Digital Memory Imaging via Multi-Device Parallel Data Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital memory imaging systems for forensic investigations are inefficient and slow, often requiring extensive time and storage space, and are not suitable for covert operations due to limitations in USB storage capacity and speed, as well as the need to physically remove hard drives, which can compromise the investigation's secrecy and completeness.
Innovation Solution
A digital memory imaging system that utilizes multiple removable data storage devices connected via various ports (USB, eSATA, SD, FireWire, Thunderbolt, and PCIe) to split the imaging process, employing a dynamic queuing system to distribute data blocks efficiently across available devices, allowing continuous imaging without the need to remove the hard drive and enhancing speed and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is imaged to a single removable memory device, then the imaging process is simple to operate, but the storage capacity is insufficient and the imaging speed is slow
Solution Approach 1:
The patent divides the imaging process into multiple independent streams, each writing to a separate removable memory device. The system automatically partitions the data flow across multiple devices based on their available capacity, allowing the total storage capacity to be the sum of all individual device capacities. This resolves the contradiction by maintaining operational simplicity while exponentially increasing storage capacity through parallel use of multiple devices.
Solution Approach 2:
The patent combines multiple removable memory devices into a unified imaging target, treating them as a single logical storage pool. The system automatically manages data distribution across devices without requiring user intervention, merging their capacities while maintaining the simplicity of a single-device imaging process. This allows the system to achieve large storage capacity while preserving ease of operation.
2Ease of operation
If data is imaged to a removable memory device, then the imaging process is portable and easy to set up, but the imaging speed creates a bottleneck
Solution Approach 1:
The patent segments the imaging workload into multiple parallel streams, each writing to a different removable memory device simultaneously. This parallelization multiplies the effective imaging speed while maintaining the portability advantage of using removable devices. The system automatically manages the segmentation without requiring complex setup, preserving ease of operation while dramatically improving productivity.
Solution Approach 2:
The patent ensures continuous imaging operation by distributing data across multiple devices, eliminating the bottleneck that occurs when a single device's storage or write speed is exhausted. The system continuously writes data to available devices without interruption, maintaining high imaging speed while preserving the portability and simplicity of removable media imaging.
3Productivity
If the hard drive is removed from the target computer for imaging, then the imaging speed increases, but the covert nature of the investigation is compromised and time is lost
Solution Approach 1:
The patent combines multiple removable memory devices to create sufficient aggregate storage capacity, eliminating the need to remove the hard drive. This allows imaging to proceed while the hard drive remains installed in the target computer, maintaining the covert nature of the investigation. The merged capacity of multiple devices replaces the need for physical drive removal, saving time and preserving operational security.
Solution Approach 2:
The patent enables the imaging system to function in multiple modes: it can image from installed drives without removal, or from removed drives when necessary. The system's ability to adapt to different scenarios while maintaining high speed through multi-device imaging provides universal functionality, eliminating the trade-off between speed and covert operation requirements.
4Productivity
If the hard drive is removed from the target computer for imaging, then faster imaging can be achieved, but the operation becomes detectable and security is compromised
Solution Approach 1:
The patent merges the capacity of multiple removable memory devices to provide sufficient storage for complete hard drive imaging without removal. This allows the imaging process to proceed covertly with the hard drive remaining installed, eliminating the security risk of detection while maintaining imaging capability. The combined storage capacity resolves the contradiction between speed and operational security.
5Ease of operation
If a single removable memory device is used for imaging, then the setup is simple, but the imaging process is slow and often cannot complete within available time
Solution Approach 1:
The patent segments the imaging process into multiple parallel operations, each writing to a separate removable memory device. This segmentation multiplies the effective imaging throughput while the system automatically manages the complexity, preserving setup simplicity. Multiple devices work simultaneously to complete the imaging process within available time, resolving the contradiction between simple setup and fast completion.
Solution Approach 2:
The patent maintains continuous imaging operation by distributing data across multiple devices, preventing the bottlenecks that occur with single-device imaging. The system continuously writes data without interruption or waiting, ensuring complete imaging within available time while keeping the setup process simple through automatic device management.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A digital memory imaging system for imaging the digital memory of a target computer (1) comprising: a plurality of removable data storage devices (3, 5, 7, 9, 11, 13) each receivable by the target computer (1); an imaging means configured to image the digital memory of the target computer; an output means to output the imaged digital memory as a series of data blocks to two or more of the removable data storage devices (3, 5, 7, 9, 11, 13).