Forensic system, forensic method, and forensic program

Abstract

Embodiments of the inventive concept can extract digital document information related with a specific individual to achieve a work load reduction associated with evidentiary material preparation for litigation. A specific individual is selected from at least one individual included in user information. Only digital document information which was accessed by the specific individual is extracted based on access history information regarding the selected specific individual. Additional information indicating whether or not document files in the extracted digital document information are each related with the litigation is set, and a document file related with the litigation is outputted based on the additional information.

1 . A forensic system configured to acquire digital information recorded on a plurality of computers or a server to analyze the acquired digital information, the forensic system comprising:
 a digital information acquiring unit configured to acquire digital information containing digital document information composed of a plurality of document files, to acquire user information about users using the plurality of computers or the server, and to acquire access history information which shows a fact that the users accessed a document file recorded in the server;   a recording unit configured to record therein digital information acquired by the digital information acquiring unit;   a display unit configured to display the recorded digital information;   a specific-individual selecting unit configured to select, via the display unit, a specific individual from at least one user contained in the user information;   a digital document information extracting unit configured to extract only digital document information which was accessed by the specific individual based on the access history information related with the selected specific individual;   an additional information setting unit configured to set, via the display unit, additional information indicating whether or not document files in the extracted digital document information are each related with litigation; and   an output unit configured to output a document file related with the litigation based on the additional information.   
     
     
         2 . The forensic system according to  claim 1 , wherein
 the digital information acquiring unit is configured to acquire second digital information including second digital document information, second user information and second access history information, the second digital information being recorded in a second server different from the server; and   the forensic system is configured to use not only the digital information but also the second digital information, and to extract the second digital document information based on the second access history information.   
     
     
         3 . The forensic system according to  claim 1 , further comprising:
 a text information extracting unit configured to extract text information for each of the plurality of document files from the recorded digital document information;   a keyword selecting unit configured to select a keyword; and   a searching unit configured to search a document file including the selected keyword based on the extracted text information, wherein   the additional information setting unit is configured to set additional information to the searched document file.   
     
     
         4 . The forensic system according to  claim 1 , further comprising:
 a data converting unit configured to convert the document file in the digital document information recorded by the recording unit to a predetermined data format, wherein   the document file converted by the data converting unit is processed with the same data format as the converted data format in a period before being outputted by the output unit.   
     
     
         5 . The forensic system according to  claim 1 , further comprising:
 a statistical data producing unit configured to produce statistical data represented by data size for each data format of the acquired digital document information or statistical data represented by data size for each data format of the searched digital document information.   
     
     
         6 . The forensic system according to  claim 1 , further comprising:
 a clock unit which, when newly acquiring digital information, is configured to clock a time and date of the acquisition of the digital information, the digital information further including folder information saving digital document information, wherein   the digital information acquiring unit is configured to acquire the digital document information and the folder information which were produced after a time and date previously clocked by the clock unit, and is configured to acquire user information and access history information related with the acquired digital document information and the folder information.   
     
     
         7 . The forensic system according to  claim 1 , wherein
 the forensic system further includes a plurality of servers,   the digital information extracting unit and the searching unit are separate from the servers, respectively, and   the separate digital information extracting unit, the searching unit, and the plurality of servers are connected to each other via a network.   
     
     
         8 . The forensic system according to  claim 1 , wherein
 the forensic system is configured to be simultaneously used by a plurality of operators, and   the additional information setting unit is configured to set additional information by different operators.   
     
     
         9 . The forensic system according to  claim 1 , wherein
 the output unit is either one of a printer and a digital document producing device.   
     
     
         10 . A forensic method for acquiring digital information recorded on a plurality of computers or a server to analyze the acquired digital information, the method comprising:
 acquiring digital information containing digital document information composed of a plurality of document files, acquiring user information about users using the plurality of computers or the server, and acquiring access history information which shows a fact that the users accessed a document file recorded in the server;   recording the acquired digital information;   displaying the recorded digital information;   selecting a specific individual from at least one user contained in the user information;   extracting only digital document information which was accessed by the specific individual based on the access history information related with the selected specific individual;   setting additional information indicating whether or not document files in the extracted digital document information are each related with litigation; and   outputting a document file related with the litigation based on the additional information.   
     
     
         11 . A recording program recording therein a forensic program which acquires digital information recorded on a plurality of computers or a server to analyze the acquired digital information, for causing a computer to execute:
 a function of acquiring digital information containing digital document information composed of a plurality of document files, acquiring user information about users using the plurality of computers or the server, and acquiring access history information which shows a fact that the users accessed a document file recorded in the server;   a function of recording the acquired digital information;   a function of displaying the recorded digital information;   a function of selecting a specific individual from at least one user contained in the user information;   a function of extracting only digital document information which was accessed by the specific individual based on the access history information related with the selected specific individual;   a function of setting additional information indicating whether or not document files in the extracted digital document information are each related with litigation; and   a function of outputting a document file related with the litigation based on the additional information.