Ordering of event records in an electronic system for forensic analysis
First Claim
1. A method of ordering events captured by multiple forensic agents running in an electronic system, comprising:
- receiving, by a recording unit of the electronic system, multiple event records from the forensic agents, each event record including a set of timing information provided by the respective agent;
storing the event records in the recording unit in the order received;
resequencing the event records received by the recording unit based on the sets of timing information received from the forensic agents to at least partially reconstruct an order of events described in the event records across the forensic agents; and
storing the resequenced event records in the recording unit,wherein the recording unit and the forensic agents each receive periodic timestamps from a timestamp server,wherein at least one forensic agent stores an event in a vector clock that records receipt of at least one of the timestamps from the timestamp server, the vector clock established among the forensic agents, andwherein resequencing the event records received by the recording unit includes correcting for timing errors in the event records based on differences between timestamps reported in the vector clock and timestamps received by the recording unit.
9 Assignments
0 Petitions
Accused Products
Abstract
An improved technique for logging events in an electronic system for forensic analysis includes receiving event records by a recording unit from different forensic agents of the electronic system and applying timing information included within the event records to resequence the event records in the recording unit in a more accurate order. In some examples, the timing information includes a vector clock established among the agents of the electronic system for storing sequences of events. The vector clock provides sequence information about particular events occurring among the forensic agents, which is applied to correct the order of reported event records. In other examples, the timing information includes timestamps published to the agents from a common timestamp server. In yet other examples, the timing information includes timestamps of the devices on which the agents are running, or any combination of the foregoing examples of timing information.
269 Citations
20 Claims
-
1. A method of ordering events captured by multiple forensic agents running in an electronic system, comprising:
-
receiving, by a recording unit of the electronic system, multiple event records from the forensic agents, each event record including a set of timing information provided by the respective agent; storing the event records in the recording unit in the order received; resequencing the event records received by the recording unit based on the sets of timing information received from the forensic agents to at least partially reconstruct an order of events described in the event records across the forensic agents; and storing the resequenced event records in the recording unit, wherein the recording unit and the forensic agents each receive periodic timestamps from a timestamp server, wherein at least one forensic agent stores an event in a vector clock that records receipt of at least one of the timestamps from the timestamp server, the vector clock established among the forensic agents, and wherein resequencing the event records received by the recording unit includes correcting for timing errors in the event records based on differences between timestamps reported in the vector clock and timestamps received by the recording unit. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 20)
-
-
15. An apparatus for ordering events captured by multiple forensic agents running on an electronic system, comprising:
-
a set of processors; memory, coupled to the set of processors, the memory constructed and arranged to store instructions executable by the set of processors; and a recording unit coupled to the memory and the set of processors, wherein the set of processors executing instructions from the memory forms a specialized circuit constructed and arranged to; receive, by a recording unit of the electronic system, multiple event records from the forensic agents, each event record including a set of timing information provided by the respective agent; store the event records in the recording unit in the order received; resequence the event records received by the recording unit based on the sets of timing information received from the forensic agents to at least partially reconstruct an order of events described in the event records across the forensic agents; and store the resequenced event records in the recording unit, wherein the specialized circuit is further constructed and arranged to cause the recording unit and the forensic agents each to receive periodic timestamps from a timestamp server, wherein the specialized circuit is further constructed and arranged to cause at least one forensic agent to store an event in a vector clock that records receipt of at least one of the timestamps from the timestamp server, the vector clock established among the forensic agents, and wherein, when resequencing the event records received by the recording unit, the specialized circuitry is constructed and arranged to correct for timing errors in the event records based on differences between timestamps reported in the vector clock and timestamps received by the recording unit. - View Dependent Claims (16, 17)
-
-
18. A non-transitory computer readable medium including instructions which, when executed by a set of processors, cause the set of processors to perform a method for ordering events captured by multiple forensic agents running in an electronic system, the method comprising:
-
receiving, by a recording unit of the electronic system, multiple event records from the forensic agents, each event record including a set of timing information provided by the respective agent; storing the event records in the recording unit in the order received; resequencing the event records received by the recording unit based on the sets of timing information received from the forensic agents to at least partially reconstruct an order of events described in the event records across the forensic agents; and storing the resequenced event records in the recording unit, wherein the recording unit and the forensic agents each receive periodic timestamps from a timestamp server, wherein at least one forensic agent stores an event in a vector clock that records receipt of at least one of the timestamps from the timestamp server, the vector clock established among the forensic agents, and wherein resequencing the event records received by the recording unit includes correcting for timing errors in the event records based on differences between timestamps reported in the vector clock and timestamps received by the recording unit. - View Dependent Claims (19)
-
Specification