Digital memory imaging system and method

Abstract

A digital memory imaging system for imaging the digital memory of a target computer (1) comprising: a plurality of removable data storage devices (3, 5, 7, 9, 11, 13) each receivable by the target computer (1); an imaging means configured to image the digital memory of the target computer; an output means to output the imaged digital memory as a series of data blocks to two or more of the removable data storage devices (3, 5, 7, 9, 11, 13).

Claims

1. A digital memory imaging system for imaging the digital memory of a target computer comprising: a plurality of removable data storage devices each connectable to the target computer; and a software subsystem adapted to imaging the digital memory of the target computer; outputting the imaged digital memory as a series of data blocks to at least two of the removable data storage devices; and assigning each data block of imaged digital memory to the at least two of the removable data storage devices according to a queuing subsystem; and a display adapted to displaying an indicia of the removable data storage devices that are available for storing data blocks, displaying information about the status of imaging the digital memory into an image file, and displaying information when any one of the plurality of removable data storage devices is full, wherein the display is the display associated with the target computer; wherein each of the at least two of the removable data storage devices has a queue of data to be stored thereon that is constantly monitored by the software subsystem, wherein each data block of imaged digital memory is assigned based on one or both of the respective free memory available on each of the removable data storage devices and the respective speed of the removable data storage devices, and wherein the software leaves the target computer in a condition that is identical to its condition prior to imaging the digital memory.

2. A digital memory imaging system according to claim 1 wherein the plurality of removable data storage devices comprise any combination of a USB, an eSata external drive, an SD card, an SD micro card, an SSD drive, and a DVD drive.

3. A digital memory imaging system according to claim 1, the software subsystem further adapted to labelling each imaged data block with a header comprising any combination of a sequence number, a data block length, a source address, a compression value, a time stamp, and a unique identifier.

4. A digital memory imaging system according to claim 1, the software subsystem further adapted to detecting an interruption of the imaging of the digital memory and storing the imaged digital memory to the point of interruption.

5. A digital memory imaging method for imaging the digital memory of a target computer comprising the steps of: connecting a plurality of removable data storage devices to the target computer; executing software on one of the plurality of removable data storage devices for imaging the digital memory of the target computer; outputting the imaged digital memory as a series of data blocks to at least two of the removable data storage devices; assigning each data block of imaged digital memory to the at least two of the removable data storage devices according to a queuing system, wherein each of the at least two of the removable data storage devices has a queue of data to be stored thereon that is constantly monitored, and wherein assigning each data block of imaged digital memory is based on one or both of the respective free memory available on each of the removable data storage devices and the respective speed of the removable data storage devices; storing the assigned data blocks to the at least two of the plurality of removable data storage devices; displaying progress information relating to the imaging step, wherein the display is the display associated with the target computer; and disconnecting the plurality of removable data storage devices from the target computer, wherein the target computer is left in a condition that is identical to its condition prior to imaging the digital memory.

6. A digital memory imaging method according to claim 5 further comprising the step of labelling each imaged data block with a header comprising any combination of a sequence number, a data block length, a source address, a compression value, a time stamp, and a unique identifier.

7. A digital memory imaging method according to claim 5 further comprising the steps of storing the imaged digital memory at a point of interruption.

8. A digital memory imaging system according to claim 1, wherein the digital memory of the target computer is one or more of a hard disc, a flash memory, and a random-access memory (RAM).

9. A digital memory imaging system according to claim 1, wherein the software subsystem is stored on one of the plurality of removable data storage devices when the plurality of removable data storage devices are connected to the target computer, and wherein the one of the plurality of removable data storage devices containing the software subsystem is excluded from the at least one or more removable data storage devices that are used for assigning the data blocks of imaged digital memory.

10. A digital memory imaging method according to claim 5, wherein the digital memory of the target computer is one or more of a hard disc, a flash memory, and a random-access memory (RAM).

11. A digital memory imaging method according to claim 5, wherein the plurality of connected removable data storage devices comprise any combination of a USB, an eSata external drive, an SD card, an SD micro card, an SSD drive, and a DVD drive.

