Back to results
US 11,057,438 B1Granted
Configurable investigative tool
AssigneeArchitecture Technology Corporation
InventorsDerek P. Bronner, Robert A. Joyce, Matthew P. Donovan, Julia A. Baker
Life of this patent
Estimating the term…
Abstract
This disclosure provides example techniques to invoke one or more tools, with an investigative tool. The investigative tool provides a common framework that allows investigators to invoke their own trusted tools or third-party generated tools. The investigative tool described herein seamlessly and transparently invokes the tools in accordance with an investigative profile created by the investigator.
Claims21
A method comprising:
- presenting, with an investigative device, a user interface configured to receive input, from a user, that specifies a plurality of different investigative profiles, each of the investigative profiles identifying a plurality of tools, defining a sequence in which the tools are to be invoked by an investigative device for an investigation of a target computing device, and defining a reporting structure of data collected from the investigation, wherein at least two of the plurality of tools are configured to acquire different types of data from the target computing device as part of the investigation of the target computing device, wherein each of the investigative profiles comprises a plurality of labels, wherein at least one of the labels includes a plurality of tags, wherein the plurality of tags includes a first tag that specifies which tools are to be executed, a second tag indicative of command-line arguments for executing the tools, and a third tag that indicates files needed by the tools specified in the first tag;
- generating and storing, in response to the input, the plurality of investigative profiles, wherein one or more of the investigative profiles are non-executable data configuration information files arranged as text that specifies the plurality of tools, define the sequence in which the tools are to be invoked by the investigative device for the investigation of the target computing device, and define the reporting structure of data collected from the investigation, wherein at least two of the investigative profiles specify different sequences for invoking the tools, wherein the plurality of tools includes a first tool and a second tool, and wherein a first investigative profile specifies the first tool and not the second tool, and a second investigative profile specifies the second tool and not the first tool;
- receiving a selection of one of the investigative profiles;
- configuring, responsive to the selection of one of the investigative profiles, an investigative tool on the investigative device for execution, on the target computing device, with the plurality of tools identified by the selected investigative profile to allow for collection of all desired data with one investigation of the target computing device and reporting of the collected data in the reporting structure defined by the selected investigative profile, wherein the investigative tool is configurable to operate in accordance with any of the plurality of investigative profiles;
- and
- performing the investigation with the configured investigative tool.
3 more elements
An investigative device comprising:
- a storage device;
- and
- a hardware unit configured to:
- generate a plurality of different investigative profiles based on input, received from a user, via a presented user interface, that specifies the plurality of different investigative profiles, each of the investigative profiles identifying a plurality of tools, defining a sequence in which the tools are to be invoked by an investigative device for an investigation of a target computing device, and defining a reporting structure of data collected from the investigation, wherein at least two of the plurality of tools are configured to acquire different types of data from the target computing device as part of the investigation of the target computing device, wherein one or more of the investigative profiles are non-executable data configuration information files arranged as text that specifies the plurality of tools, define the sequence in which the tools are to be invoked by the investigative device for the investigation of the target computing device, and define the reporting structure of data collected from the investigation, and wherein at least two of the investigative profiles specify different sequences for invoking the tools, wherein each of the investigative profiles comprises a plurality of labels, wherein at least one of the labels includes a plurality of tags, wherein the plurality of tags includes a first tag that specifies which tools are to be executed, a second tag indicative of command-line arguments for executing the tools, and a third tag that indicates files needed by the tools specified in the first tag;
- store, in response to the input, the plurality of investigative profiles in the storage device;
- receive a selection of one of the investigative profiles;
- configure, responsive to the selection of one of the investigative profiles, an investigative tool on the investigative device for execution, on the target computing device, with the plurality of tools identified by the selected investigative profile to allow for collection of all desired data with one investigation of the target computing device and reporting of the collected data in the reporting structure defined by the selected investigative profile, wherein the investigative tool is configurable to operate in accordance with any of the plurality of investigative profiles;
- and
- perform the investigation with the configured investigative tool.
6 more elements
A non-transitory computer-readable storage medium comprising instructions that cause one or more processors of an investigative device to:
- generate a plurality of different investigative profiles based on input, received from a user, via a presented user interface, that specifies the plurality of different investigative profiles, each of the investigative profiles identifying a plurality of tools, defining a sequence in which the tools are to be invoked by an investigative device for an investigation of a target computing device, and defining a reporting structure of data collected from the investigation, wherein at least two of the plurality of tools are configured to acquire different types of data from the target computing device as part of the investigation of the target computing device, wherein one or more of the investigative profiles are non-executable data configuration information files arranged as text that specifies the plurality of tools, define the sequence in which the tools are to be invoked by the investigative device for the investigation of the target computing device, and define the reporting structure of data collected from the investigation, and wherein at least two of the investigative profiles specify different sequences for invoking the tools, wherein each of the investigative profiles comprises a plurality of labels, wherein at least one of the labels includes a plurality of tags, wherein the plurality of tags includes a first tag that specifies which tools are to be executed, a second tag indicative of command-line arguments for executing the tools, and a third tag that indicates files needed by the tools specified in the first tag;
- store, in response to the input, the plurality of investigative profiles in a storage device;
- receive a selection of one of the investigative profiles;
- configure, responsive to the selection of one of the investigative profiles, an investigative tool on the investigative device for execution, on the target computing device, with the plurality of tools identified by the selected investigative profile to allow for collection of all desired data with one investigation of the target computing device and reporting of the collected data in the reporting structure defined by the selected investigative profile, wherein the investigative tool is configurable to operate in accordance with any of the plurality of investigative profiles;
- and
- perform the investigation with the configured investigative tool.
3 more elements
Dependencies are inferred from the claim text.