System and method for conducting searches at target devices
A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network.
1. A system for conducting computer investigations of a storage device at a target device remotely from a client device, comprising:
a client device coupled to a target device over a network, the target device coupled to a storage device and having a servlet executing thereon; and
a non-transitory computer readable storage medium comprising instructions for:
identifying a file stored in the storage device;
transmitting a search key to the servlet at the target device over the network, the search key comprising a keyword;
transmitting file extents including a sector of the storage device and a count associated with the identified file to the servlet on the target device over the network, wherein in response to receipt of the search key and the file extents over the network, the servlet on the target device searches the coupled storage device for the search key received over the network only at the sector and count of the storage device identified by the file extents received over the network without opening the file and generates a search result, the search result identifying at least one sector on the storage device associated with a hit for the search key;
receiving the search result over the network from the target device;
determining one or more sectors of the at least one sector included in the search result to examine; and
sending a command to the servlet at the target device to retrieve the one or more sectors of the storage device; and
displaying the search result on a display device.
2. The system of claim 1 , wherein the file extents identify sectors or blocks of the storage device.
3. The system of claim 2 , wherein the location of the search result identifies one or more sectors or blocks of the storage device that include a match for the search key.
4. The system of claim 3 , wherein the instructions further comprise instructions for determining the file extents associated with the identified file, wherein identifying the file and determining the file extents associated with the identified file result from an examination of partition data to determine a file structure of the storage device, the partition data obtained by transmitting a request for partition data of the storage device to the target device over the network and receiving partition data for the storage device from the target device over the network.
5. The system of claim 4 , wherein the request is a read command for sector 0 of the storage device.
6. The system of claim 1 , wherein the target device searches the coupled storage device without use of operating system utilities.
7. The system of claim 1 , wherein at least one of the file extents corresponds to file slack associated with the identified file.
8. In a networked computer investigation system including a client device and a target device coupled over a network, a method for remotely conducting computer investigations of a storage device coupled to the target device from the client device, the target device having a servlet executing thereon, the method comprising:
identifying a file stored in the storage device;
transmitting a search key to the servlet at the target device over the network, the search key comprising a keyword;
transmitting file extents including a sector of the storage device and a count associated with the identified file to the servlet on the target device over the network, wherein in response to receipt of the search key and the file extents over the network, the servlet on the target device searches the coupled storage device for the search key received over the network only at the sector and count of the storage device identified by the file extents received over the network without opening the file and generates a search result, the search result identifying at least one sector on the storage device associated with a hit for the search key;
receiving the search result over the network from the target device;
determining one or more sectors of the at least one sector included in the search result to examine; and
sending a command to the servlet at the target device to retrieve the one or more sectors of the storage device; and
displaying the search result on a display device.
9. The method of claim 8 , wherein the file extents identify sectors or blocks of the storage device.
10. The method of claim 9 , wherein the location of the search result identifies one or more sectors or blocks of the storage device that include a match for the search key.
11. The method of claim 8 , wherein the target device searches the coupled storage device without use of operating system utilities.
12. The method of claim 8 , wherein at least one of the file extents corresponds to file slack associated with the identified file.
13. The method of claim 12 , further comprising determining the file extents associated with the identified file, wherein identifying the file and determining the file extents associated with the identified file result from an examination of partition data to determine a file structure of the storage device, the partition data obtained by transmitting a request for partition data of the storage device to the target device over the network and receiving partition data for the storage device from the target device over the network.
14. The method of claim 13 , wherein the request is a read command for sector 0 of the storage device.
15. A non-transitory computer-readable medium comprising instructions for remotely, a remotely conducting computer investigations of a storage device coupled to the target device from a client device coupled to target device over a network, the target device having a servlet executing thereon, the instructions for:
identifying a file stored in the storage device;
transmitting a search key to the servlet at the target device over the network, the search key comprising a keyword;
transmitting file extents including a sector of the storage device and a count associated with the identified file to the servlet on the target device over the network, wherein in response to receipt of the search key and the file extents over the network, the servlet on the target device searches the coupled storage device for the search key received over the network only at the sector and count of the storage device identified by the file extents received over the network without opening the file and generates a search result, the search result identifying at least one sector on the storage device associated with a hit for the search key;
receiving the search result over the network from the target device;
determining one or more sectors of the at least one sector included in the search result to examine; and
sending a command to the servlet at the target device to retrieve the one or more sectors of the storage device; and
displaying the search result on a display device.
16. The non-transitory computer-readable medium of claim 15 , wherein the file extents identify sectors or blocks of the storage device.
17. The non-transitory computer-readable medium of claim 16 , wherein the location of the search result identifies one or more sectors or blocks of the storage device that include a match for the search key.
18. The non-transitory computer-readable medium of claim 15 , wherein the target device searches the coupled storage device without use of operating system utilities.
19. The non-transitory computer-readable medium of claim 15 , wherein at least one of the file extents corresponds to file slack associated with the identified file.
20. The non-transitory computer-readable medium of claim 19 , further comprising determining the file extents associated with the identified file, wherein identifying the file and determining the file extents associated with the identified file result from an examination of partition data to determine a file structure of the storage device, the partition data obtained by transmitting a request for partition data of the storage device to the target device over the network and receiving partition data for the storage device from the target device over the network.
21. The non-transitory computer-readable medium of claim 20 , wherein the request is a read command for sector 0 of the storage device.