Patent ID: 11895125
Assignee: QUICKVAULT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 18:
19. A method related to computing forensics, the method comprising:
transmitting machine-executable instructions to one or more network devices comprising one or more processors and one or more memories, wherein the machine-executable instructions are stored in the one or more memories, and wherein the machine-executable instructions when executed by the one or more processors enable the one or more network devices to:
receive meta data associated with an electronic file stored at an endpoint, the meta data comprising:
one or more of a file name of the electronic file, a creation date on which the electronic file was created, a modification date on which the electronic file was modified, a data element tag, and
an endpoint identifier that is usable to identify the endpoint on which the electronic file is stored;

analyze the meta data based on one or more of a configured setting and a policy;
determine a pattern of data activity that constitutes a deviation from a normal pattern of data activity, wherein the deviation from the normal pattern of data activity is determined by detecting a significant number of new electronic files compared to historical activity for one or more of a user, a set of users, and the endpoint; and
perform one or more responsive actions related to determining the pattern of data activity that constitutes the deviation from the normal pattern of data activity.