Methods for Searching Forensic Data

Abstract

In one aspect of the present invention, a software component for conducting digital forensic searches is described. The software component has a header; one or more search markup language programs, and a data features section. The software component, also referred to as a search pack, enables a first entity, such as a federal investigation agency, to share its suspect and sensitive data with a second entity, such as another investigative agency, in a manner that allows the second agency to utilize the suspect data while not revealing the actual content of the sensitive data to the second agency. The second agency can perform comparisons and other operations on the sensitive data without having to know the actual content of the data. The search pack allows an investigative agency to define an investigative strategy for a particular case via the search markup language programs and by the data features that it includes in the search pack. Thus, by sharing search packs among agencies, an agency can share or inform others of that agency's theory of the case and investigative goal. Search packs can also be updated automatically as new information is learned about a particular case. A search pack is updated is determined by the agency that created it and manages it.

1 - 4 . (canceled) 
   
   
       5 . A digital forensic data management system, comprising:
 a digital forensics and data identification server platform;   at least one digital forensic search tool;   a search tool editor for creating and editing said digital forensic search tool; and   a search tool exchange server configured to output said forensic search tool from said digital forensics and data identification server platform to at least one computing platform associated with a second agency, said digital forensics and data identification server platform being associated with a first agency, and said at least one computing platform being associated with a second agency.   
   
   
       6 . The digital forensic data management system of  claim 5 , wherein said digital forensic search tool further comprises:
 a data verification portion comprising a data representation obtained by applying a hash function to sensitive data.   
   
   
       7 . The digital forensic data management system of  claim 6 ,
 wherein said sensitive data comprises at least one of a thumbnail image and a video image.   
   
   
       8 . The digital forensic data management system of  claim 6 ,
 wherein said hash function produces a value based on semantic content of said sensitive data.   
   
   
       9 . The digital forensic data management system of  claim 6 ,
 wherein said sensitive data can only be modified by said computing platform associated with said first agency.   
   
   
       10 . The digital forensic data management system of  claim 5 , further comprising:
 a suspect computer comprising a client device,   wherein the suspect computer is configured by a digital forensic search tool to boot with a specialized operating system, to compute one or more checksums to verify a before analysis and after analysis state of a memory device of said suspect computer, and to copy files identified to include said detected suspect data and a findings report onto a removable storage medium.   
   
   
       11 . The digital forensic data management system of  claim 10 , wherein said digital forensic search tool is encrypted. 
   
   
       12 . The digital forensic data management system of  claim 5 , wherein all user activities are logged.