12. A digital memory imaging method according to claim 5, further comprising the step of executing a software stored on one of the connected plurality of removable data storage devices for imaging the digital memory of the target computer.

13. A digital memory imaging method according to claim 12, wherein the step of assigning each data block of imaged digital memory excludes assigning any data block to the one of the connected plurality of removable data storage devices executing the software.

14. A digital memory imaging system for imaging the digital memory of a target computer comprising: a plurality of removable data storage devices each connectable to the target computer; a software subsystem stored on and adapted to executing locally from one of the removable data storage devices upon connection to the target computer, wherein the software subsystem is further adapted to imaging the digital memory of the target computer; outputting the imaged digital memory as a series of data blocks to at least two of the removable data storage devices; and assigning each data block of imaged digital memory to the at least two of the removable data storage devices according to a queuing subsystem; and a display adapted to displaying an indicia of the removable data storage devices that are available for storing data blocks, displaying information about the status of imaging the digital memory into an image file, and displaying information when any one of the plurality of removable data storage devices is full, wherein each of the at least two of the removable data storage devices has a queue of data to be stored thereon that is constantly monitored by the software subsystem, wherein each data block of imaged digital memory is assigned based on one or both of the respective free memory available on each of the removable data storage devices and the respective speed of the removable data storage devices, wherein the software leaves the target computer in a condition that is identical to its condition prior to imaging the digital memory.

15. A digital memory imaging system according to claim 14, wherein the plurality of removable data storage devices comprise any combination of a USB, an eSata external drive, an SD card, an SD micro card, an SSD drive, and a DVD drive.

16. A digital memory imaging system according to claim 14, the software subsystem further adapted to detecting an interruption of the imaging of the digital memory and storing the imaged digital memory to the point of interruption.

17. A digital memory imaging method for imaging the digital memory of a target computer comprising the steps of: storing software on one of a plurality of removable data storage devices; connecting the plurality of removable data storage devices to the target computer; locally executing the software from the one of the plurality of removable data storage devices for imaging the digital memory of the target computer; outputting the imaged digital memory as a series of data blocks to at least two of the removable data storage devices; assigning each data block of imaged digital memory to the at least two of the removable data storage device according to a queuing system, wherein each of the at least two of the removable data storage device has a queue of data to be stored thereon that is constantly monitored, and wherein assigning each data block of imaged digital memory is based on one or both of the respective free memory available on each of the removable data storage devices and the respective speed of the removable data storage devices; storing the assigned data blocks to the at least two of the plurality of removable data storage devices; displaying progress information relating to the imaging step, wherein the display is the display associated with the target computer; and disconnecting the plurality of removable data storage devices from the target computer, wherein the target computer is left in a condition that is identical to its condition prior to imaging the digital memory.

18. A digital memory imaging method according to claim 17 further comprising the steps of storing the imaged digital memory at a point of interruption.

19. A digital memory imaging method according to claim 17, wherein the plurality of connected removable data storage devices comprise any combination of a USB, an eSata external drive, an SD card, an SD micro card, an SSD drive, and a DVD drive.

20. A digital memory imaging method according to claim 17, wherein the step of assigning each data block of imaged digital memory excludes assigning any data block to the one of the connected plurality of removable data storage devices executing the software.

Description

(1) These and other characteristics of the present technology will be more fully understood by reference to the following detailed description in conjunction with the attached drawings, in which:

(2) FIG. 1 is a block diagram of an example of the digital memory imaging system constructed in accordance with the present invention;

(3) FIG. 2a is a flow diagram of the digital memory imaging method of a first embodiment of the present invention;

(4) FIG. 2b is a flow diagram of the dynamic queuing carried out by the digital memory imaging method of a first embodiment of the present invention;

(5) FIG. 3 is flow diagram of the digital memory imaging method of an alternative embodiment of the present invention; and

(6) FIG. 4 is a graph illustrating the testing detailed in Appendix 2 showing transfer speed against read buffer size for various write buffer sizes on a typical mid-range system.

(7) The figures described herein, wherein like parts are designated by like reference numerals throughout; illustrate example embodiments of a digital memory imaging system and method according to the present technology. Although the present technology will be described with reference to the example embodiments shown in the figures, it should be understood that many alternative forms can embody the present technology.

