Remote Metadata Scanning for Restricted Content Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer forensic methods for identifying restricted content on computer networks are time-consuming and impractical, requiring physical access to hard drives and resulting in numerous false positives, making it difficult to efficiently scan large networks for illegal or inappropriate content.
Innovation Solution
A method and system for remotely accessing computer systems to retrieve metadata, comparing it to a database of known restricted content, and flagging matching entries without scanning the actual file data, allowing for efficient identification with fewer false positives and legal data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full hard drive scanning is performed to identify restricted content, then detection completeness is improved, but time consumption and operational complexity increase significantly
Solution Approach 1:
The patent extracts and scans only the metadata portion of files rather than the entire file content. The metadata contains file information such as names, paths, and timestamps that can identify restricted content without requiring analysis of the actual file data, thus dramatically reducing scanning time while maintaining detection effectiveness
Solution Approach 2:
The patent segments the file system into metadata and content portions, scanning only the metadata segment for restricted content identification. This segmentation allows the system to focus on structural file information that reveals the presence of restricted content without processing the entire file, resolving the contradiction between complete detection and time efficiency
2Measurement precision
If physical access to hard drives is required for forensic scanning, then scanning accuracy is improved, but ease of operation and scalability deteriorate
Solution Approach 1:
The patent replaces the mechanical process of physically removing and connecting hard drives with a software-based remote scanning system. The scanning tool accesses metadata through file system interfaces without requiring physical hardware manipulation, thereby maintaining scanning accuracy while dramatically improving ease of operation and enabling remote execution
Solution Approach 2:
The patent introduces a scanning tool as an intermediary that remotely accesses and analyzes metadata without requiring direct physical handling of storage devices. This intermediary enables accurate scanning while eliminating the need for manual drive removal and connection, resolving the contradiction between precision and operational convenience
3Reliability
If comprehensive file analysis is performed on entire hard drives, then detection reliability is improved, but device complexity and resource requirements increase
Solution Approach 1:
The patent extracts only the necessary metadata information from files rather than performing comprehensive analysis of entire file contents. This extraction approach maintains detection reliability by focusing on file-identifying metadata while eliminating the complexity of analyzing vast amounts of actual file data
Solution Approach 2:
The patent applies partial action by scanning only the metadata portion of files rather than performing excessive comprehensive scanning of all file content. This partial scanning approach achieves sufficient detection reliability for identifying restricted content while significantly reducing system complexity and resource requirements
Data Source
AI summary
Embodiments of the present invention provide a method and apparatus for remotely accessing a computer system or network to identify storage devices and to retrieve metadata from the storage devices that are respectively unique to files stored in the storage devices. The metadata provides information regarding each file stored on the storage devices and each metadata is associated with a respective file. A scanning tool compares the metadata retrieved from the computer system or network to a database or list of known metadata of known restricted content. Metadata retrieved from the computer system or network that matches metadata from the database or list of known restricted content is flagged and the file associated with the matching metadata is flagged and reported as potentially storing restricted content. During the scanning, restricted content itself is not scanned, not copied, not transferred and not stored.