# US 8,474,047 B2 · Remote collection of computer forensic evidence > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,047 B2 - Document ID: US8474047B2 - Status: Granted - Kind: B2 - Application number: 13/465,859 - Filed: 2012-05-07 - Published: 2012-08-30 - Granted: 2013-06-25 - Earliest claimed: 2003-06-23 - Assignees: Architecture Technology Corporation - Applicants: Frank N. Adelstein; Matthew A. Stillerman; Robert A. Joyce - Inventors: Frank N. Adelstein; Matthew A. Stillerman; Robert A. Joyce - Web page: https://patentgrep.com/patent/US8474047B2 ## CPC - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention is directed to techniques for allowing a user to remotely interrogate a target computing device in order to collect and analyze computer evidence that may be stored on the target computing device. A forensic device receives input from a remote user that identifies computer evidence to acquire from the target computing device. The forensic device acquires the computer evidence from the target computing device and presents a user interface for the forensic device through which the remote user views the computer evidence acquired from the target computing device. In this manner, forensic device allows the user to interrogate the target computing device to acquire the computer evidence without seizing or otherwise “shutting down” the target device. ## Claims ### Claim 1 A method comprising: receiving, with a forensic device, input from a user that identifies a target computing device coupled to the forensic device via a communication link; automatically selecting, based on the target computing device, at least one of a plurality of access methods via which to perform acquisition operations to acquire computer evidence from the target computing device; communicating commands associated with the acquisition operations from the forensic device to the target computing device via the selected acquisition methods to initiate the acquisition operations on the target computing device to acquire the computer evidence from the target computing device with the forensic device without pre-loading acquisition software on the target computing device prior to initiating the acquisition; and presenting a user interface for the forensic device through which the remote views the computer evidence acquired from the target computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein automatically selecting at least one of a plurality of access methods comprises automatically selecting the at least one of a plurality of access methods based on both: (1) a type of data to be acquired from the target computing device as forensic evidence, and (2) a type of operating system executed by the target computing device. ### Claim 3 (depends on 1) The method of claim 1, wherein the plurality of access methods includes at least two or more of Windows Management Instrumentation (WMI), Server Message Block (SMB), Secure Shell (SSH), Remote Shell (RSH), Network File System (NFS), Apple Filing Protocol (AFP), File Transfer Protocol (FTP), and Hypertext Transfer Protocol (HTTP). ### Claim 4 (depends on 1) The method of claim 1, further comprises automatically determining, with the forensic device, an order for performing the acquisition operations that reduces the impact on other data stored on the target computing device. ### Claim 5 (depends on 1) The method of claim 1, wherein presenting the user interface for the forensic device through which the user views and analyzes the computer evidence acquired from the target computing device comprises presenting the user interface for the forensic device through which the user views and analyzes the computer evidence acquired from the target computing device on-line. ### Claim 6 (depends on 1) The method of claim 1, further comprising acquiring additional computer evidence while the user views and analyzes the previously acquired computer evidence. ### Claim 7 (depends on 1) The method of claim 1, wherein acquiring the computer evidence from the target computing device comprises acquiring the computer evidence from the target computing device while the target computing device is active. ### Claim 8 (depends on 1) The method of claim 1, further comprising receiving input from the user instructing the forensic device to analyze the computer evidence. ### Claim 9 (depends on 1) The method of claim 1, wherein acquiring the computer evidence from the target computing device comprises acquiring state information from the target computing device that includes at least one of running process information and open network ports with associated processes. ### Claim 10 (depends on 1) The method of claim 1, further comprising performing a subset of the acquisition operations to acquire at least one of an log file and communication statistics prior to performing the other acquisition operations. ### Claim 11 (depends on 10) The method of claim 10, further comprising performing the acquisition operation to acquire the communication statistics after performing the acquisition operation to acquire the log file. ### Claim 12 (depends on 10) The method of claim 10, further comprising performing the acquisition operation to acquire the log file after performing the acquisition operation to acquire the communication statistics. ### Claim 13 (depends on 10) The method of claim 10, further comprising performing an acquisition operation to acquire general system information from the target computing device after performing the subset of the acquisition operations to acquire the at least one of the log file and communication statistics prior to any other acquisition operations. ### Claim 14 (depends on 10) The method of claim 10, wherein the log file comprises one of a system event log, an application event log, and a security event log, web server log file, Unix SYSLOG file, a mail log file, an accounting log file, and a router flow log file. ### Claim 15 (depends on 10) The method of claim 10, wherein the communications statistics comprises one of Ethernet statistics and network protocol statistics. ### Claim 16 (depends on 10) The method of claim 10, further comprising determining an order in which to perform acquisition operations. ### Claim 17 (depends on 1) The method of claim 1, further comprising: receiving case information and target device information from a user to define a new inquiry; creating a new inquiry based on the received information; and associating the new inquiry with a case. ### Claim 18 (depends on 17) The method of claim 17, wherein the case information comprises at least one of a case number, case name, principle investigator, location to store the collected data, and a time zone for date/time reporting. ### Claim 