System and method for conducting searches at target devices
A method, apparatus and system for secure forensic investigation of a target machine by a client machine over a communications network. In one aspect the method comprises establishing secure communication with a server over a communications network, establishing secure communication with the target machine over the communications network, wherein establishing secure communication with the target machine includes establishing secure communication between the server and the target machine, installing a servelet on the target machine, transmitting a secure command to the servelet over the communications network, executing the secure command in the servelet, transmitting data, by the target machine, in response to a servelet instruction, and receiving the data from the target machine over the communication network.
1. A system for remotely conducting computer investigations of a storage device at a target device, comprising:
a device coupled to a target device over a network, the target device coupled to a storage device and having an application executing thereon; and
a non-transitory computer readable storage medium comprising instructions for:
initiating a key search at the target device by transmitting, by the device, a search key and one or more file extents to the application on the target device over the network, wherein the one or more file extents are associated with one or more sectors of the storage device coupled to the target device and the one or more sectors are at least a portion of sectors comprising a file,
the application on the target device configured to initiate the key search for the search key received over the network in response to receipt of the search key and the file extents, the key search searching the coupled storage device for the search key received over the network only at the sectors of the storage device associated with the received file extents without opening the file comprising the one or more sectors in an application associated with the file, and to generate a key search result, the key search result identifying at least one sector on the coupled storage device associated with a hit for the search key, and including an identification of at least one search key hit location in the at least one sector;
receiving the key search result over the network from the target device, the received key search result including the identification of the at least one search key hit location in the at least one sector, and
in response to receiving the key search result over the network from the target device:
determining a sector of the one more sectors to obtain from the target device based on the received key search result; and
sending a command to the application at the target device to retrieve the sector.
2. The system of claim 1 , wherein the file extents are included in an command for the application on the target device.
3. The system of claim 2 , wherein the command is a read command for sector 0 of the storage device.
4. The system of claim 1 , wherein the file extents are an identification of one or more files.
5. The system of claim 1 , wherein the key search result specifies a location within at least one file extent associated with the hit for the search key.
6. The system of claim 1 , wherein the search key is a keyword or a digital fingerprint.
7. The system of claim 1 , wherein the application is a servelet.
8. A computer implemented method for implementing on a computer having a hardware processor and a memory, the method for remotely conducting computer investigations of a storage device coupled to a target device from a device coupled to the target device, and the method comprising:
initiating a key search at the target device by transmitting, by the device, a search key and one or more file extents to an application on the target device over the network, wherein the one or more file extents are associated with one or more sectors of the storage device coupled to the target device and the one or more sectors are at least a portion of sectors comprising a file,
the application on the target device configured to initiate the key search for the search key received over the network in response to receipt of the search key and the file extents, the key search searching the coupled storage device for the search key received over the network only at the sectors of the storage device associated with the received file extents without opening the file comprising the one or more sectors in an application associated with the file, and to generate a key search result, the key search result identifying at least one sector on the coupled storage device associated with a hit for the search key, and including an identification of at least one search key hit location in the at least one sector;
receiving the key search result over the network from the target device, the received key search result including the identification of the at least one search key hit location in the at least one sector, and
in response to receiving the key search result over the network from the target device:
determining a sector of the one more sectors to obtain from the target device based on the received key search result; and
sending a command to the application at the target device to retrieve the sector.
9. The method of claim 8 , wherein the file extents are included in an command for the application on the target device.
10. The method of claim 9 , wherein the command is a read command for sector 0 of the storage device.
11. The method of claim 8 , wherein the file extents are an identification of one or more files.
12. The method of claim 8 , wherein the key search result specifies a location within at least one file extent associated with the hit for the search key.
13. The method of claim 8 , wherein the search key is a keyword or a digital fingerprint.
14. The method of claim 8 , wherein the application is a servelet.
15. A non-transitory computer-readable medium comprising instructions for remotely conducting computer investigations of a storage device coupled to a target device from a device coupled to the target device over a network, the instructions for:
initiating a key search at the target device by transmitting, by the device, a search key and one or more file extents to an application on the target device over the network, wherein the one or more file extents are associated with one or more sectors of the storage device coupled to the target device and the one or more sectors are at least a portion of sectors comprising a file,
the application on the target device configured to initiate the key search for the search key received over the network in response to receipt of the search key and the file extents, the key search searching the coupled storage device for the search key received over the network only at the sectors of the storage device associated with the received file extents without opening the file comprising the one or more sectors in an application associated with the file, and to generate a key search result, the key search result identifying at least one sector on the coupled storage device associated with a hit for the search key, and including an identification of at least one search key hit location in the at least one sector;
receiving the key search result over the network from the target device, the received key search result including the identification of the at least one search key hit location in the at least one sector, and
in response to receiving the key search result over the network from the target device:
determining a sector of the one more sectors to obtain from the target device based on the received key search result; and
sending a command to the application at the target device to retrieve the sector.
16. The non-transitory computer-readable medium of claim 15 , wherein the file extents are included in an command for the application on the target device.
17. The non-transitory computer-readable medium of claim 16 , wherein the command is a read command for sector 0 of the storage device.
18. The non-transitory computer-readable medium of claim 15 , wherein the file extents are an identification of one or more files.
19. The non-transitory computer-readable medium of claim 15 , wherein the key search result specifies a location within at least one file extent associated with the hit for the search key.
20. The non-transitory computer-readable medium of claim 15 , wherein the search key is a keyword or a digital fingerprint.
21. The non-transitory computer-readable medium of claim 15 , wherein the application is a servelet.