Automatic reconnect and reacquisition in a computer investigation system

• Main Authors: GARRETT MATTHEW STEVEN, STONE-KAPLAN KIMBERLY A
• Format: Patent
• Language: English
• Published: 23.01.2007
• Subjects: CALCULATING; COMPUTING; COUNTING; ELECTRIC DIGITAL DATA PROCESSING; PHYSICS

An examining machine automatically reconnecting to a target machine and resuming acquisition of data stored in a device coupled to the target machine. The examining machine establishes connection with the target machine and initiates data acquisition of the device coupled to the target machine. Periodically during the data acquisition, the examining machine receives from the target machine an intermediary hash state of the data that has been acquired so far. When connection is lost during the acquisition, the examining machine is able to automatically attempt reconnection to the target machine. Once the connection is automatically reestablished, the examining machine transmits the hash state that is currently saved for the acquisition to the target machine. The target machine may then continue the hash process from this intermediate state. That is, the target machine is able to continue generating a hash value for the entire acquisition without rehashing previously acquired data because that previously acquired data is already reflected in the intermediate hash state.