19 (depends on 17) The method of claim 17, wherein the target computing device information includes at least one of a target computing device host name, IP address, operating system, access methods and password. ### Claim 20 (depends on 1) The method of claim 1, further comprising storing a copy of the computer evidence originally acquired from the target computing device. ### Claim 21 (depends on 1) The method of claim 1, further comprising: normalizing the acquired computer evidence to a common format; and storing the normalized computer evidence. ### Claim 22 (depends on 21) The method of claim 21, wherein normalizing the acquired computer evidence to a common format comprises at least one of converting timestamp data from a local time zone of the target computing device to a standard time zone, converting data having host names and IP addresses to all host names, converting data having host names and IP addresses to all IP addresses, and normalizing the clock of the target computing device to that of the forensic device. ### Claim 23 (depends on 1) The method of claim 1, further comprising: performing a cryptographic hash on the computer evidence when acquired; and storing the resulting hash value representative of an unaltered stated of the computer evidence. ### Claim 24 (depends on 1) The method of claim 1, further comprising maintaining an audit log of transactions performed by the forensic device. ### Claim 25 (depends on 24) The method of claim 24, wherein maintaining the audit log comprises at least one of tracking computer evidence downloaded from the target computing device, browsing of the computer evidence by the user, and analyses performed on the computer evidence, and wherein the audit log comprises a timestamp corresponding to each transaction, an investigator identifier corresponding to the investigator performing each transaction, and a description of each transaction. ### Claim 26 (depends on 1) The method of claim 1, wherein the computer evidence comprises at least one log file, the method further comprising: receiving input from the user to analyze the log file for tampering; analyzing the log file to detect log file tampering; and displaying to the user the results of the analysis. ### Claim 27 (depends on 26) The method of claim 26, wherein analyzing the log file to detect log file tampering comprises determining whether the entries in the log file are in ascending order. ### Claim 28 (depends on 26) The method of claim 26, wherein analyzing the log file to detect log file tampering comprises: computing time gaps between entries of the log file; identifying anomalous time gaps; and displaying to the user the identified anomalous gaps. ### Claim 29 (depends on 26) The method of claim 26, wherein analyzing the log file to detect log file tampering comprises: computing time gaps between entries of the log file; generating a graphical representation of the time gaps; and displaying the graphical representation to the user. ### Claim 30 (depends on 26) The method of claim 26, wherein analyzing the log file to detect log file tampering comprises: receiving input that identifies a periodic event; detecting an absent periodic event within the log file; and alerting the user of the absent periodic events. ### Claim 31 (depends on 30) The method of claim 30, wherein receiving input that identifies the periodic event comprises: receiving input that identifies a period of the periodic event; and receiving input that identifies an identifier associated with the periodic event. ### Claim 32 (depends on 31) The method of claim 31, wherein detecting absent periodic events within the log file comprises: searching for the log file for the periodic event identifier; computing the amount of time that elapsed between each of the periodic event identifiers; and comparing the period of the event with the computed elapsed times to detect absent periodic events. ### Claim 33 (depends on 30) The method of claim 30, wherein identifying the periodic event comprises receiving input from the user identifying the periodic event. ### Claim 34 (depends on 1) The method of claim 1, wherein acquiring the computer evidence from the target computing device comprises acquiring an image of at least one of a disk attached to the target computing device and a memory of the target computing device, and further comprising examining the acquired image to identify at least one of files, process or operating system data structures, boot information, deleted files or directories, and data hidden in unallocated space. ### Claim 35 (depends on 1) The method of claim 1, wherein the communication link comprises a customer network of the target computing device. ### Claim 36 (depends on 1) The method of claim 1, wherein a client device is coupled to the forensic device via one of a public network, a customer network of the target computing device, a phone line, a universal serial bus (USB), a wireless port, a serial port, a parallel port and an infrared link. ### Claim 37 (depends on 1) The method of claim 1, wherein the target computing device comprises one of a personal computer, a handheld computer, a laptop, a workstation, a router, a gateway device, a firewall device, a web server, a file server, a database server, a mail server, a print server, a network-enabled personal digital assistant, and a network-enabled phone. ### Claim 38 A system comprising: a target computing device; a forensic device coupled to the target computing device via a customer network of the target computing device; a client device; and a user interface module to present a user interface for the forensic device that is remotely accessible by the client device, wherein the forensic device receives input via the user interface that identifies computer evidence to acquire from a target computing device, wherein, in response, the forensic device automatically selects, based on the target computing device, at least one of a plurality of access methods via which to perform acquisition operations to acquire computer evidence from the target computing device and communicates commands associated with the acquisition operations from the forensic device to the target computing device via the selected acquisition methods to acquire the computer evidence from the target computing device without pre-loading acquisition software on the target computing device prior to acquiring the computer evidence, stores the computer evidence, and wherein the forensic device presents the computer evidence to the remote user for analysis via the user interface. ### Claim 39 (depends on 38) The system of claim 38, wherein the forensic device automatically selects the at least one of a plurality of access methods based