(8) Referring to FIG. 1 and an example of the digital memory imaging system, the target computer 1, is able to receive multiple, removable data storage devices including any combination of USB 1.0, USB 2.0 and 3.0 drives 3; eSata external drives 5; SD and SD micro cards 7; FireWire drives 9; Thunderbolt drives 11 and PCI Express external drives 13. The target computer is understood to be a personal computer, a laptop, a tablet computer, or any similar device capable of connecting to a removable data storage device.

(9) A user having access to the target computer 1 introduces the digital memory imaging system to the target computer 1 via the USB 1.0, 2.0 or 3.0 drive 3 or similar device, 5, 7, 9, 11, 13. A USB drive 3 is connected to the target computer 1 and acts as a host device to allow the digital memory imaging method to be carried out.

(10) Referring to FIG. 2a, in a preferred embodiment of the digital memory imaging method, the digital memory imaging system is connected to the target computer in step 200 and the digital memory imaging method starts. In step 201 the system detects the data storage devices i.e. the physical, fixed digital memory (drive) devices to which the target computer's digital memory is to be imaged. For example, in step 201, the system detects that three USB 2.0 devices; two USB 3.0 devices and one PCIe USB 3.0 card are inserted into the target computer. In step 203 the system excludes the host storage device; for example the USB 2.0, USB 3.0 or similar removable data storage device on which the imaging system is stored. Thus, in the above example the system detects that one USB 2.0 device carries the digital memory imaging system and that the remaining two USB 2.0 devices; two USB 3.0 devices and one PCIe USB 3.0 card are to be used to image the target computer's hard disc (digital memory). It is understood that reference to the hard disc includes any form of digital memory, such as a flash memory or random access memory (RAM). Simultaneously in step 205, the system detects the logical drives i.e. the digital memory of the target computer.

(11) In step 207, the system collates and displays the devices and drives that it has previously detected. For example, the information is displayed on the target computer screen. In step 209, a user instructs the system to commence imaging of the target digital memory.

(12) The system then begins imaging the target digital memory by reading the memory sequentially in large data blocks. The data block size is pre-determined to ensure optimum performance for common device types. It has been found that a block size of 8 MB allows for an optimum balance between the memory capacity of the computer carrying out the method and the queue length for storing the data blocks across the multiple removable memory devices. For example, a small personal computer has a memory of around 512 MB and a data block size of 8 MB is small enough not to overload a target computer with memory of this size, whilst the data block size of 8 MB is large enough that usage of the central processing unit (CPU) is mostly kernel time such that processing is as efficient as possible.

(13) Referring to steps 211, 213, 215 the system proceeds so that as each block of data is read from the target digital memory in step 211 it is imaged and assigned for storage on one of the detected removable memory devices (RMD). The assignment is determined according to a hierarchical queuing system. Each removable memory device has a queue of data to be stored. The preferred data block size of 8 MB is selected to be compatible with the queue length to avoid output idling. In step 213 each block of data that is read is assigned to the shortest RMD queue. Each data block is thus assigned to the RMD currently having the least amount of data to store and/or the RMD with the greatest speed. This ensures maximum storage efficiency across the multiple removable memory devices. The queuing system is dynamic whereby the queue of each removable memory device is constantly monitored.

(14) Referring to FIG. 2b, the assignment of each data block starts at step 222 before the system reads the data block at step 224. At step 226, the system selects the next RMD output device and asks at step 228 whether this is the device having the shortest queue. If the device is detected to have the shortest queue at step 230, the data block is added to that queue, i.e. to be stored on that RMD. However, if the RMD does not have the shortest queue at step 228, the system moves to step 226 to select the next RMD in the list and again ask, at step 228, if this device has the shortest queue.

(15) When the system has repeated the necessary steps to arrive at the RMD with the shortest queue, it checks at step 230 whether the queue is sufficiently short to allow for efficient storage of the data block. If the queue is not sufficiently short and addition of the data block is likely to affect the efficiency of the system, the addition of the data block is delayed at step 232. If the queue is sufficiently short, the data block is added to the queue of the selected RMD, at step 234. At step 236, the dynamic queuing system continues to assign each data block in the same way until all of the data has been imaged and stored and the method ends, at step 238.

