing the investigative profile comprises at least one of a user pre-building the investigative profile and the user building the investigative profile after execution of the investigative tool.

12. The method of claim 1, further comprising:

deleting, after receiving the data acquired from the target computing device, the transferred identified tools, the remote agent, and a temporary directory within the target computing device where the transferred tools and the remote agent are temporarily stored.

13. The method of claim 1, wherein the investigation comprises at least one of a forensic examination, a monitoring and detection of an intrusion agent, and a monitoring of content on the target computing device.

14. An investigative device comprising:

a storage device that stores an investigative profile that identifies a plurality of tools and defines a manner in which an investigative tool invokes the identified tools for an investigation of a target computing device; and

a hardware unit that executes the investigative tool to;

configure the investigative tool for the investigation based on the investigative profile to provide a common execution framework for selective execution of the plurality of tools identified by the investigative profile;

transfer one or more of the identified tools and a remote agent to the target computing device;

execute the remote agent on the target computing device to execute the identified tools on the target computing device in the manner defined by the investigative profile; and

receive data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile.

15. The investigative device of claim 14, wherein the investigative profile comprises a first investigative profile, the plurality of tools comprise a first plurality of tools, and the investigation of the target computing device comprises a first investigation of a first target computing device, wherein the storage device stores a second investigative profile that identifies a second plurality of tools and defines a manner in which the investigative tool invokes the second plurality of tools for a second investigation of a second target computing device, and wherein the hardware unit that executes the investigative tool configures the investigative tool for the second investigation based on the second investigative profile.

16. The investigative device of claim 14, wherein the investigative profile identifies the plurality of tools and defines the manner in which the investigative tool invokes the identified tools for an investigation of a plurality of target computing devices, and wherein the target computing device is one of the plurality of target computing devices.

17. The investigative device of claim 16, wherein the investigative profile defines whether the investigation of the plurality of target computing devices occurs sequentially or in parallel.

18. The investigative device of claim 14, wherein the investigative profile defines at least one of a sequence in which the investigative tool executes the one or more identified tools, a duration of the investigation of the target computing device, and a frequency of the investigation of the target computing device.

19. The investigative of claim 18, wherein the frequency of the investigation comprises real-time monitoring of the target computing device.

20. The investigative device of claim 14, wherein the investigative tool temporarily invokes a service that includes the remote agent on the target computing device to execute the remote agent.

21. The investigative device of claim 14, wherein the investigative tool receives at least one of encrypted and compressed data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile.

22. The investigative device of claim 14, wherein the investigative tool receives the acquired data in raw format or extensible markup language (XML) format.

23. The investigative device of claim 14, wherein the manner in which the investigative tool invokes the identified tools comprises defining actions to be performed when the investigative tool encounters an error on the target computing device.

24. The investigative device of claim 14, wherein the investigative profile stored in the storage device comprises at least one of a user pre-built investigative profile and an investigative profile built by the user after execution of the investigative tool.

25. The investigative device of claim 14, wherein, after the hardware unit receives the data acquired from the target computing device, the investigative tool deletes the transferred identified tools, the remote agent, and a temporary directory within the target computing device where the transferred tools and the remote agent are temporarily stored.

26. The investigative device of claim 14, wherein the investigation comprises at least one of a forensic examination, a monitoring and detection of an intrusion agent, and a monitoring of content on the target computing device.

27. A non-transitory computer-readable storage medium comprising instructions that cause one or more processors to:

store an investigative profile that identifies a plurality of tools and defines a manner in which an investigative tool invokes the identified tools for an investigation of a target computing device;

configure the investigative tool for the investigation based on the investigative profile to provide a common execution framework for selective execution of the plurality of tools identified by the investigative profile;

transfer, upon execution of the investigative tool, one or more of the identified tools and a remote agent to the target computing device;

execute, upon execution of the investigative tool, the remote agent on the target computing device to execute the identified tools on the target computing device in the manner defined by the investigative profile; and

receive, with the investigative tool, data acquired from the target computing device by the execution of the identified tools in the manner defined by the investigative profile.

28. The non-transitory computer-readable storage medium of claim 27, wherein the computer-readable storage medium comprises a computer-readable storage medium that a user inserts or attaches into the target computing device.