Forensic Imaging via Encrypted External Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for collecting electronically stored information (ESI) in civil and criminal investigations are either too simplistic and prone to data alteration or require specialized knowledge and tools, failing to capture deleted files and system logs, and are logistically and financially challenging for large-scale or geographically dispersed collections.
Innovation Solution
A method involving a password-encrypted external storage device with a data collection program that allows custodians to create a complete forensic image of electronic storage media, including deleted files and system logs, without altering the data, and enables self-collection while ensuring authentication and preservation of exact copies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the usual file copy method is used to collect ESI, then the process is simple and can be performed by someone with limited technical knowledge, but the method only collects live files and cannot capture deleted files, system files, or unallocated disk space
Solution Approach 1:
The patent uses forensic imaging technology to create a complete bit-by-bit copy of the storage media, including all sectors containing live files, deleted files, system files, and unallocated space. This copying approach captures everything on the media without requiring the custodian to manually select files, thus resolving the contradiction between simplicity and completeness of data collection
2Loss of information
If forensic imaging is performed using traditional methods, then complete forensic images including deleted files and system logs can be obtained, but the process requires specialized knowledge, training, and tools
Solution Approach 1:
The patent enables custodians to perform their own forensic imaging by providing them with a pre-configured external storage device containing the imaging software and necessary tools. The custodian simply connects the device and runs the automated process without needing specialized forensic training or knowledge, thus resolving the contradiction between completeness of imaging and complexity of the process
Solution Approach 2:
The forensic imaging software and external storage device are prepared in advance by the requesting party, with all necessary tools, software, and instructions pre-configured. This preliminary preparation eliminates the need for the custodian to have specialized knowledge or assemble complex equipment, making the process accessible to ordinary users while still producing complete forensic images
3Loss of information
If multiple collections are performed to accommodate changes in scope, then more complete evidence can be gathered, but additional time and cost are incurred and potential evidence can be lost or become inaccessible
Solution Approach 1:
The patent performs a complete forensic image of all storage media in advance, capturing all possible evidence including live files, deleted files, system files, and unallocated space. This comprehensive preliminary collection ensures that all evidence is preserved in a single operation, eliminating the need for multiple subsequent collections and the associated time losses, costs, and risks of evidence degradation
4Ease of operation
If the custodian performs file copy collection themselves, then logistical requirements are minimized, but the custodian may accidentally, negligently, or willfully destroy, alter, or omit evidence
Solution Approach 1:
The patent creates a complete forensic image copy of all storage media that is bit-by-bit identical to the original, preserving all evidence in an immutable format. The use of cryptographic hashing and verification procedures ensures the integrity of the copy, while the automated process eliminates human error or intentional misconduct in the collection process, thus resolving the contradiction between operational simplicity and evidence reliability
Data Source
AI summary
In a method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media is part of a computer system. The method includes the steps of: (a) storing a data collection program on an external storage device; (b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device; (c) requiring the custodian to connect the external storage device to a computer system containing the storage media; (d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data; (e) authenticating the forensic image; and (f) preserving an exact copy of the forensic image without making changes to the forensic image.