Systems, methods, apparatuses, and computer program products for forensic monitoring

Abstract

Systems, methods, apparatuses, and computer program products are provided for forensic monitoring. A system may include a forensic analysis apparatus and one or more monitored apparatuses. A monitored apparatus may monitor activity on the monitored apparatus and extract forensic data based at least in part on monitored activity. The forensic data may be transferred from the monitored apparatus to the forensic analysis apparatus for processing and analysis.

1 . A method for forensic monitoring comprising:
 monitoring activity on a monitored apparatus;   extracting, by a processor, forensic data based at least in part on monitored activity; and   causing transfer of the extracted forensic data from the monitored apparatus to a forensic analysis apparatus configured to archive the forensic data for later analysis.   
     
     
         2 . The method of  claim 1 , wherein extracting forensic data and causing transfer of the extracted forensic data are performed automatically on a scheduled basis. 
     
     
         3 . The method of  claim 1 , wherein data integrity of the extracted forensic data and a chain of custody of the extracted forensic data is preserved during transfer of the extracted forensic through secure transfer of the forensic data from the monitored apparatus to the forensic analysis apparatus. 
     
     
         4 . The method of  claim 1 , wherein extracting forensic data comprises extracting forensic data from one or more files containing evidence of activity on the monitored apparatus. 
     
     
         5 . The method of  claim 4 , wherein extracting forensic data from one or more files comprises extracting forensic data from an operating system file. 
     
     
         6 . The method of  claim 1 , wherein the forensic analysis apparatus is further configured to process the forensic data transferred to the forensic analysis apparatus and generate a report based at least in part on the processed forensic data. 
     
     
         7 . The method of  claim 1 , wherein:
 extracting forensic data and causing transfer of the extracted forensic data are performed automatically on a scheduled basis;   data integrity of the extracted forensic data and a chain of custody of the extracted forensic data is preserved during transfer of the extracted forensic through secure transfer of the forensic data from the monitored apparatus to the forensic analysis apparatus; and   the forensic analysis apparatus is further configured to process the forensic data transferred to the forensic analysis apparatus and generate a report based at least in part on the processed forensic data.   
     
     
         8 . An apparatus for forensic monitoring comprising at least one processor, the at least one processor configured to cause the apparatus to at least:
 monitor activity on a monitored apparatus;   extract forensic data based at least in part on monitored activity; and   cause transfer of the extracted forensic data from the monitored apparatus to a forensic analysis apparatus configured to archive the forensic data for later analysis.   
     
     
         9 . The apparatus of  claim 8 , wherein the at least one processor is further configured to cause the apparatus to extract forensic data and cause transfer of the extracted forensic data automatically on a scheduled basis. 
     
     
         10 . The apparatus of  claim 8 , wherein the at least one processor is further configured to cause the apparatus to preserve data integrity of the extracted forensic data and a to preserve chain of custody of the extracted forensic data during transfer of the extracted forensic through secure transfer of the forensic data from the monitored apparatus to the forensic analysis apparatus. 
     
     
         11 . The apparatus of  claim 8 , wherein the at least one processor is further configured to cause the apparatus to extract forensic data at least in part by extracting forensic data from one or more files containing evidence of activity on the monitored apparatus. 
     
     
         12 . The apparatus of  claim 11 , wherein the at least one processor is further configured to cause the apparatus to extract forensic data from an operating system file. 
     
     
         13 . The apparatus of  claim 8 , wherein the forensic analysis apparatus is further configured to process the forensic data transferred to the forensic analysis apparatus and generate a report based at least in part on the processed forensic data. 
     
     
         14 . A method for forensic analysis comprising:
 receiving, at a forensic analysis apparatus, forensic data transferred from a monitored apparatus to the forensic analysis apparatus, the forensic data comprising forensic data extracted by the monitored apparatus based at least in part on monitored activity on the monitored apparatus; and   archiving the forensic data for later analysis, wherein archiving the received forensic data is performed under control of a processor.   
     
     
         15 . The method of  claim 14 , wherein receiving the forensic data comprises receiving forensic data securely transferred from the monitored apparatus to the forensic analysis apparatus to preserve data integrity and a chain of custody of the forensic data. 
     
     
         16 . The method of  claim 14 , further comprising:
 processing the received forensic data to generate a processed set of forensic data;   wherein archiving the forensic data comprises archiving the processed set of forensic data.   
     
     
         17 . The method of  claim 14 , further comprising:
 analyzing the forensic data; and   generating a report based at least in part on the analysis of the forensic data.   
     
     
         18 . The method of  claim 17 , further comprising:
 determining one or more key risk indicator values relating to the monitored apparatus based at least in part on the analysis;   wherein generating the report comprises generating a report including the determined key risk indicator values.   
     
     
         19 . The method of  claim 17 , wherein receiving the forensic data comprises receiving forensic data securely transferred from the monitored apparatus to the forensic analysis apparatus to preserve data integrity and a chain of custody of the forensic data, the method further comprising:
 processing the received forensic data to generate a processed set of forensic data;   wherein archiving the forensic data comprises archiving the processed set of forensic data, wherein analyzing the forensic data comprises analyzing the processed set of forensic data.   
     
     
         20 . An apparatus for forensic analysis comprising at least one processor, the at least one processor configured to cause the apparatus to at least:
 receive forensic data transferred from a monitored apparatus to the apparatus, the forensic data comprising forensic data extracted by the monitored apparatus based at least in part on monitored activity on the monitored apparatus; and   archive the forensic data for later analysis.   
     
     
         21 . The apparatus of  claim 20 , wherein the at least one processor is further configured to cause the apparatus to receive the forensic data by receiving forensic data securely transferred from the monitored apparatus to the forensic analysis apparatus to preserve data integrity and a chain of custody of the forensic data. 
     
     
         22 . The apparatus of  claim 20 , wherein the at least one processor is further configured to cause the apparatus to:
 process the received forensic data to generate a processed set of forensic data; and   archive the forensic data at least in part by archiving the processed set of forensic data.   
     
     
         23 . The apparatus of  claim 20 , wherein the at least one processor is further configured to cause the apparatus to:
 analyze the forensic data; and   generate a report based at least in part on the analysis of the forensic data.   
     
     
         24 . The apparatus of  claim 23 , wherein the at least one processor is further configured to cause the apparatus to:
 determine one or more key risk indicator values relating to the monitored apparatus based at least in part on the analysis; and   generate the report at least in part by generating a report including the determined key risk indicator values.