Granular Forensic Backup Kits for Faster Malware Investigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware attacks on computing systems cause significant damage and recovery is delayed by investigative processes, including those conducted by law enforcement and insurance companies, leading to prolonged system downtime.
Innovation Solution
A forensic kit is developed to generate granular forensic backups, allowing investigative entities to analyze a focused subset of the production system components, including infected and related components, enabling quicker and more efficient malware investigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a complete backup of the production system is provided for forensic analysis, then investigative entities can thoroughly analyze the malware attack, but the system downtime is prolonged due to the large size and complexity of the backup
Solution Approach 1:
The patent divides the complete production system backup into granular components (files, folders, registry keys, database records) and selectively packages only those components that are relevant to the malware investigation. This segmentation allows investigative entities to receive a focused subset of data rather than the entire system backup, reducing analysis time while maintaining forensic completeness for the affected areas.
Solution Approach 2:
The patent extracts and isolates specifically the infected components and their related dependencies from the complete production system. By using dependency graphs and relationship mapping, the system identifies and extracts only the necessary components (files, registry entries, database records) that are directly or indirectly related to the malware, excluding all unrelated system components from the forensic kit.
2Reliability
If the forensic kit includes all production system components, then no relevant evidence is missed, but the complexity and size of the forensic kit increases significantly
Solution Approach 1:
The patent segments the production system into discrete analyzable components and uses relationship mapping to identify which segments are connected to the malware infection. This allows the forensic kit to include only the segmented components that have direct or indirect relationships with the malware, rather than including all system components, thereby reducing kit complexity while preserving evidence reliability.
Solution Approach 2:
The patent applies partial action by including only the necessary subset of system components required for effective malware analysis. Rather than providing the complete system (excessive action), the forensic kit includes precisely the infected components and their dependencies, which is sufficient for reliable forensic investigation without the bloat of unrelated system data.
3Measurement precision
If investigative entities analyze the complete production system, then they can conduct thorough investigations, but the investigation process becomes slower and less efficient
Solution Approach 1:
The patent segments the investigation target into focused components (infected files, related registry keys, dependent database records) rather than requiring analysis of the complete production system. This segmentation enables investigative entities to concentrate their analysis on the relevant segmented components, maintaining investigation thoroughness for the affected areas while dramatically improving investigation speed by eliminating unrelated system components.
Solution Approach 2:
The patent performs preliminary action by pre-identifying and pre-packaging the relevant infected components and their dependencies before the investigative entity receives the forensic kit. The system uses dependency graphs and relationship mapping to pre-process the production system, identifying which components need to be included in the forensic kit, thereby saving the investigative entity the time of sifting through irrelevant data during their analysis.
Data Source
AI summary
A forensic kit with a granular infected backup. A forensic engine may evaluate a production system that is infected with malware or other corruption and generate a forensic kit. The forensic kit may include copies of components of the production system that are infected or that are sufficiently related to infected components. The forensic kit may be provided to investigators.