# US 12,182,153 B2 · Digital forensics tool and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,153 B2
- Document ID: US12182153B2
- Status: Granted
- Kind: B2
- Application number: 17/865,216
- Filed: 2022-07-14
- Published: 2023-01-26
- Granted: 2024-12-31
- Earliest claimed: 2021-07-15
- Assignees: Magnet Forensics Inc.
- Applicants: Grayshift, LLC
- Inventors: Robert Palazzo; Kerry Armistead; Andrea Dickerson; Justin Fisher; David Miles; David Smalley; Braden Thomas; Philip Thrasher
- Web page: https://patentgrep.com/patent/US12182153B2

## CPC

- G06F 16/254: {Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses}
- G06Q 50/265: {Personal security, identity or safety}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A digital forensics tool and associated method are disclosed for extracting digital data from a user computing device, transforming and analyzing the digital data, and generating an interactive user interface that facilitates the identification of important digital data, such as for a criminal investigation.

## Claims

### Claim 1

A digital forensics method comprising:
coupling one or more extraction computing devices to one or more mobile devices;
extracting, by the one or more extraction computing devices, a first set of digital data from the one or more mobile devices;
filtering, by the one or more extraction computing devices, the first set of digital data into a second set of digital data comprising one or more flat text files and not including certain types of data in the first set of digital data;
receiving, by a cloud server from the one or more extraction computing devices, the second set of digital data;
transforming, by the cloud server, the second set of digital data into a third set of digital data of a normalized format;
analyzing, by the cloud server, the third set of digital data to generate results; and
generating a user interface, on a user computing device, to display one or more of an interactive map derived from location data in the results, a timeline of communications to or from the one or more mobile devices contained in the results, and a network graph indicating relationships between contacts in the results and frequency of communications with contacts in the results.

### Claim 2 (depends on 1)

The method of claim 1, wherein the extracting is performed by one or more extraction computing devices connected to the one or more mobile devices.

### Claim 3 (depends on 1)

The method of claim 1, wherein the extracting is performed by a software agent installed on the one or more mobile devices.

### Claim 4 (depends on 1)

The method of claim 1, wherein the filtering prioritizes a type of data in the first set of digital data in response to a command entered by a user.

### Claim 5 (depends on 1)

The method of claim 1, wherein the transforming step comprises:
automatically parsing data in the second set of data from files and databases associated with one or more applications into the normalized format independent of source.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
recording the location of the first set of digital data within the one or more mobile devices during the filtering step and recording all transformations of data during the transforming step.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
providing access to the results and some or all of the second set of digital data to one or more additional user computing devices.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
storing contact information identified in the third set of digital data into a database.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
cross-referencing data in the database with contact information obtained from one or more other mobile devices.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
generating an alert when the third set of digital data contains contact information previously flagged by a user computing device.

### Claim 11 (depends on 1)

The method of claim 1, wherein the user interface comprises an interactive interface allowing actions comprising changing time scales, filtering content by source, zooming in and out of maps, and scrolling through sequential photos.

### Claim 12 (depends on 1)

The method of claim 1, wherein the analyzing comprises identifying an individual using a plurality of forms of identification.

### Claim 13 (depends on 12)

The method of claim 12, wherein the plurality of forms of identification comprise two or more of first name, last name, nickname, phone number, email address, username, account ID, and device identifier.

### Claim 14 (depends on 1)

The method of claim 1, wherein the results comprise one or more pattern of life anomalies.

### Claim 15 (depends on 14)

The method of claim 14, wherein the one or more pattern of life anomalies comprise variations in typical locations, timing patterns, communications, and behaviors.

### Claim 16 (depends on 1)

The method of claim 1, wherein the generating further comprises displaying a timeline and displaying some or all of the results on the timeline.

### Claim 17 (depends on 1)

The method of claim 1, wherein the generating further comprises displaying a map showing a location of the one or more mobile devices using data from a plurality of sources.

### Claim 18 (depends on 1)

The method of claim 1, wherein the generating further comprises displaying media from a plurality of sources.

### Claim 19 (depends on 1)

The method of claim 1, wherein the generating further comprises displaying communications from a plurality of sources.

