Systems and methods for digital evidence preservation, privacy, and recovery
View Patent ↗Systems and methods for preserving digital evidence using a self-protecting storage device are provided, by copying digital evidence from a source drive to a self-protecting storage device, writing and storing metadata relating to the copying such as date, time, and those present, and engaging the self-protecting features of the storage device such that the copied digital evidence cannot be altered.
1. A system for preserving electronic evidence, the system comprising:
a self-protecting storage device (SPSD), comprising a first computer-readable medium having self-protecting features that, when engaged, limit recovery of data stored on the SPSD; and
a software medium coupled to the SPSD, the software medium comprising a second computer-readable medium containing a set of instructions for:
copying electronic data from a source medium coupled to the SPSD;
writing metadata relating to the copying to a secure area on the SPSD, wherein the metadata comprises one or more of the following:
identity of an individual performing the copying;
a description of the electronic data;
time and date of the copying;
provenance of the SPSD; and
location where the copying is performed;
and wherein the metadata is cryptographically signed and a public key credential is attached to the metadata; and
engaging the self-protecting features of the SPSD, whereby the SPSD is converted to a read-only state.
2. The system of claim 1 , wherein the SPSD is coupled to the source medium via a connector including at least one of USB, IEEE 1394, IEEE 802.3, SATA, eSATA, SAS, and Thunderbolt.
3. The system of claim 1 , wherein the SPSD comprises a USB hard drive.
4. The system of claim 1 , wherein the SPSD is wirelessly coupled to the source medium.
5. The system of claim 1 , wherein the metadata is written to the secure area before the self-protecting features are engaged.
6. The system of claim 1 , wherein the converting the SPSD to read-only is permanent and unalterable.
7. The system of claim 1 , wherein the converting the SPSD to read-only is under control of one or more cryptographically strong secrets.
8. The system of claim 1 , wherein the SPSD is converted to an openly read-only state.
9. The system of claim 1 , wherein the SPSD is converted to a read-only state such that the data on the SPSD is accessible by one or more authorized users and inaccessible to unauthorized users.
10. The system of claim 1 , the system further comprising encrypting the electronic data.
11. The system of claim 10 , wherein the encrypting is performed using a self-encrypting capability of the SPSD.
12. The system of claim 1 , the system further comprising creating a log of all read activity that occurs after the self-protecting features are engaged.
13. The system of claim 12 , wherein the log contains the time and date of the engaging of the self-protecting features.
14. The system of claim 12 , wherein the log is stored in a non-secure area of the SPSD, and the log is read-only by one or more authorized log users and inaccessible to unauthorized log users.
15. The system of claim 12 , wherein the log is cryptographically signed and a public key credential attached.
16. The system of claim 1 , wherein the set of instructions further comprises storing on the SPSD a cryptographic hash of all the electronic data stored on the SPSD.
17. The system of claim 16 , wherein the cryptographic hash is stored in a secure area that is not part of the electronic data stored on the SPSD.
18. The system of claim 16 , wherein the cryptographic hash is cryptographically signed and a public key credential attached.
19. The system of claim 1 , wherein the set of instructions further comprises reverting the SPSD to a clean state.
20. The system of claim 19 , wherein the reverting is performed using a cryptographic erasure and revert.
21. The system of claim 19 , wherein the reverting is performed only by one or more authorized reverting users.
22. A method for preserving electronic evidence, the method comprising:
copying electronic data to a self-protecting storage device (SPSD) from a source medium, wherein the SPSD comprises a first computer-readable medium having self-protecting features that, when engaged, limit recovery of data stored on the SPSD;
writing metadata relating to the copying to the SPSD, wherein the metadata comprises one or more of the following:
identity of an individual performing the copying;
a description of the electronic data;
time and date of the copying;
provenance of the SPSD; and
location where the copying is performed;
and wherein the metadata is cryptographically signed and a public key credential is attached to the metadata; and
engaging the self-protecting features of the SPSD, whereby the SPSD is converted to a read-only state.
23. The method of claim 22 , wherein the SPSD is coupled to the source medium via a connector including at least one of USB, IEEE 1394, IEEE 802.3, SATA, eSATA, SAS, and Thunderbolt.
24. The method of claim 22 , wherein the SPSD comprises a USB hard drive.
25. The method of claim 22 , wherein the SPSD is wirelessly coupled to the source medium.
26. The method of claim 22 , wherein the metadata is written to a secure area on the SPSD.
27. The method of claim 26 , wherein the metadata is written to the secure area before the engaging of the self-protecting features.
28. The method of claim 22 , wherein the engaging of the self-protecting features comprises converting the SPSD to read-only.
29. The method of claim 28 , wherein the converting the SPSD to read-only is permanent and unalterable.
30. The method of claim 28 , wherein the converting the SPSD to read-only is under control of one or more cryptographically strong secrets.
31. The method of claim 28 , wherein the SPSD is converted to a read-only state such that the data on the SPSD is accessible by one or more authorized users and inaccessible to unauthorized users.
32. The method of claim 22 , the method further comprising encrypting the electronic data.
33. The method of claim 32 , where the encrypting is performed using a self-encrypting capability of the SPSD.
34. The method of claim 22 , the method further comprising creating a log of all read activity that occurs after the self-protecting features are engaged.
35. The method of claim 34 , wherein the log is stored in a non-secure area of the SPSD, and the log is read-only by one or more authorized log users and inaccessible to unauthorized log users.
36. The method of claim 22 , the method further comprising storing on the SPSD a cryptographic hash of all the electronic data stored on the SPSD.
37. The method of claim 36 , wherein the cryptographic hash is stored in a secure area that is not part of the electronic data stored on the SPSD.
38. The method of claim 22 , the method further comprising reverting the SPSD to a clean state.