Presentation of an extracted artifact based on an indexing technique
View Patent ↗A system and method of presentation of an extracted artifact based on an indexing technique are disclosed. In an embodiment, the method includes indexing a database of a captured network characteristic data using a processor and a memory to form an indexed capture data. The method includes enhancing a query response time with the indexed capture data. The method further includes searching the indexed capture data to generate a capture query result. The capture query result includes an extracted artifact. The method also includes graphically presenting the capture query result as at least one of an artifact list and an artifact image.
1. A method, comprising:
indexing a database of captured network characteristic data, wherein the captured network characteristic data includes payload data and artifact characteristic data for captured network packets subject to network packet level processing, wherein the captured network packets include local area network packets and wide area network packets;
presenting a query interface that specifies parameters derived from network packet level processing;
receiving a query from the query interface, wherein the query includes specified parameters from the query interface, wherein the specified parameters include wide area network content filtering, local area network content filtering and desktop content filtering;
processing the query and the specified parameters against the database to form search results; and
supplying the search results in response to the query, wherein the search results include a wide area network search results section, a local area network search results section and a desktop search results section.
2. The method of claim 1 wherein parameters derived from network packet level processing include a user internet protocol address.
3. The method of claim 1 wherein parameters derived from network packet level processing include network transport mechanisms.
4. The method of claim 3 wherein the network transport mechanisms include HTTP sessions.
5. The method of claim 3 wherein the network transport mechanisms include FTP sessions.
6. The method of claim 1 further comprising acquiring a snapshot of an artifact image in network packets.
7. The method of claim 6 further comprising forming a thumbnail view of the snapshot.
8. The method of claim 7 further comprising providing the thumbnail view with the search results.
9. The method of claim 1 wherein the search results are organized by content type.
10. The method of claim 1 wherein the database categorizes payload data as at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a presentation, a program file and a data package.