US 12,314,227 B2Granted

Forensic file service

AssigneeCode42 Software, Inc.

InventorsChristopher Michael Montgomery, Peter John Lindquist, Brent Aethon McCullough, Vijay Ramanathan, Daniel Louis Sullivan

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A system for forensic file services is configured to receive data indicative of operations executed on a filesystem element stored on a computing resource associated with a first tenant, to and adjust the data according to an indicated database schema. The system is also configured to store the adjusted data in a record of a partition of a database, where the partition configured to store a history of operations executed on filesystem elements of computing resources associated with the first tenant. The system is further configured to receive a search request to search the database and to execute the search request on a second partition of the database to identify one or more matching records. The system is additionally configured to provide the identified records in response to the search request.

Claims15

Dependent claims

A system for forensic file services, the system comprising:

a computing device, comprising a hardware processor and a memory, the memory, storing instructions, which when executed by the hardware processor, causes the system to perform operations comprising:
receiving, over a network and from a monitoring application executing on a computing resource associated with a first tenant for forensic file services, data describing a filesystem element event corresponding to a particular filesystem element on the computing resource associated with the first tenant, the filesystem element event data describing a change to the particular filesystem element on a filesystem of the computing resource associated with the first tenant, and the filesystem element data including metadata of the particular filesystem element;
allocating the filesystem element event data to one of a plurality of parallel processing queues based upon an identifier of the computing resource;
determining that the filesystem element event corresponds to a deletion event;
responsive to determining that the filesystem element event corresponds to the deletion event, searching an event database for a last filesystem element event corresponding to that filesystem element and extracting a filesystem element signature including a hash of content of the particular filesystem element;
adding the filesystem element signature to the filesystem element event data to create enhanced filesystem element event data;
store the enhanced filesystem element event data in a database record of the event database in a partition configured to store a history of filesystem element events of a plurality computing resources associated with the first tenant;
receive a search request from a second computing device to search the event database, the search request comprising a search query and a tenant identifier of a second tenant;
execute the search query on a second partition of the event database to identify records that satisfy the search query, the second partition configured to store a history of filesystem element events of a plurality of computing resources associated with the second tenant;
and
provide the identified records in response to the search request.

8 more elements

A method comprising:

receiving, over a network and from a monitoring application executing on a computing resource associated with a first tenant for forensic file services, data describing a filesystem element event corresponding to a particular filesystem element on the computing resource associated with the first tenant, the filesystem element event data describing a change to the particular filesystem element on a filesystem of the computing resource associated with the first tenant, and the filesystem element data including metadata of the particular filesystem element;
allocating the filesystem element event data to one of a plurality of parallel processing queues based upon an identifier of the computing resource;
determining that the filesystem element event corresponds to a deletion event;
responsive to determining that the filesystem element event corresponds to the deletion event, searching an event database for a last filesystem element event corresponding to that filesystem element and extracting a filesystem element signature including a hash of content of the particular filesystem element;
adding the filesystem element signature to the filesystem element event data to create enhanced filesystem element event data;
storing the enhanced filesystem element event data in a database record of the event database in a partition configured to store a history of filesystem element events of a plurality computing resources associated with the first tenant;
receiving a search request from a second computing device to search the event database, the search request comprising a search query and a tenant identifier of a second tenant;
executing the search query on a second partition of the event database to identify records that satisfy the search query, the second partition configured to store a history of filesystem element events of a plurality of computing resources associated with the second tenant;
and
providing the identified records in response to the search request.

7 more elements

A machine-readable medium, storing instructions, which when executed by a machine, cause the machine to perform operations comprising:

receiving, over a network and from a monitoring application executing on a computing resource associated with a first tenant for forensic file services, data describing a filesystem element event corresponding to a particular filesystem element on the computing resource associated with the first tenant, the filesystem element event data describing a change to the particular filesystem element on a filesystem of the computing resource associated with the first tenant, and the filesystem element data including metadata of the particular filesystem element;
allocating the filesystem element event data to one of a plurality of parallel processing queues based upon an identifier of the computing resource;
determining that the filesystem element event corresponds to a deletion event;
responsive to determining that the filesystem element event corresponds to the deletion event, searching an event database for a last filesystem element event corresponding to that filesystem element and extracting a filesystem element signature including a hash of content of the particular filesystem element;
adding the filesystem element signature to the filesystem element event data to create enhanced filesystem element event data;
storing the enhanced filesystem element event data in a database record of the event database in a partition configured to store a history of filesystem element events of a plurality computing resources associated with the first tenant;
receiving a search request from a second computing device to search the event database, the search request comprising a search query and a tenant identifier of a second tenant;
executing the search query on a second partition of the event database to identify records that satisfy the search query, the second partition configured to store a history of filesystem element events of a plurality of computing resources associated with the second tenant;
and
providing the identified records in response to the search request.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/382,621Filed 23 Oct 2023 · continuation
Priority: 21 Mar 2019
Published: US 2024/0054105 A115 Feb 2024
Granted: 27 May 2025
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 16/1734
Details of further file system functions: details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
G06F 16/128
File system administration, e.g. details of archiving or snapshots: details of file system snapshots on the file-level, e.g. snapshot creation,…
G06F 16/13
File systems; File servers: file access structures, e.g. distributed indices
G06F 16/148
Details of searching files based on file metadata: file search processing

Family

Application16/360,273Parent of this continuation · filed 21 Mar 2019
US 2024/0054105 A1Pre-grant publication · published 15 Feb 2024
US 11,822,514 B2Parent of this continuation
US 2020/0301888 A1Published application
US 12,314,227 B2This patent

From the US filing history. Foreign family members aren’t listed.