on a type of data to be acquired from the target computing device as forensic evidence and a type of operating system executed by the target computing device. ### Claim 40 (depends on 38) The system of claim 38, wherein the plurality of access methods includes at least two or more of Windows Management Instrumentation (WMI), Server Message Block (SMB), Secure Shell (SSH), Remote Shell (RSH), Network File System (NFS), Apple Filing Protocol (AFP), File Transfer Protocol (FTP), and Hypertext Transfer Protocol (HTTP). ### Claim 41 (depends on 38) The system of claim 38, wherein the forensic device presents the user nterface to the remote user to allow the remote user to view and analyze the data on-line. ### Claim 42 (depends on 38) The system of claim 38, wherein the forensic device acquires additional computer evidence from the target computing device while the remote user views and analyzes the previously acquired computer evidence. ### Claim 43 (depends on 38) The system of claim 38, wherein the forensic device acquires the computer evidence from the target computing device while the target computing device is active. ### Claim 44 (depends on 38) The system of claim 38, wherein the forensic device acquires state information from the target computing device. ### Claim 45 (depends on 38) The system of claim 38, wherein the remote user identifies a plurality of acquisition operations to perform and the forensic device performs the acquisition operations in an order that reduces the impact on other data stored on the target computing device. ### Claim 46 (depends on 45) The system of claim 45, wherein the forensic device performs the acquisition operations to acquire at least one of a log file and communication statistics prior to any other acquisition operations. ### Claim 47 (depends on 46) The system of claim 46, wherein the forensic device performs an acquisition operation to acquire general system information from the target computing device after performing the acquisition operations to acquire the at least one of the log file and communication statistics prior to any other acquisition operations. ### Claim 48 (depends on 47) The system of claim 47, wherein the forensic device stores a copy of the computer evidence originally acquired from the target computing device, normalizes the acquired computer evidence to a common format, stores the normalized computer evidence, performs a cryptographic hash on the computer evidence, and stores the resulting hash value. ### Claim 49 (depends on 47) The system of claim 47, wherein the computer evidence comprises at least one log file, and wherein the forensic device analyzes the log file to detect log file tampering and displays to the user the results of the analysis. ### Claim 50 (depends on 49) The system of claim 49, wherein the forensic device determines whether the entries in the log file are in ascending order. ### Claim 51 (depends on 49) The system of claim 49, wherein the forensic device computes time gaps between entries of the log file, identifies anomalous time gaps, and displays to the user the identified anomalous gaps. ### Claim 52 (depends on 49) The system of claim 49, wherein the forensic device computes time gaps between entries of the log file, generates a graphical representation of the time gaps, and displays the graphical representation to the user. ### Claim 53 (depends on 49) The system of claim 49, wherein the forensic device receives input identifying a period and an identifier associated with a periodic event, searches the log file for the periodic event identifier, computes the amount of time that elapsed between each of the periodic event identifiers, and compares the period of the event with the computed elapsed times to detect an absent periodic event, and alerts the user of the absent periodic event. ### Claim 54 (depends on 46) The system of claim 46, wherein the log file comprises one of a system event log, an application event log, a security event log, web server log file, Unix SYSLOG file, a mail log file, an accounting log file, and a router flow log file. ### Claim 55 (depends on 46) The system of claim 46, wherein the communications statistics comprises one of Ethernet statistics and network protocol statistics. ### Claim 56 (depends on 38) The system of claim 38, wherein the forensic device receives case information and target device information from a user to define a new inquiry, creates a new inquiry based on the received information, and associates the new inquiry with a case. ### Claim 57 (depends on 56) The system of claim 56, wherein the case information comprises at least one of a case number, case name, principle investigator, location to store the collected data, and a time zone for date/time reporting. ### Claim 58 (depends on 56) The system of claim 56, wherein the target computing device information includes at least one of a target computing device host name, IP address, operating system, access methods and password. ### Claim 59 (depends on 38) The system of claim 38, wherein the forensic device maintains an audit log of transactions to track at least one of computer evidence downloaded from the target computing device, browsing of the computer evidence by the remote user, and analyses performed on the computer evidence, and wherein the audit log comprises a timestamp corresponding to each transaction, an investigator identifier corresponding to the investigator performing each transaction, and a description of each transaction. ### Claim 60 (depends on 38) The system of claim 38, wherein the forensic device acquires an image of at least one of a disk attached to the target computing device and a memory of the target computing device and examines the acquired image to identify at least one of files, process or operating system data structures, boot information, deleted files or directories, and data hidden in unallocated space. ### Claim 61 (depends on 38) The system of claim 38, wherein the target computing device comprises one of a personal computer, a handheld computer, a laptop, a workstation, a router, a gateway device, a firewall device, a web server, a file server, a database server, a mail server, a print server, a network-enabled personal digital assistant, and a network-enabled phone. ### Claim 62 (depends on 38) The system of claim 38, wherein the forensic device is coupled to a same local subnet as the target computing device. ### Claim 63 (depends on 38) The system of claim 38, wherein the client device is coupled to the forensic device via one of a public network, a customer network of the target computing device, a phone line, a universal serial bus (USB), a wireless port, a serial port, a parallel port and an infrared link.