Granted Patent B2

US 8,566,476 · App. 12/024,858 · Granted Oct 22, 2013

Inventors: Jason Shiffer (Vienna, VA); Matthew Frazier (New York, NY); Sean Cunningham (Washington, DC); Scott Hogsten (West Jefferson, OH); Eric Helvey (Alexandria, VA); Theodore Wilson (Alexandria, VA)

Assignee: Mandiant Corporation

Abstract

Claims (49)

1. A method of analyzing data related to an event comprising:

(a) providing an interface to a user on a central computer;

(b) contacting a plurality of memory locations coupled to the central computer at a first time;

(c) copying data from the plurality of memory locations to the central computer;

(d) converting the data to a uniform format;

(e) providing the user access to the data through the interface;

(f) contacting the plurality of memory locations at a second time, comparing the data on the plurality of memory locations to the data on the central computer, and updating the display of the data to the user if data stored on the plurality of memory locations has changed more than a predetermined amount, the predetermined amount being a specific user-defined value;

(g) determining what has changed in the data stored on the plurality of memory locations; and

(h) conducting a timeline analysis to determine how the central computer has changed over time, the timeline analysis operable to exclude or include data based on a time period,

wherein only stored files of a file type requested by the user are able to be copied to the central computer;

wherein the display is updated using a syndication feed;

wherein the syndication feed is in Atom syndication format.

2. The method of claim 1 wherein the plurality of memory locations are coupled to the central computer through a network.

3. The method of claim 1 wherein converting the data to a uniform format occurs before copying data from the plurality of memory locations to the central computer.

4. The method of claim 1 wherein the uniform format is extensible markup language.

5. The method of claim 1 wherein providing the user access to the data through the interface further comprises executing a search query of the data requested by the user.

6. The method of claim 1 wherein the contacting the plurality of memory locations at a second time is repeated periodically.

7. The method of claim 6 wherein the contacting the plurality of memory locations at a second time is repeated periodically at a user-defined time interval.

8. The method of claim 1 wherein the predetermined amount is a number of modified files.

9. The method of claim 1 wherein the syndication feed comprises details of the data that has changed and upon which memory locations the data is located.

10. The method of claim 1 wherein the user is alerted when the display is updated.

11. The method of claim 10 wherein the user is presented with an option to copy any changed data from the memory locations to the central computer.

12. A method of tracking data comprising:

(a) contacting a plurality of computer environments coupled to a central computer;

(b) identifying stored files on the plurality of computer environments;

(c) copying the stored files to the central computer;

(d) converting the stored files into uniform files in a uniform file format;

(e) comparing the uniform files to the stored files on the plurality of computer environments;

(f) alerting the user if the difference between the uniform files and the stored files is greater than a predetermined amount, the predetermined amount being a specific user-defined value; and

(g) conducting, a timeline analysis to determine how the central computer has changed over time, the timeline analysis operable to exclude or include data based on a time period,

wherein only stored files of a file type requested by the user are able to be copied to the central computer;

wherein the display is updated using a syndication feed to provide any updates to the stored files to the user;

wherein the syndication feed is in Atom syndication format.

13. The method of claim 12 wherein the uniform file format is extensible markup language.

14. The method of claim 12 wherein comparing the uniform files to the stored files occurs periodically.

15. The method of claim 14 wherein comparing the uniform files to the stored files occurs periodically at user-defined time intervals.

16. The method of claim 12 further comprising creating a plurality of indexes of the uniform data.

17. The method of claim 16 further comprising executing a search of the indexes based on their defined search terms.

18. A system of analyzing data comprising:

(a) means for providing an interface to a user on a central computer;

(b) means for contacting a plurality of memory locations coupled to the central computer at a first time;

(c) means for copying data from the plurality of memory locations to the central computer;

(d) means for converting the data to a uniform format;

(e) means for providing the user access to the data through the interface; and

(f) means for contacting the plurality of memory locations at a second time, comparing the data on the memory locations to the data on the central computer, and alerting the user if data stored on the plurality of memory locations has changed more than a predetermined amount, the predetermined amount being a specific user-defined value: and

(g) conducting a timeline analysis to determine how the central computer has changed over time, the timeline analysis operable to exclude or include data based on a time period,

wherein only stored files of a file type requested by the user are able to be copied to the central computer;

wherein the display is updated using a syndication feed to provide any updates to the stored files to the user;

wherein the syndication feed is in Atom syndication format.

Assignments (16)

Continuity (1)