Obtaining Complete Forensic Images Of Electronic Storage Media

Abstract

In a method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media is part of a computer system. The method includes the steps of: (a) storing a data collection program on an external storage device; (b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device; (c) requiring the custodian to connect the external storage device to a computer system containing the storage media; (d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data; (e) authenticating the forensic image; and (f) preserving an exact copy of the forensic image without making changes to the forensic image.

What is claimed is: 
     
         1 . An external storage device storing in memory one or more computer instructions which, when executed by a processor, cause:
 receiving, from a first computer system, a data collection program and storing the data collection program in the external storage device;   in response to receiving one or more configuration instructions from the first computer system, configuring the data collection program based on the one or more configuring instructions;   establishing a communications connection between the external storage device and a second computer system, wherein the second computer system includes one or more storage media;   causing an execution of the data collection program to perform:
 displaying a splash screen on a display screen of the second computer system; 
 via the splash screen, using the second computer system to forensically collect electronic data stored on one or more of the one or more storage media included in the second computer system; 
 based on the collected electronic data, creating a forensic image, on the external storage device, of the one or more of the one or more storage media containing the electronic data; 
 auditing an inventory of the second computer system and storing auditing report data in a file; and 
 preserving a copy of the forensic image and the file that includes the auditing report data onto the external storage device. 
   
     
     
         2 . The external storage device of  claim 1 , wherein executing of the one or more computer instructions that causes auditing of the inventory further causes collecting, and storing in the file for later review, one or more of: a make and a model of the second computer system; a make and model of the second computer system's storage media that was imaged; a size and available capacity of the second computer system's storage media that was imaged; an operating system install date and a time; a user log on statistics; or identification of one or more devices attached to the second computer system. 
     
     
         3 . The external storage device of  claim 1 , wherein the one or more configuration instructions received from the first computer system comprise one or more instructions for performing one of more of: selecting a desired level of encryption, requesting specific input of information from a custodian of the electronic data, selecting one or more switches to capture data stored in a RAM, selecting a drive to be imaged, selecting data capturing switches, to be used during a process of collecting the electronic data, from a group of switches comprising: verification, chunked file sizes, logging options, and verification, or selecting audit switches, to be used to perform a system audit after termination of the imaging by the data collection program, from a group of audit switches comprising: operating system version, logged-on user name, hard drive size, and electronic serial numbers. 
     
     
         4 . The external storage device of  claim 1 , wherein the external storage device is sent to a custodian of the electronic data, and
 wherein the external storage device is sent to the custodian together with means for the custodian to return the external storage device to a requesting entity.   
     
     
         5 . The external storage device of  claim 1 , wherein executing of the one or more computer instructions further causes:
 in response to establishing the connection between the external storage device and the computer system, causing displaying, in the splash screen, a request for a custodian to enter his name and/or his email address.   
     
     
         6 . The external storage device of  claim 5 , wherein executing of the one or more computer instructions further causes:
 after displaying in the splash screen the request for the custodian to enter his name and email address, causing displaying a request for the custodian to select which electronic storage media, from the one or more storage media, to image.   
     
     
         7 . The external storage device of  claim 1 ,
 wherein the instructions that cause storing the data collection program on the external storage device, further cause encrypting the external storage device, and   wherein the encrypting is done without input from a custodian.   
     
     
         8 . The external storage device of  claim 1 , wherein the instructions that cause storing the data collection program on the external storage device, further cause setting one or more switches within the data collection program to designate one or more particular storage media inside the second computer system, or attached to the second computer system, are to be forensically imaged. 
     
     
         9 . The external storage device of  claim 1 , wherein the instructions that cause collecting the electronic data further cause preventing a custodian from deselecting certain files, and preventing the custodian from deleting or corrupting data. 
     
     
         10 . The external storage device of  claim 1 , wherein the external storage device includes a communications interface for communicating data and receiving an operational power. 
     