### Claim 20 (depends on 1)

The method of claim 1, wherein the results comprise one or more of device name, operating system version, model, serial number, and passcode.

### Claim 21

A digital forensics tool comprising:
one or more computing devices storing instructions to perform the following steps when executed:
extracting a first set of digital data from one or more mobile devices;
filtering the first set of digital data into a second set of digital data comprising one or more flat text files and not including certain types of data in the first set of digital data;
transforming the second set of digital data into a third set of digital data of a normalized format;
analyzing the third set of digital data to generate results; and
generating a user interface to display one or more of an interactive map derived from location data in the results, a timeline of communications to or from the one or more mobile devices contained in the results, and a network graph indicating relationships between contacts in the results and frequency of communications with contacts in the results.

### Claim 22 (depends on 21)

The digital forensics tool of claim 21, wherein the extracting is performed by one or more extraction computing devices connected to the one or more mobile devices.

### Claim 23 (depends on 21)

The digital forensics tool of claim 21, wherein the extracting is performed by a software agent installed on the one or more mobile devices.

### Claim 24 (depends on 21)

The digital forensics tool of claim 21, wherein the filtering prioritizes a type of data in the first set of digital data in response to a command entered by a user.

### Claim 25 (depends on 21)

The digital forensics tool of claim 21, wherein the transforming step comprises:
automatically parsing data in the second set of data from files and databases associated with one or more applications into the normalized format independent of source.

### Claim 26 (depends on 21)

The digital forensics tool of claim 21, wherein the one or more computing devices store instructions to perform the following step:
recording the location of the first set of digital data within the one or more mobile devices during the filtering step and recording all transformations of data during the transforming step.

### Claim 27 (depends on 21)

The digital forensics tool of claim 21, wherein the one or more computing devices store instructions to perform the following step:
providing access to the results and some or all of the second set of digital data to one or more additional user computing devices.

### Claim 28 (depends on 21)

The digital forensics tool of claim 21, wherein the one or more computing devices store instructions to perform the following step:
storing contact information identified in the third set of digital data into a database.

### Claim 29 (depends on 28)

The digital forensics tool of claim 28, wherein the one or more computing devices store instructions to perform the following step:
cross-referencing data in the database with contact information obtained from one or more other mobile devices.

### Claim 30 (depends on 21)

The digital forensics tool of claim 21, wherein the one or more computing devices store instructions to perform the following step:
generating an alert when the third set of digital data contains contact information previously flagged by a user computing device.

### Claim 31 (depends on 21)

The digital forensics tool of claim 21, wherein the user interface comprises an interactive interface allowing actions comprising changing time scales, filtering content by source, zooming in and out of maps, and scrolling through sequential photos.

### Claim 32 (depends on 21)

The digital forensics tool of claim 21, wherein the analyzing comprises identifying an individual using a plurality of forms of identification.

### Claim 33 (depends on 32)

The digital forensics tool of claim 32, wherein the plurality of forms of identification comprise two or more of first name, last name, nickname, phone number, email address, username, account ID, and device identifier.

### Claim 34 (depends on 21)

The digital forensics tool of claim 21, wherein the results comprise one or more pattern of life anomalies.

### Claim 35 (depends on 34)

The digital forensics tool of claim 34, wherein the one or more pattern of life anomalies comprise variations in typical locations, timing patterns, communications, and behaviors.

### Claim 36 (depends on 21)

The digital forensics tool of claim 21, wherein the generating further comprises displaying a timeline and displaying some or all of the results on the timeline.

### Claim 37 (depends on 21)

The digital forensics tool of claim 21, wherein the generating further comprises displaying a map showing a location of the one or more mobile devices using data from a plurality of sources.

### Claim 38 (depends on 21)

The digital forensics tool of claim 21, wherein the generating further comprises displaying media from a plurality of sources.

### Claim 39 (depends on 21)

The digital forensics tool of claim 21, wherein the generating further comprises displaying communications from a plurality of sources.

### Claim 40 (depends on 21)

The digital forensics tool of claim 21, wherein the results comprise one or more of device name, operating system version, model, serial number, and passcode.