Block-Level Data Capture for Forensic Volume Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of computing resources in distributed environments leads to issues such as malfunction, software bugs, and malicious usage, which can affect other users and require effective forensic analysis tools to investigate security events and data changes over time.
Innovation Solution
Implementing frequent block-level data captures and maintaining them for forensic use, utilizing journaling techniques to reconstruct data sets at specific points in time, and providing a forensic storage volume that allows users to analyze data sets at different capture times, enabling forensic analysis and security event investigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If frequent block-level data captures are implemented for forensic analysis, then the ability to investigate security events and data changes is improved, but the storage requirements and system complexity increase
Solution Approach 1:
The patent segments data storage into multiple independent storage units, each capable of holding captured data sets. This segmentation allows the system to manage forensic data captures in distributed fashion across multiple units, reducing the complexity burden on any single storage component while maintaining comprehensive forensic analysis capability.
Solution Approach 2:
The system performs preliminary data capture and storage actions automatically at predetermined intervals or upon detecting specific events. By pre-capturing data sets before security incidents occur and storing them in dedicated units, the system eliminates the need for complex real-time analysis infrastructure, simplifying the overall system while preserving forensic investigation capabilities.
2Reliability
If data sets are captured and stored for forensic use, then security event investigation capability is improved, but the storage space and resource consumption increase
Solution Approach 1:
The patent extracts only the necessary forensic data sets from the main computing system and stores them in separate, dedicated storage units. By extracting and isolating only the data required for forensic analysis rather than storing complete system states, the system maintains high investigation reliability while minimizing storage space consumption.
Solution Approach 2:
The system dynamically adjusts capture frequency and data retention parameters based on system activity levels, security event types, and storage availability. By changing these parameters adaptively, the system optimizes the balance between maintaining reliable forensic investigation capability and managing storage space consumption efficiently.
Data Source
AI summary
Techniques, including systems and methods, take frequent captures of data sets for the purpose of forensic analysis. The data set captures are taken at the block level in various embodiments. Data set captures are used to instantiate forensic storage volumes that are attached to computing instances. The computing instances can access data in the forensic storage volumes at a state corresponding to a specified capture time. A user can select different capture times to re-instantiate the forensic storage volume to see how the forensic storage volume changed between captures.