(16) Referring to FIG. 2a, the reading, imaging and storing of the target computer's digital memory continues until there is no more data to be read and at step 215 the end of the file (EOF) is detected. Thus, the imaging process continues until the entire target memory has been imaged and the method ends at step 220.

(17) Simultaneously with the reading and imaging storing process, 211, 213, 215, the system detects in step 217 if any of the data storage devices (RMDs) are full. Detection of a full data storage device will be indicated to a user via the system display. This gives a user the opportunity to remove the full device and replace with a new RMD having capacity for storage. The system also detects in step 217 if a new data storage device is inserted or if a full data storage device is removed or disconnected from the target computer. The system does not limit the number of removals/disconnections or insertions/connections of data storage devices in a single imaging process. Thus, there is no limit to the amount of data that can be imaged by the system of the present invention.

(18) As shown in FIG. 2a, the imaging process is continuous until the entire digital memory of the target computer has been imaged. During imaging the volume of data that has been imaged and the remaining amount of data to be imaged is monitored to avoid any shortages in memory capacity or any consequent reduction in the data transfer speed. In further embodiments of the invention read throttling and garbage collection are initiated at intervals during the imaging process where such processes have been shown to be most effective. Read throttling is initiated whenever the shortest of the RMD output queues contains 20 items. Garbage collection is done at the same time, when a new buffer cannot be supplied by the operating system.

(19) At step 220, when the imaging process is completed the data that has been collected will be converted into an image file. The user-interface provides suitable displays to prompt a user to initiate the conversion.

(20) Referring to FIG. 2a and step 211, the target data to be imaged is read in blocks. Each data block comprises a header of 4096 bytes, followed by the data segment to be imaged. The header comprises information as a text string with the following fields: i) Sequence number of the data block: (0, 1, 2, 3 . . . n); ii) Data length: byte count of the data segment. iii) Compression value: If this value is zero, then the data is uncompressed. If it is non-zero it refers to the technique used to compress the date segment. In the preferred embodiments of the present invention, compression is performed with a gzip algorithm; iv) Source address: the address on the target memory device from which the data block was extracted; v) Time stamp: Indicating when the data imaging started; vi) Unique identifier of the data collection run: A 16-byte Globally Unique Identifier (GUID) generated at the start of the data collection process.

(21) The sequence number and compression value are used when recombining the imaged data at step 220 to form an image file of the target digital memory. The time stamp and unique identifier allow the imaged data to be validated.

(22) In an alternative embodiment of the present invention, if a user does not have access to a host device carrying the digital memory imaging system, the method includes an additional step prior to step 201 wherein a blank USB device is connected to the target computer and the digital memory imaging system is downloaded via the Internet. The instructions as to how to download the system are provided separately to the USB or alternatively brief instructions are provided on the USB regarding access to download. It is envisaged that, in a preferred embodiment, a user will be authorised to access the system or given permission to download the system via a license provided on a USB device. The user will then be able to validate multiple removable data storage devices according to their requirements

(23) As illustrated by the test results shown in Appendix 1, the imaging speed is increased by effectively splitting the imaging process across multiple data storage devices connected to the target machine. The data storage devices can be inserted into each of the following ports in any combination: USB 1.0; USB2.0; USB3.0; PCIe; card slots; SD card slots; Apple FireWire and Apple Thunderbolt. With multiple data storage devices connected to the target machine, the drive image is effectively divided across the different ports and so different mainboard BUS channels. This increases the speed and efficiency of imaging and also enables the size of the target drive to be divided across several data storage devices.

(24) Referring to FIG. 3 and an alternative embodiment of the imaging system of the present invention, the above-described method can be carried out over multiple sessions because the method includes the option to start and stop the process as required. The alternative embodiment shown in FIG. 3 allows the user to stop and store imaging results before resuming the imaging method i.e. the system is placed on hold. At step 300 the imaging process is started and at step 301 the system creates a log file corresponding to the current location that is being imaged and the location is stored in the log file. At step 302 the system creates a master image file, where the imaged data will be stored. At step 303, before imaging commences the current location of the digital memory is set to the start.

