Hawaii International Conference on System Sciences

Embodiments of the invention relate to systems, methods, and computer program products for improved file identification. Embodiments herein disclosed provide for a file scanning tool that receives input related to compromised information in a structured data file and scans databases, servers, systems, or computers throughout a company for origin structured data files that contain the same or similar information as the compromised information in the structured data file. The file scanning tool then outputs the location of the origin structured data files that have the same or similar information. The file scanning tool can be used for various purposes, especially as a tool for investigators trying to determine if other information from the same location could have been compromised, the responsible parties, and the contact information of customers whose information was compromised, so the company can notify customers if their account information has changed.

File scanning tool

Digital forensics has become a critical part of almost every investigation, and users of digital forensics tools are becoming more diverse in their backgrounds and interests. As a result, usability is an important aspect of these tools. This paper examines the usability aspect of forensics tools through interviews and surveys designed to obtain feedback from professionals using these tools as part of their regularly assigned duties. The study results highlight a number of usability issues that need to be taken into consideration when designing and implementing digital forensics tools.

/pdf/usability-of-forensics-tools-a-user-study-1klv7xduj3.pdf

Usability of Forensics Tools: A User Study

Embodiments of the invention relate to systems, methods, and computer program products for electronic discovery and, more particularly, remotely collecting a custodian's data that is stored in one or more network storage areas residing on a network. For example, embodiments of the present invention utilize a collection tool to access a mailbox residing on an email server, copy at least some of the active email data stored in the mailbox, and transmit the copied active email data from the mailbox to a collection server and then to a long-term storage device.

Active email collector

Embodiments of the invention relate to systems, methods, and computer program products for improved electronic discovery. More specifically, embodiments relate to monitoring or otherwise "watching" the online and/or offline activity of specified computing devices in an enterprise wide electronic discovery system. By determining when a computing device is online/offline and notifying a requesting party of the online/offline status, the requesting party knows when the specified device is available for electronic discovery functions, such as collecting data from the computing device or the like. The monitoring application of the present invention eliminates the need for the requesting party to wait for prolonged periods of time for a computing device to come online or to randomly attempt to find a computing device on line.

Monitoring an enterprise network for determining specified computing device usage

The subject of digital forensics can be quite challenging. Digital forensics is in its infancy and teaching digital forensics includes the techniques as well as the tools that assist in the process. This article discusses the tools used in computer forensics, compares an open source tool to two commercial tools, and the advantages and disadvantages of all three tools in an academic environment. A team of four senior students sponsored by two faculty members established the project scope and requirements, presented three prototypes, and detailed the considerations of using open source tools. The same image was used to measure the performance of each software tool. The team found that the three tools provided the same results with different degrees of difficulty. The end results indicate that open source tools are a very good verification of evidence found using other products and should be included in the academic environment

/pdf/is-the-open-way-a-better-way-digital-forensics-using-open-39309v5zab.pdf

A. Gyger

Papers

Is the Open Way a Better Way? Digital Forensics Using Open Source Tools