Method And System For Forensic Data Tracking

What is this patent about?

’840 is related to the field of data loss prevention and forensic computing. Enterprises face increasing pressure to protect sensitive data due to regulatory requirements and the rising need to understand data provenance. Existing security measures often fail to prevent breaches, especially when data leaks outside protected environments. Data Loss Prevention (DLP) tools can help, but they are not foolproof, leaving a need for systems that can track data movement even after it has left the authorized environment.

The underlying idea behind ’840 is to provide a method and system for tracking data elements as they are shared and moved between authorized and unauthorized devices and users. This involves scanning files, classifying them based on content, and then monitoring their movement even outside the direct control of the responsible organization. The system uses various techniques, including encoding files with hidden tracking mechanisms, to maintain visibility and auditability of sensitive information.

The claims of ’840 focus on a computing system that receives metadata about electronic files detected at an endpoint. This metadata includes the filename, creation/modification dates, data element tags, and an endpoint identifier. The system analyzes this metadata based on configured settings and policies to determine a data classification. Crucially, the system determines if the file is unauthorized due to a deviation from normal behavior , specifically an increase in the total number of files exceeding a user's average. Responsive actions are then performed.

In practice, the invention works by deploying software agents on endpoints that scan files and extract metadata. This metadata is sent to a central server where it is analyzed to identify policy violations or deviations from normal behavior. The system can then take actions such as deleting unauthorized files, moving them to a secure archive, or encoding them with tracking information. The encoding mechanisms , like transparent GIFs with embedded URLs, allow the system to track the file's movement even when it is opened on unregistered devices.

The invention differentiates itself from prior approaches by focusing on post-leakage tracking . While traditional DLP systems aim to prevent data from leaving the authorized environment, ’840 provides a mechanism to monitor and control data even after it has escaped those boundaries. This is achieved through the use of persistent tracking mechanisms embedded within the files themselves, allowing the system to identify unauthorized access and potential data breaches even when the data is in the hands of unauthorized users.