     
         11 . A non-transitory, computer-readable storage medium, storing one or more computer instructions which, when executed by a processor, cause the processor to perform:
 receiving, from a first computer system, a data collection program and storing the data collection program in an external storage device;   in response to receiving one or more configuration instructions from the first computer system, configuring the data collection program based on the one or more configuring instructions;   establishing a communications connection between the external storage device and a second computer system, wherein the second computer system includes one or more storage media;   causing an execution of the data collection program to perform:
 displaying a splash screen on a display screen of the second computer system; 
 via the splash screen, using the second computer system to forensically collect electronic data stored on one or more of the one or more storage media included in the second computer system; 
 based on the collected electronic data, creating a forensic image, on the external storage device, of the one or more of the one or more storage media containing the electronic data; 
 auditing an inventory of the second computer system and storing auditing report data in a file; and 
 preserving a copy of the forensic image and the file that includes the auditing report data onto the external storage device. 
   
     
     
         12 . The non-transitory, computer-readable storage medium of  claim 11 , wherein executing of the one or more computer instructions that causes auditing of the inventory further causes collecting, and storing in the file for later review, one or more of: a make and a model of the second computer system; a make and model of the second computer system's storage media that was imaged; a size and available capacity of the second computer system's storage media that was imaged; an operating system install date and a time; a user log on statistics; or identification of one or more devices attached to the second computer system. 
     
     
         13 . The non-transitory, computer-readable storage medium of  claim 11 , wherein the one or more configuration instructions received from the first computer system comprise one or more instructions for performing one of more of: selecting a desired level of encryption, requesting specific input of information from a custodian of the electronic data, selecting one or more switches to capture data stored in a RAM, selecting a drive to be imaged, selecting data capturing switches, to be used during a process of collecting the electronic data, from a group of switches comprising: verification, chunked file sizes, logging options, and verification, or selecting audit switches, to be used to perform a system audit after termination of the imaging by the data collection program, from a group of audit switches comprising: operating system version, logged-on user name, hard drive size, and electronic serial numbers. 
     
     
         14 . The non-transitory, computer-readable storage medium of  claim 11 , wherein the external storage device is sent to a custodian of the electronic data, and
 wherein the external storage device is sent to the custodian together with means for the custodian to return the external storage device to a requesting entity.   
     
     
         15 . The non-transitory, computer-readable storage medium of  claim 11 , wherein executing of the one or more computer instructions further causes:
 in response to establishing the connection between the external storage device and the computer system, causing displaying, in the splash screen, a request for a custodian to enter his name and email address.   
     
     
         16 . The non-transitory, computer-readable storage medium of  claim 15 , wherein executing of the one or more computer instructions further causes:
 after displaying in the splash screen the request for the custodian to enter his name and email address, causing displaying a request for the custodian to select which electronic storage media, from the one or more storage media, to image.   
     
     
         17 . The non-transitory, computer-readable storage medium of  claim 11 , wherein the instructions that cause storing the data collection program on the external storage device, further cause encrypting the external storage device, and
 wherein the encrypting is done without input from a custodian.   
     
     
         18 . The non-transitory, computer-readable storage medium of  claim 11 , wherein the instructions that cause storing the data collection program on the external storage device, further cause setting one or more switches within the data collection program to designate one or more particular storage media inside the second computer system, or attached to the second computer system, are to be forensically imaged. 
     
     
         19 . A data collection method comprising:
 receiving, from a first computer system, a data collection program and storing the data collection program in an external storage device,   in response to receiving one or more configuration instructions from the first computer system, configuring the data collection program based on the one or more configuring instructions,   establishing a communications connection between the external storage device and a second computer system, wherein the second computer system includes one or more storage media,   causing an execution of the data collection program to perform:
 displaying a splash screen on a display screen of the second computer system; 
 via the splash screen, using the second computer system to forensically collect electronic data stored on one or more of the one or more storage media included in the second computer system; 
 based on the collected electronic data, creating a forensic image, on the external storage device, of the one or more of the one or more storage media containing the electronic data; 
 auditing an inventory of the second computer system and storing auditing report data in a file; and 
 preserving a copy of the forensic image and the file that includes the auditing report data onto the external storage device. 
   
     
     
         20 . The method of  claim 19 , wherein the auditing of the inventory comprises collecting, and storing in the file for later review, one or more of: a make and a model of the second computer system; a make and model of the second computer system's storage media that was imaged; a size and available capacity of the second computer system's storage media that was imaged; an operating system install date and a time; a user log on statistics; or identification of one or more devices attached to the second computer system.