Method to scan a forensic image of a computer system with multiple malicious code detection engines simultaneously from a master control point

Abstract

A multi-engine malicious code scanning method for scanning data sets from a storage device is provided. The method includes, among other steps obtaining at least one data set from a storage device and generating a single forensic image of the data set and also applying a recover data application to the data set to generate a single recovered data set. A scanning is initiated of the single forensic image and the single recovered data set using the selected plurality of malware engines, where each of the malware engines, installed on the independent operating systems of the virtual operating system may be run concurrently on the single forensic image and the single recovered data set. A report is generated combining each of the malware engines reporting the results of the scans.

What is claimed is: 
     
         1 . A multi-engine malicious code scanning method for scanning data sets from a storage device, said method comprising the steps of:
 installing a virtual operating system on at least one computer, along with a plurality of independent operating systems on said computer;   for each of said independent operating systems, installing a malware engine, such that said computer includes a plurality of malware engines, each operating separately on its respective independent operating system;   obtaining at least one data set from a storage device;   generating a single forensic image of said data set;   applying a recover data application to said data set to generate a single recovered data set;   selecting a plurality of malware engines for analyzing said single forensic image and said single recovered data set;   initiating a scanning of said single forensic image and said single recovered data set using said selected plurality of malware engines, wherein each of said malware engines, installed on said independent operating systems of said virtual operating system, may be run concurrently on said single forensic image and said single recovered data set; and   generating a combined report for each of said malware engines reporting the results of said scans.