System and method for digital evidence analysis and authentication
AssigneeUnited States Postal Service
InventorsSuzanne Hermitage, Steve D. Nguyen, Jeffrey A. Steadman, Kennon F. Privette, Gerry Picciano, Jill Padres
Life of this patent
Estimating the term…
Abstract
The system disclosed provides an efficient mechanism for acquiring email and other data from remote systems in a forensically sound manner. Email for users can be requested by investigators from email servers across the country. It is then be automatically acquired and made available to the examiner, subject to approval, and any others he deems have a need-to-know on a web based system. The data can be searched and bookmarked, and the bookmarks shared. Data can also be uploaded manually and combined with email data in the searching, bookmarking, and sharing.
Claims18
A method for investigating data, the method comprising:
- receiving a plurality of data files at a server from a first remote computing device associated with a first user, the data files including data concerning a plurality of email messages, the email messages each associated with a plurality of email users;
- granting, by the server, to a second remote computing device associated with a second user access to the data files received from the first remote computing device;
- receiving, by the server, from the second remote computing device, a selection of data concerning an email message from among the data concerning the plurality of email messages;
- generating, by the server, a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with the selected email message data, wherein the graphical representation is a picture depicting the plurality of email users, and further depicting travel of the selected email message to and from the plurality of email users;
- and
- transmitting, by the server, the graphical representation of the email transmission relationships to the second remote computing device for display on a display screen of the second remote computing device.
A non-transitory computer-readable storage medium having a computer program embodied thereon, the program executable to perform a method for investigating data, the method comprising:
- receiving a plurality of data files at a server from a first remote computing device associated with a first user, the data files including data concerning a plurality of email messages, the email messages each associated with a plurality of email users;
- granting to a second remote computing device associated with a second user access to the data files received from the first remote computing device;
- receiving from the second remote computing device a selection of data concerning an email message from among the data concerning the plurality of email messages;
- generating a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with the selected email message data, wherein the graphical representation is a picture depicting the plurality of email users, and further depicting travel of the selected email message to and from the plurality of email users;
- and
- transmitting the graphical representation of the email transmission relationships to the second remote computing device for display on a display screen of the second remote computing device.
A data investigation system, the system comprising:
- a first remote computing device associated with a first user;
- a second remote computing device associated with a second user, the second remote computing device communicatively coupled to the first remote computing device by a network;
- and
- a server that receives a plurality of data files from the first remote computing device and executions instructions stored in memory, the server communicatively coupled to the first and second remote computing devices by the network, the data files including data concerning a plurality of email messages, and the email messages each associated with a plurality of email users, wherein execution of the instructions:
- grants to the second remote computing device access to the data files received from the first remote computing device;
- generates a graphical representation of a plurality of email transmission relationships among the plurality of email users associated with a portion of selected email message data identified in a selection of data received from the second remote computing device, wherein the graphical representation is a picture depicting the plurality of email users, and further depicting travel of the selected email message to and from the plurality of email users;
- and
- transmits the graphical representation of the email transmission relationships to the second remote computing device for display on a display screen of the second remote computing device.
Dependencies are inferred from the claim text.