(25) At step 304 the imaging process starts to image the digital memory of the target computer and the image results are stored into a working file. The position of the digital memory is incremented and indexed and the log file is updated as imaging progresses. For example, in a windows environment, each byte on a disc drive or solid state device (SSD) is indexed as consecutive number from zero with consecutive numbers in several separate ranges being used to index each byte in RAM. At step 305 the system monitors whether the imaging process is interrupted. If an interruption occurs, at step 306 the system monitors whether the process has been resumed. Following an interruption, at step 307 when the process is resumed the log file is used to direct the system to resume the imaging process from the point of interruption.

(26) The imaging method continues until, at step 308, the working image file is full. At step 309 the working file is added to the master image file and the working image file is cleared. Step 310 increments the digital memory location and the working file is updated accordingly. This process of updating the working file and checking for interruptions continues until, at step 311, the system reaches the end of the target digital memory, or the user stops the process. The process ends at step 312. If the user stops the process, the image result in the current working file is ignored and the user will have imaged only part of the target digital memory. Multiple master image files can be used if required and when a master image file reaches a pre-determined size a new master image file is created. This allows a user to collect a part of the digital memory in any one session and image the entire digital memory over multiple sessions.

(27) The above described embodiments have been given by way of example only, and the skilled reader will naturally appreciate that many variations could be made thereto without departing from the scope of the claims.

(28) Any values provided herein are illustrative and in no way limiting of the present invention. Upon reading the present specification, one of skill in the art will appreciate a wide variety of other parameters that can be used to implement the digital memory imaging system and method. All such alternatives and modifications are contemplated within the scope of the present invention as defined by the claims.

(29) Numerous modifications and alternative embodiments of the present invention will be apparent to those skilled in the art in view of the foregoing description. Accordingly, this description is to be construed as illustrative only and is for the purpose of teaching those skilled in the art the best mode for carrying out the present invention. Details of the invention may vary substantially without departing from the spirit of the present invention, and exclusive use of all modifications that come within the scope of the appended claims is reserved. It is intended that the present invention be limited only to the extent required by the appended claims and the applicable rules of law.

(30) It is also to be understood that the following claims are to cover all generic and specific features of the invention described herein, and all statements of the scope of the invention which, as a matter of language, might be said to fall therebetween.

APPENDIX 1

(31) By way of comparison, to illustrate the improved speed and efficiency of the present invention, set out in Table 1 is experimental data of the time taken to image a target hard drive using a single USB port using the known imaging technology, FTK Imager v3 1.3.2 Forensic Toolkit Imager, provided by AccessData Group, with the drive attached to the Tableau TD1 Forensic Duplicator provided by Guidance Software, Inc.

(32) TABLE-US-00001 TABLE 1 Tableau TD1 Drive Imager FTK Imager FTK Imager Time to (USB 2.0) (USB 2.0 Hard RAM Image Speed Time Speed Time Speed Laptop Drive CPU (GB) (mins) (GB/min) (min) (GB/min) (min) (GB/min) Test 1 Dell Hitachi Core i5 4 76 4.211 230.05 1.391 82.13 3.896 Latitude HTS7250 3380M (RTM) 32A7E630 Processor E6230 320 GB 7200 rpm Test 2 Dell Samsung Core i7 16 50.55 5.064 No USB 2.0 40.85 6.267 Alienware PM830 3920XM ports M18x 256 GB Processor SSD @ 3.1 GHz Test 3 Dell Samsung Core i5 4 77.80 4.113 224 1.429 84.58 3.783 Vostro HM320HJ 2410M 3450 320 GB Processor 7200 rpm @2.3 GHz

(33) Table 2 sets out experimental data of the time taken to image a target hard drive using the digital memory imaging system and method of the present invention, with a variety of ports being used to make use of a combination of data storage devices connected to the target machine.

