System and method for real-time forensic instrumentation

Abstract

Real-time forensic instrumentation comprising: a monitoring hook into the notification interface of an operating system; a forensic artifact filter to evaluate events received via the real-time monitoring hook to determine if an event represents a change to a forensic artifact; and a forensic interpreter subsystem to: based on the forensic artifact filter output, collect forensic metadata associated with the forensic artifact and apply a forensic analysis to the forensic artifact to generate a result; generate a forensically interpreted activity for the event, the forensically interpreted activity comprising the forensic metadata, the result of the forensic analysis and a description of a first activity by a user with respect to the forensic artifact; and store the forensically interpreted activity in a digital forensics store.

What is claimed is: 
     
         1 . A computer program product comprising a non-transitory computer-readable medium storing a set of computer-readable instructions, the set of computer-readable instructions executable to:
 register with an operating system of a target computer to receive file change notifications for files in a specified directory in a file system of the target computer;   receive a file change event for a file in the specified directory via a monitoring hook into a notification interface of the operating system of the target computer;   determine that the file change event represents a forensic artifact change according to a forensic artifact definition;   based on a determination that the file change event represents the forensic artifact change;
 load the file into volatile memory for analysis; 
 determine a forensic artifact type of the file; 
 apply a forensic analysis to the file according to the forensic artifact type to determine an activity on the target computer, the forensic analysis selected based on the forensic artifact type determined; 
 collect forensic metadata associated with the file, the forensic metadata comprising a user identifier of a user correlated to the activity on the target computer; 
 generate a forensically interpreted activity for the file change event, the forensically interpreted activity comprising the user identifier and a textual description of the activity on the target computer; and 
 store the forensically interpreted activity in a digital forensics store for the target computer. 
   
     
     
         2 . The computer program product of  claim 1 , wherein the set of computer-readable instructions are executable to implement a filter driver to receive the file change event and determine that the file change event represents the forensic artifact change. 
     
     
         3 . The computer program product of  claim 2 , wherein the filter driver is an out-of-band filter driver. 
     
     
         4 . The computer program product of  claim 1 , wherein the set of computer-readable instructions comprises:
 a set of code libraries, each code library in the set of code libraries corresponding to a different type of forensic artifact; and   code executable to map the file to a first code library from the set of code libraries, the first code library executable to perform said applying the forensic analysis to the file and said generating the forensically interpreted activity and storing the forensically interpreted activity.   
     
     
         5 . The computer program product of  claim 1 , wherein the set of computer-readable instructions comprises code executable to register a callback with the notification interface of the operating system. 
     
     
         6 . The computer program product of  claim 5 , wherein the set of computer-readable instructions comprises a callback routine for the callback, the callback routine executable to perform the said determining that the file change event represents the forensic artifact change. 
     
     
         7 . The computer program product of  claim 1 , wherein the activity on the target computer comprises a run command activity. 
     
     
         8 . The computer program product of  claim 1 , wherein the activity on the target computer comprises a click file activity. 
     
     
         9 . The computer program product of  claim 1 , wherein the activity on the target computer comprises a click attachment activity. 
     
     
         10 . The computer program product of  claim 1 , wherein the set of computer-readable instructions comprises a template activity description and said generating the forensically interpreted activity for the file change event comprises inserting the forensic metadata into the template activity description. 
     
     
         11 . The computer program product of  claim 1 , wherein the forensic artifact change comprises at least one of a creation of the file, an update to the file or a deletion of the file. 
     
     
         12 . A method for real-time digital forensic instrumentation comprising:
 registering with an operating system of a target computer to receive file change notifications for files in a specified directory in a file system of the target computer;   receive a file change event for a file in the specified directory via a monitoring hook into a notification interface of the operating system of the target computer;   determine that the file change event represents a forensic artifact change according to a forensic artifact definition;   based on a determination that the file change event represents the forensic artifact change;
 load the file into volatile memory for analysis; 
 determine a forensic artifact type of the file; 
 apply a forensic analysis to the file according to the forensic artifact type to determine an activity on the target computer, the forensic analysis selected based on the forensic artifact type determined; 
 collect forensic metadata associated with the file, the forensic metadata comprising a user identifier of a user correlated to the activity on the target computer; 
 generate a forensically interpreted activity for the file change event, the forensically interpreted activity comprising the user identifier and a textual description of the activity on the target computer; and 
 store the forensically interpreted activity in a digital forensics store for the target computer. 
   
     
     
         13 . The method of  claim 12 , further comprising implementing a filter driver to receive the file change event and determine that the file change event represents the forensic artifact change. 
     
     
         14 . The method of  claim 12 , further comprising:
 providing a set of code libraries, each code library in the set of code libraries corresponding to a different type of forensic artifact; and   mapping the file to a first code library from the set of code libraries and executing the first code library to perform said applying the forensic analysis to the file and said generating the forensically interpreted activity and storing the forensically interpreted activity.   
     
     
         15 . The method of  claim 12 , comprising registering a callback with the notification interface of the operating system. 
     
     
         16 . The method of  claim 15 , comprising providing a callback routine for the callback, the callback routine, wherein the callback routine performs said determining that the file change event represents the forensic artifact change. 
     
     
         17 . The method of  claim 12 , wherein the activity on the target computer comprises a run command activity. 
     
     
         18 . The method of  claim 12 , wherein the activity on the target computer comprises a click file activity. 
     
     
         19 . The method of  claim 12 , wherein the activity on the target computer comprises a click attachment activity. 
     
     
         20 . The method of  claim 12 , wherein the forensic artifact change comprises at least one of a creation of the file, an update to the file or a deletion of the file. 
     
     
         21 . A system comprising:
 a processor;   a computer-readable medium storing an operating system having a notification interface and a set of computer-readable instructions, the set of computer-readable instructions executable to:
 register with an operating system of a target computer to receive file change notifications for files in a specified directory in the file system of a target computer; 
 receive a file change event for a file in the specified directory via a monitoring hook into a notification interface of the operating system of the target computer; 
 determine that the file change event represents a forensic artifact change according to a forensic artifact definition; 
 based on a determination that the file change event represents the forensic artifact change;
 load the file into volatile memory for analysis; 
 determine a forensic artifact type of the file; 
 apply a forensic analysis to the file according to the forensic artifact type to determine an activity on the target computer, the forensic analysis selected based on the type of forensic artifact determined; 
 collect additional forensic metadata associated with the file, the forensic metadata comprising a user identifier of a user correlated to the activity on the target computer; 
 generate a forensically interpreted activity for the file change event, the forensically interpreted activity comprising the user identifier and a textual description of the activity on the computer; and 
 store the forensically interpreted activity in a digital forensics store for the computer.