Abstract: Methods and apparatus for acquiring and analyzing digital forensic data using a computing device. Forensic data collections are retrieved by a computing device, and artifacts can be identified according to a variety of display types and presentation formats specified in an extensible format, to facilitate review and reporting by a user.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: A system and a method for locating populations of content-specific data portions. The method includes determining a current population of data portions to be searched based on at least one prioritization criterion; accessing the current population of data portions; examining at least one data portion of the current population of data portions and extracting content-specific data; comparing the content-specific data to at least one suspect criterion; determining whether the current population meets at least one population criterion by analyzing the content-specific data; determining at least one next population of data portions to be searched based on proximity to the current population; and determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

Abstract: Methods and apparatus for acquiring and analyzing digital forensic data using a computing device. Forensic data collections are retrieved by a computing device, and artifacts can be identified according to a variety of display types and presentation formats specified in an extensible format, to facilitate review and reporting by a user.

Abstract: A system and a method for locating populations of content-specific data portions. The method includes determining a current population of data portions to be searched based on at least one prioritization criterion; accessing the current population of data portions; examining at least one data portion of the current population of data portions and extracting content-specific data; comparing the content-specific data to at least one suspect criterion; determining whether the current population meets at least one population criterion by analyzing the content-specific data; determining at least one next population of data portions to be searched based on proximity to the current population; and determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

Abstract: Methods and apparatus for acquiring and analyzing digital forensic data using a computing device. Forensic data collections are retrieved by a computing device, and artifacts can be identified according to a variety of display types and presentation formats specified in an extensible format, to facilitate review and reporting by a user.

Abstract: A computer system, method, and device perform targeted acquisition of data. The system includes an examiner device having a processor and a memory, an agent in the form of an executable program for finding and transferring targeted data, and a target endpoint system. The examiner device is configured to deploy the agent to the target endpoint system. The agent is configured to establish a connection with the examiner device. The examiner device is configured to send a request for targeted data to the agent. The agent is configured to locate the targeted data on the target endpoint system. The agent is configured to transfer the targeted data to the examiner device.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: A computer system, method, and device perform targeted acquisition of data. The system includes an examiner device having a processor and a memory, an agent in the form of an executable program for finding and transferring targeted data, and a target endpoint system. The examiner device is configured to deploy the agent to the target endpoint system. The agent is configured to establish a connection with the examiner device. The examiner device is configured to send a request for targeted data to the agent. The agent is configured to locate the targeted data on the target endpoint system. The agent is configured to transfer the targeted data to the examiner device.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: A system and a method for locating populations of content-specific data portions. The method includes determining a current population of data portions to be searched based on at least one prioritization criterion; accessing the current population of data portions; examining at least one data portion of the current population of data portions and extracting content-specific data; comparing the content-specific data to at least one suspect criterion; determining whether the current population meets at least one population criterion by analyzing the content-specific data; determining at least one next population of data portions to be searched based on proximity to the current population; and determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

Abstract: A system and a method for locating populations of content-specific data portions. The method includes determining a current population of data portions to be searched based on at least one prioritization criterion; accessing the current population of data portions; examining at least one data portion of the current population of data portions and extracting content-specific data; comparing the content-specific data to at least one suspect criterion; determining whether the current population meets at least one population criterion by analyzing the content-specific data; determining at least one next population of data portions to be searched based on proximity to the current population; and determining the at least one next population of data portions to be searched based on the at least one prioritization criterion.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: Methods and apparatus for acquiring and analyzing digital forensic data using a computing device. Forensic data collections are retrieved by a computing device, and artifacts can be identified according to a variety of display types and presentation formats specified in an extensible format, to facilitate review and reporting by a user.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.