Digital Forensics Agent Handoff for Parallel Data Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital forensic systems require significant time to access and extract data from multiple devices due to the need for a digital forensic access tool to be connected for extended periods, leading to inefficiencies when dealing with large numbers of devices.
Innovation Solution
A system where a digital forensic access device installs an access agent on each device, which is later replaced by an extraction agent, allowing simultaneous extraction of data from multiple devices using a computing device, reducing the time the access device is connected to each target.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a digital forensic access tool is connected to each target device for both access and extraction phases, then data access and extraction can be performed, but the process becomes time-consuming and tedious when dealing with multiple devices
Solution Approach 1:
The patent divides the digital forensics process into two distinct phases: access phase and extraction phase. During the access phase, a digital forensic access device connects to target devices to install access agents and collect data. Then, during the extraction phase, the same access device disconnects and a separate computing device performs extraction using the collected data. This segmentation allows the access device to serve multiple target devices sequentially without being blocked by extraction operations, thereby improving throughput and reducing time loss.
Solution Approach 2:
The patent introduces an intermediary data structure (such as a database or file system) that stores data collected during the access phase. This intermediary allows the extraction phase to proceed independently using pre-collected data, eliminating the need for the access device to remain connected during extraction. The intermediary acts as a buffer that decouples the access and extraction operations, enabling parallel processing and improving overall productivity.
2Quantity of substance
If the number of target devices exceeds the number of digital forensic access tools, then more devices can be processed, but the process becomes more time-consuming and tedious
Solution Approach 1:
By segmenting the forensics process into access and extraction phases with separate devices, the system allows multiple target devices to be accessed sequentially by the access device, then extracted in parallel by the computing device. This segmentation enables the system to handle more target devices than there are access tools, as the extraction phase can proceed concurrently for multiple devices without requiring additional access tools.
Solution Approach 2:
The patent enables continuous useful action by allowing the access device to move between target devices for access phase operations while the computing device simultaneously performs extraction operations on previously accessed devices. This continuity ensures that the system is always productive - either accessing new devices or extracting data from existing ones - thereby reducing idle time and improving the rate at which multiple devices can be processed.
Data Source
AI summary
In one example, a system comprises a digital forensic access device executing instructions to install an access agent on a target device and to replace the access agent with an extraction agent after the access agent locates and copies data in the target device into a data structure; and a computing device running an extraction server comprising instructions to store a copy of the data structure in storage and to remove the extraction agent from the target device.