# US 2014/0157407 A1 · Methods, systems, and computer readable media for efficient computer forensic analysis and data access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157407 A1 - Document ID: US20140157407A1 - Status: Published application - Kind: A1 - Application number: 14/115,094 - Filed: 2012-05-07 - Published: 2014-06-05 - Earliest claimed: 2011-05-06 - Assignees: The University of North Carolina at Chapel Hill - Applicants: The University of North Carolina at Chapel Hill - Inventors: Srinivas Krishnan; Fabian Monrose; Kevin Snow - Web page: https://patentgrep.com/patent/US20140157407A1 ## CPC - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract According to one aspect, the subject matter described herein includes a method for efficient computer forensic analysis and data access control. The method includes steps occurring from within a virtualization layer separate from a guest operating system. The steps include monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory. The steps also include tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network. The steps further include linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accessed. ## Claims ### Claim 1 A method for efficient computer forensic analysis and data access control, the method comprising: from within a virtualization layer separate from a guest operating system: monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory; tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network; and linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accesses. ### Claim 2 (depends on 1) The method of claim 1 wherein the virtualization layer comprises a hypervisor layer. ### Claim 3 (depends on 1) The method of claim 1 wherein monitoring disk accesses includes maintaining a watch list of virtual machine disk blocks containing data of interest and determining whether a disk access corresponds to any of the virtual machine blocks on the watch list. ### Claim 4 (depends on 3) The method of claim 3 wherein tracking subsequent accesses to the memory resident data includes, in response to determining that the disk access corresponds to a virtual machine disk block on the watch list, triggering a memory monitoring module located within the virtualization layer to monitor a physical page of memory into which blocks of data from the disk access are paged. ### Claim 5 (depends on 1) The method of claim 1 comprising maintaining a watch list of file system objects corresponding to data of interest and determining whether a file system object operation corresponds to any of the file system objects on the watch list. ### Claim 6 (depends on 1) The method of claim 1 wherein linking the operations made by the guest operating system associated with the disk accesses with the operations associated with the memory accesses includes examining source and destination parameters associated with operations to infer that the operations concern the same data. ### Claim 7 (depends on 1) The method of claim 1 wherein tracking subsequent accesses to the memory resident data includes, in response to the memory resident data being copied from its initial location to another memory resident location, adding the new memory resident location to a watch list and monitoring subsequent accesses to the new memory resident location using the watch list. ### Claim 8 (depends on 1) The method of claim 1 comprising identifying a codepage signature of a process making the memory accesses and comparing the codepage signature to stored codepage signatures to identify the process. ### Claim 9 (depends on 8) The method of claim 8 comprising creating the codepage signature for the process by recognizing shared and kernel code pages associated with the process and utilizing the codepage signature to selectively extract codepages that identify the process. ### Claim 10 (depends on 1) The method of claim 1 comprising selectively blocking and/or dropping packets associated with a network connection without examining the packets' contents. ### Claim 11 (depends on 1) The method of claim 1 comprising selectively blocking accesses to the guest operating system to memory and/or disk locations containing data of interest. ### Claim 12 A system for efficient computer forensic analysis and data access control, the system comprising: a virtualization layer separate from a guest operating system for virtualizing resources of an underlying computing system; a storage monitoring module located within the virtualization layer and for monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory; a memory monitoring module located within the virtualization layer for tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network; and a system call monitoring module for linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accesses. ### Claim 13 (depends on 12) The system of claim 12 wherein the virtualization layer comprises a hypervisor layer. ### Claim 14 (depends on 12) The system of claim 12 wherein the storage monitoring module is configured to maintain a watch list of virtual machine disk blocks containing data of interest and determine whether a disk access corresponds to any of the virtual machine blocks on the watch list. ### Claim 15 (depends on 14) The system of claim 14 wherein the storage monitoring module is configured to, in response to determining that the disk access corresponds to a virtual machine disk block on the watch list, trigger the memory monitoring module to monitor a physical page of memory into which blocks of data from the disk access are paged. ### Claim 16 (depends on 12) The system of claim 12 wherein the storage monitoring module is configured to maintain a watch list of file system objects corresponding to data of interest and determine whether a file system object operation corresponds to any of the file system objects on the watch list. ### Claim 17 (depends on 12) The system of claim 12 wherein the system call monitoring module is configured to examine source and destination parameters associated with operations to infer that the operations concern the same data. ### Claim 18 (depends on 12) The system of claim 12 wherein the memory monitoring module is configured to, in response to the memory resident data being copied from its initial location to another memory resident location, add the new memory resident location to a watch list and monitor subsequent accesses to the new memory resident location using the watch list. ### Claim 19 (depends on 12) The system of claim 12 wherein the memory monitoring module is configured to identify a codepage signature of a process making the memory accesses and to compare the codepage signature to stored codepage signatures to identify the process. ### Claim 20 (depends on 19) The system of claim 19 wherein the memory monitoring module is configured to create the codepage signature for the process by recognizing shared and kernel code pages associated with the process and utilize the codepage signature to selectively extract codepages that identify the process. ### Claim 21 (depends on 12) The system of claim 12 comprising a network monitoring module configured to, in response to a trigger from either the memory monitoring module or the system call monitoring module, selectively block and/or drop packets associated with a network connection. ### Claim 22 (depends on 12) The system of claim 12 comprising an enforcement module for selectively blocking accesses to the guest operating system to memory and/or disk locations containing data of interest. ### Claim 23 A non-transitory computer readable medium having stored thereon executable instructions that when executed by the processor of a computer control the computer to perform steps comprising: from within a virtualization layer separate from a guest operating system: monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory; tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network; and linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accesses.