SMART Activity Logging for Hard Drive Access Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods cannot detect if a hard drive has been accessed using a read-only connection after the last recorded shutdown, leaving no indication on the drive, which is a security concern for sensitive data.

Innovation Solution

The system utilizes Self-Monitoring Analysis and Reporting Technology (SMART) to track and compile event data from the hard drive, such as Time Powered On and Power Cycle Count, to determine if the drive has been accessed through a read-only connection by analyzing activity data and logging it for later assessment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If read-only connection is used to access hard drive, then data integrity is preserved, but detection capability is lost

Engineering Contradiction:

Improvedata integrityVSAvoidaccess detection

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system performs preliminary actions by establishing a baseline state of the hard drive before it leaves controlled environments. Activity data is collected and stored during authorized use, creating a reference profile that can later be compared against post-recovery data to detect unauthorized access

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary monitoring system that operates between the hard drive and external access points. This intermediary continuously collects activity data including read/write operations, file access patterns, and system calls, creating a detectable record even during read-only operations

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If forensic analysis is performed after recovery, then security breach assessment is enabled, but time delay increases detection

Engineering Contradiction:

Improvesecurity breach assessmentVSAvoiddetection delay

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The monitoring system operates continuously without interruption, collecting activity data throughout the hard drive's operational lifecycle. This continuous data collection ensures that no access events are missed and eliminates gaps in the forensic record, enabling immediate analysis upon recovery

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

All necessary data collection and baseline establishment occurs while the hard drive is still in controlled environments, preparing the forensic record in advance. This preliminary preparation eliminates the need for time-consuming data gathering after recovery, enabling immediate security breach assessment

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10032019B2System, method, and computer program product for detecting access to a memory device

Publication Date: 2018.07.24 STROZ FRIEDBERG LLC

AI summary

Discrete events that take place with respect to a hard disk drive or other I/O device or port are indicated to logic that implements Self-Monitoring Analysis and Reporting Technology (SMART) or similar technology. These events are communicated to SMART as event data. Examples of such discrete events include power on, power off, spindle start, and spindle stop, positioning of the actuator, and the time at which such events occur. SMART then compiles event data to create compiled activity data. Compiled activity data represents summary statistical information that is created by considering some or all of the event data. Examples of compiled activity data include the Time Powered On and Power Cycle Count. Collection logic then writes the compiled activity data to a memory medium. An analyst can then read data from log file(s).