US 10,380,357 B1Granted

Forensic investigation tool

AssigneeUnited Services Automobile Association (USAA)

InventorJon D. McEachron

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and systems are disclosed a digital investigation tool capable of recovering and decrypting content. The tool combines digital techniques with decryption capability for a wide range of encryption algorithms. In one implementation, the tool identifies the type and/or vendor of the encryption algorithm used to protect the content. The tool then automatically obtains the decryption information needed to decrypt the content. Depending on the encryption algorithm used, the information may include a master key, user-specific keys, user IDs, passwords, and the like. The decryption information may be accumulated in a local or remote storage location accessible by the tool, or it may be acquired in real time on an as-needed basis from a third-party encryption vendor, a key server, and the like. Such an arrangement allows law enforcement agencies as well as corporate security personnel to quickly recover and decrypt content stored on a computer system.

Claims18

Dependent claims

A method comprising:

extracting, by at least one processing device, a content item from a non-transitory storage medium for conducting a digital investigation;
determining, by the at least one processing device, that the content item is encrypted;
identifying, by the at least one processing device, an encryption tool used in encrypting the content item based on a file format of the content item;
retrieving, by the at least one processing device, a decryption key for decrypting the content item based on the identified encryption tool, wherein the retrieving comprises:
obtaining, from data input into a plurality of fields on a website, (i) a first username of a first authenticator and a first authentication code corresponding to the first authenticator, and (ii) a second username of a second authenticator and a second authentication code corresponding to the second authenticator,
authenticating each of the first username of the first authenticator, the first authentication code corresponding to the first authenticator, the second username of the second authenticator and the second authentication code corresponding to the second authenticator,
responsive to the authenticating based on the data input into the plurality of fields of the website, accessing a repository of decryption information, the repository storing a plurality of decryption keys,
retrieving the decryption key from the accessed repository of decryption information based on the identified encryption tool, and
disabling a paste function of the at least one processing device to prevent storage of the retrieved decryption key in a permanent memory;
decrypting the encrypted content item using the retrieved decryption key;
and
searching the decrypted content item for evidence to be used in the digital investigation.

9 more elements

A system comprising:

at least one processing device;
and
a computer-readable medium coupled to the at least one processing device having instructions stored thereon which, when executed by the at least one processing device, cause the at least one processing device to perform operations comprising:
extracting a content item from a non-transitory storage medium for conducting a digital investigation;
determining that the content item is encrypted;
identifying an encryption tool used in encrypting the content item based on a file format of the content item;
retrieving a decryption key for decrypting the content item based on the identified encryption tool, wherein the retrieving comprises:
obtaining, from data input into a plurality of fields on a website, (i) a first username of a first authenticator and a first authentication code corresponding to the first authenticator, and (ii) a second username of a second authenticator and a second authentication code corresponding to the second authenticator,
authenticating each of the first username of the first authenticator, the first authentication code corresponding to the first authenticator, the second username of the second authenticator and the second authentication code corresponding to the second authenticator,
responsive to the authenticating based on the data input into the plurality of fields of the website, accessing a repository of decryption information, the repository storing a plurality of decryption keys,
retrieving the decryption key from the accessed repository of decryption information based on the identified encryption tool, and
disabling a paste function of the at least one processing device to prevent storage of the retrieved decryption key in a permanent memory;
decrypting the encrypted content item using the retrieved decryption key;
and
searching the decrypted content item for evidence to be used in the digital investigation.

12 more elements

A non-transitory computer-readable medium coupled to at least one processing device having instructions stored thereon which, when executed by the at least one processing device, cause the at least one processing device to perform operations comprising:

extracting, by the at least one processing device, a content item from a non-transitory storage medium for conducting a digital investigation;
determining that the content item is encrypted;
identifying an encryption tool used in encrypting the content item based on a file format of the content item;
retrieving a decryption key for decrypting the content item based on the identified encryption tool, wherein the retrieving comprises:
obtaining, from data input into a plurality of fields on a website, (i) a first username of a first authenticator and a first authentication code corresponding to the first authenticator, and (ii) a second username of a second authenticator and a second authentication code corresponding to the second authenticator,
authenticating each of the first username of the first authenticator, the first authentication code corresponding to the first authenticator, the second username of the second authenticator and the second authentication code corresponding to the second authenticator,
responsive to the authenticating based on the data input into the plurality of fields of the website, accessing a repository of decryption information, the repository storing a plurality of decryption keys,
retrieving the decryption key from the accessed repository of decryption information based on the identified encryption tool, and
disabling a paste function of the at least one processing device to prevent storage of the retrieved decryption key in a permanent memory;
decrypting the encrypted content item using the retrieved decryption key;
and
searching the decrypted content item for evidence to be used in the digital investigation.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/690,506Filed 30 Aug 2017 · continuation
Priority: 20 Sep 2007
Granted: 13 Aug 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 12/1408
Protection against unauthorised use of memory or access to memory: by using cryptography
G06F 21/105
Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]: arrangements for…
G06F 21/123
Restricting unauthorised execution of programs: by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global…

Family

Application11/858,801Parent of this continuation · filed 20 Sep 2007
Application14/665,011Parent of this continuation · filed 23 Mar 2015
US 8,990,583 B1Parent of this continuation · filed 24 Mar 2015
US 9,773,120 B1Parent of this continuation
US 10,380,357 B1This patent

From the US filing history. Foreign family members aren’t listed.