(34) TABLE-US-00002 TABLE 2 Performance Laptop On Performance Time to Laptop Off Hard RAM Image Speed Time Speed Ports Laptop Drive CPU (GB) (mins) (GB/min) (mins) (GB/min) Used Test 1 Dell Hitachi Core i5 4 75.98 4.212 69.52 4.604 1 x Latitude HTS7250 3380M USB2.0 (RTM) 32A7E630 Processor 2 x E6230 320 GB USB3.0 7200 rpm Test 2 Dell Samsung Core i7 16 11.33 22.59 13.52 18.94 2 x Alienware PM830 3920XM USB3.0 M18x 256 GB Processor 1 x SSD @ 301 GHz eSATA Test 3 Dell Samsung Core i5 4 58.52 5.469 73.00 4.385 2 x Vostro HM320HJ 2410M USB2.0 3450 320 GB Processor 2 x 7200 rpm @2.3 GHz USB3.0 1 x PCIe USB3.0 Card
Comments on Test Results

(35) It can be seen that the present invention increases the speed and reduces the time taken in data imaging.

(36) With solid state devices (SSDs) the increases in the speed of imaging offered by the present invention are significant. The tests detailed herein show an imaging speed that is around 4-5 times faster than known devices.

(37) With reference to Test 2, conducted for an SSD drive, the prior art TD1 system imaged the drive in 50 minutes 33 seconds at a rate of 5.064 GB/min; the prior art FTK system imaged the drive in 40 minutes 51 seconds at a rate of 6.267 GB/min. The imaging system of the present invention imaged the drive in 11 minutes and 20 seconds at a much faster rate of 22.59 GB/min.

(38) The increase in imaging speed is in addition to the time saved because the present invention does not require the drive to be removed from the target computer, i.e. the system of the present invention allows for imaging of the digital memory of the target computer with the SSD drive remaining in situ in the computer. To allow for imaging of a spinning drive, i.e. a non-SSD drive, the prior art TD1 system requires the hard drive to be removed from the target computer and attached to the TD1 imager for imaging to take place. The removal typically takes at least 20 minutes in addition to the required imaging time. The drive then needs to be replaced without leaving signs of its removal/replacement. Some computers systems have their hard drives located behind screens or located in other inaccessible areas or indeed with tamper proof seals etc. making removal/replacement impossible in covert investigations.

(39) With reference to Test 3, conducted for a non-SSD, platter-based drive, the prior art TD1 system imaged the drive in 77 minutes 48 seconds at a rate of 4.113 GB/min and required 40 minutes for removal and replacement of the drive from the target computer. The present invention imaged the drive in 58 minutes 31 seconds at a rate of 5.469 GB/min without the need to remove the drive from the target computer.

(40) Test 3 also shows that the addition of an additional PCIe Express Card increases the USB 3.0 capability and increases the speed of imaging and so the efficiency of data extraction from the target device.

(41) In conclusion, the imaging system and method of the present invention have been shown to offer a significantly higher speed of imaging so that a significantly reduced imaging time is required.

APPENDIX 2

(42) To optimise imaging of the target digital memory, testing of transfer speed for varying read buffer size and write buffer size was carried out on a typical mid-range system. The system comprised an 8 GB memory, a Western Digital Green 5400 RPM disc and four USB 2.0 ports. Each test was carried out on the same machine with only the buffer size varied between tests. The results of this testing are summarised in [Table 3].

(43) TABLE-US-00003 TABLE 3 Write size: Read size: 0.031 0.06 0.125 0.25 1 1.5 2 3 4 8 32 0.031 10.98 14.33 75.89 17.52 16.06 16.48 23.87 0.125 51.4 51.5 73.69 19.08 20.75 1 76.14 77.2 75.42 28 21.27 2 76.87 79.22 78.62 77.13 77.69 26.94 25.55 19.6 3 77.93 77.53 77.78 27.13 4 76.2 78.15 77.4 76.33 29 6 77.89 77.99 78.2 77.47 8 77.18 76.4 76.1 78.5 77.93 75.92 77.9 27.1 26.1 10 77.8 12 78.22 79.16 78.32 16 75.79 80.63 80.14 79.22 76.27 77.21 79.3 78.82 77.81 76.24 32.29
Comments on Test Results

(44) From this testing it was concluded that provided the read buffer size is a multiple of the write buffer size then the transfer speed is satisfactory.