Back to results
US 11,895,125 B2Granted
Method and system for forensic data tracking
AssigneeQuickVault, Inc.
InventorsSteven V. Bacastow, Michael Royd Heuss
Life of this patent
Estimating the term…
Abstract
The present invention relates to a method and system for tracking the movement of data elements as they are shared and moved between authorized and unauthorized devices and among authorized and unauthorized users.
Claims30
A computing system comprising one or more network devices, the one or more network devices comprising one or more microprocessors and one or more memories that store executable instructions that, when executed by the one or more microprocessors, facilitate performance of operations, comprising:
- receiving meta data associated with an electronic file stored at an endpoint, the meta data comprising:
- one or more of a file name associated with the electronic file, a creation date on which the electronic file was created, a modification date on which the electronic file was modified, one or more data element tags, and
- an endpoint identifier that is indicative of the endpoint on which the electronic file is stored;
- analyzing the meta data based on one or more of a configured setting and a policy;
- determining, based on the analyzing of the meta data, a pattern of data use that constitutes a deviation from normal behavior, wherein the deviation from normal behavior is determined based on a detected significant number of new electronic files related to historical behavior for one or more of a user, a set of users, and the endpoint;
- and
- in response to determining the deviation from normal behavior, performing one or more responsive actions.
4 more elements
A method related to computing forensics, the method comprising:
- transmitting machine-executable instructions to one or more network devices comprising one or more processors and one or more memories, wherein the machine-executable instructions are stored in the one or more memories, and wherein the machine-executable instructions when executed by the one or more processors enable the one or more network devices to:
- receive meta data associated with an electronic file stored at an endpoint, the meta data comprising:
- one or more of a file name of the electronic file, a creation date on which the electronic file was created, a modification date on which the electronic file was modified, a data element tag, and
- an endpoint identifier that is usable to identify the endpoint on which the electronic file is stored;
- analyze the meta data based on one or more of a configured setting and a policy;
- determine a pattern of data activity that constitutes a deviation from a normal pattern of data activity, wherein the deviation from the normal pattern of data activity is determined by detecting a significant number of new electronic files compared to historical activity for one or more of a user, a set of users, and the endpoint;
- and
- perform one or more responsive actions related to determining the pattern of data activity that constitutes the deviation from the normal pattern of data activity.
5 more elements
Dependencies are inferred from the claim text.