Electronic discovery system and method

Abstract

A computer investigation system and method that conducts electronic discovery of desired files across a live network in a forensically sound manner. The investigation entails an examining machine electronically identifying, collecting, and preserving evidence from target machines that is responsive to a set of investigation criteria. The set of investigation criteria is associated with an investigation subject that is identified by a global unique identifier (GUID). As the investigation subject is applied to the various files, the responsive files are stamped with the GUID and preserved in a container file referred to as a logical evidence file (LEF). The GUID allows the results of an investigation to be easily and reliably traced to the particular investigation subject that was applied.

1 . A computer-implemented method for conducting investigations of a plurality of target devices in a data communications network, the method comprising:
 defining, under control of a computer, one or more filter conditions;   grouping the one or more filter conditions into a single investigation subject;   generating an evidence container;   applying by a first examining machine the investigation subject to a plurality of files stored in a plurality of first target devices during an investigation session;   receiving from one or more of the plurality of first target devices at least metadata of one or more of the plurality of files matching the plurality of filter conditions of the applied investigation subject, wherein the matching files are only a subset of the plurality of files stored in the one or more target devices and the one or more target devices transmit at least the metadata for only the matching files; and   storing in the evidence container at least the received metadata of the matching files without modification to the received metadata due to the storing.   
     
     
         2 . The method of  claim 1  further comprising:
 identifying a set of target devices to be investigated; and 
 monitoring status of the investigation of each of the target devices in the set. 
 
     
     
         3 . The method of  claim 2  further comprising:
 applying by a second examining machine the investigation subject to a plurality of files stored in a plurality of second target devices included in the identified set, wherein the second examining machine applies the investigation subject concurrently with the first examining machine. 
 
     
     
         4 . The method of  claim 3 , wherein the first and second examining machines synchronize access to the set of target devices to be investigated. 
     
     
         5 . The method of  claim 1  further comprising:
 automatically generating at least one identifier uniquely identifying the investigation subject; and 
 storing in memory the investigation subject and the identifier in association with each other. 
 
     
     
         6 . The method of  claim 5  further comprising:
 storing the identifier in the evidence container for associating content in the evidence container with the applied investigation subject. 
 
     
     
         7 . The method of  claim 1 , wherein at least one of the one or more filter conditions specify file metadata, the method further comprising:
 retrieving filesystem data of the plurality of first target devices;   comparing the filesystem data with the specified file metadata; and   identifying the one or more of the plurality of files based on the comparison.   
     
     
         8 . The method of  claim 1 , wherein at least one of the one or more filter conditions includes one or more keywords for identifying files in the plurality of first target devices containing the one or more keywords. 
     
     
         9 . The method of  claim 1 , wherein at least one of the one or more filter conditions identifies a specific source file for identifying a file in the plurality of first target devices matching the source file. 
     
     
         10 . The method of  claim 9  further comprising:
 identifying lengths of the source file and a file in a particular target machine that is being considered for a match; 
 determining whether the lengths are equal; 
 if the lengths are equal, invoking the target machine to compute a digital signature value of the file being considered for a match; 
 retrieving the digital signature values of the source file and the file being considered for a match; 
 determining whether the digital signature values are equal; and 
 if the digital signature values are equal, identifying the file being considered for a match as a matching file. 
 
     
     
         11 . The method of  claim 1  further comprising storing content of the matching files in the evidence container without making a disk image of one or more hard disks of the one or more target devices storing the matching files. 
     
     
         12 . The method of  claim 1 , wherein the metadata includes timestamps, the method further comprising:
 preserving, without modification, timestamps of when each of the matching files was modified, accessed, and created in the corresponding target device; and   writing into the evidence container the preserved timestamps of each of the matching files.   
     
     
         13 . The method of  claim 1 , wherein the received metadata is stored in a body of the evidence container as text data. 
     
     
         14 . The method of  claim 1 , wherein the evidence container is a file created by the first examining machine. 
     
     
         15 . A system for conducting investigations of a plurality of target devices in a data communications network, the system comprising:
 one or more processors; and   one or more memory devices operably coupled to the one or more processors storing program instructions therein, each of the one or more processors being operable to execute one or more of the program instructions, the program instructions including:
 defining one or more filter conditions; 
 grouping the one or more filter conditions into a single investigation subject; 
 generating an evidence container; 
 applying the investigation subject to a plurality of files stored in the plurality of target devices during an investigation session; 
 receiving from one or more of the plurality of target devices at least metadata of one or more of the plurality of files matching the plurality of filter conditions of the applied investigation subject, wherein the matching files are only a subset of the plurality of files stored in the one or more target devices and the one or more target devices transmit at least the metadata for only the matching files; and 
 storing in the evidence container at least the received metadata of the matching files without modification to the received metadata due to the storing. 
   
     
     
         16 . The system of  claim 15 , wherein the program instructions further include:
 identifying a set of target devices to be investigated; and   monitoring status of the investigation of each of the target devices in the set.   
     
     
         17 . The system of  claim 15 , wherein the program instructions further include:
 automatically generating at least one identifier uniquely identifying the investigation subject; and   storing in memory the investigation subject and the identifier in association with each other.   
     
     
         18 . The system of  claim 17 , wherein the program instructions further include:
 storing the identifier in the evidence container for associating content in the evidence container with the applied investigation subject.   
     
     
         19 . The system of  claim 15 , wherein at least one of the one or more filter conditions specify file metadata, and the program instructions further include:
 retrieving filesystem data of the plurality of target devices;   comparing the filesystem data with the specified file metadata; and   identifying the one or more of the plurality of files based on the comparison.   
     
     
         20 . The system of  claim 15 , wherein at least one of the one or more filter conditions includes one or more keywords for identifying files in the plurality of target devices containing the one or more keywords. 
     
     
         21 . The system of  claim 15 , wherein at least one of the one or more filter conditions identifies a specific source file for identifying a file in the plurality of target devices matching the source file. 
     
     
         22 . The system of  claim 21 , wherein the program instructions further include:
 identifying lengths of the source file and a file in a particular target machine that is being considered for a match;   determining whether the lengths are equal;   if the lengths are equal, invoking the target machine to compute a digital signature value of the file being considered for a match;   retrieving the digital signature values of the source file and the file being considered for a match;   determining whether the digital signature values are equal; and   if the digital signature values are equal, identifying the file being considered for a match as a matching file.   
     
     
         23 . The system of  claim 17 , wherein the program instructions further include storing content of the matching files in the evidence container without making a disk image of one or more hard disks of the one or more target devices storing the matching files. 
     
     
         24 . The system of  claim 15 , wherein the metadata includes timestamps, and the program instructions further include:
 preserving, without modification, timestamps of when each of the matching files was modified, accessed, and created in the corresponding target device; and   writing into the evidence container the preserved timestamps of each of the matching files.   
     
     
         25 . The system of  claim 15 , wherein the received metadata is stored in a body of the evidence container as text data. 
     
     
         26 . The system of  claim 15 , wherein the evidence container is a file created by the examining machine.