System and method for generating and storing forensics-specific metadata

A system for storing forensics-specific metadata, the system comprising:

• a hardware processor configured to:
• generate a backup of user data stored on a computing device in accordance with a backup schedule;
• identify, from a plurality of system metadata of the computing device, forensics-specific metadata of the computing device based on predetermined rules, wherein the forensics-specific metadata is utilized for detecting suspicious digital activity;
• generate a backup of the forensics-specific metadata in accordance with the backup schedule, wherein the backup of the forensics-specific metadata is stored separately from the backup of the user data;
• analyze the forensics-specific metadata for an indication of the suspicious digital activity on the computing device;
• in response to detecting the suspicious digital activity based on the analysis, generate a security event indicating that the suspicious digital activity has occurred and increase the frequency of the backup schedule;
• identify characteristics of the suspicious digital activity;
• identify enhanced forensics-specific metadata based on the characteristics, wherein the enhanced forensics-specific metadata comprises characteristic-specific details of the suspicious digital activity;
• perform at least one additional iteration of generating another backup of the enhanced forensics-specific metadata in accordance with the backup schedule;
• and
• analyze the enhanced forensics-specific metadata for additional information about the suspicious digital activity on the computing device to generate subsequent security events.

A non-transitory computer readable medium storing thereon computer executable instructions for storing forensics-specific metadata, including instructions for:

• generating a backup of user data stored on a computing device in accordance with a backup schedule;
• identifying, from a plurality of system metadata of the computing device, forensics-specific metadata of the computing device based on predetermined rules, wherein the forensics-specific metadata is utilized for detecting suspicious digital activity;
• generating a backup of the forensics-specific metadata in accordance with the backup schedule, wherein the backup of the forensics-specific metadata is stored separately from the backup of the user data;
• analyzing the forensics-specific metadata for an indication of the suspicious digital activity on the computing device;
• in response to detecting the suspicious digital activity based on the analysis, generating a security event indicating that the suspicious digital activity has occurred and increase the frequency of the backup schedule;
• identifying characteristics of the suspicious digital activity;
• identifying enhanced forensics-specific metadata based on the characteristics, wherein the enhanced forensics-specific metadata comprises characteristic-specific details of the suspicious digital activity;
• performing at least one additional iteration of generating another backup of the enhanced forensics-specific metadata in accordance with the backup schedule;
• and
• analyzing the enhanced forensics-specific metadata for additional information about the suspicious digital activity on the computing device to generate subsequent security events.