Patent ID: 8825848
Filing Date: 2014-09-02
Classification: G06F,H04L

Abstract:
1. A method of ordering events captured by multiple forensic agents running in an electronic system, comprising: receiving, by a recording unit of the electronic system, multiple event records from the forensic agents, each event record including a set of timing information provided by the respective agent; storing the event records in the recording unit in the order received; resequencing the event records received by the recording unit based on the sets of timing information received from the forensic agents to at least partially reconstruct an order of events described in the event records across the forensic agents; and storing the resequenced event records in the recording unit, wherein the recording unit and the forensic agents each receive periodic timestamps from a timestamp server, wherein at least one forensic agent stores an event in a vector clock that records receipt of at least one of the timestamps from the timestamp server, the vector clock established among the forensic agents, and wherein resequencing the event records received by the recording unit includes correcting for timing errors in the event records based on differences between timestamps reported in the vector clock and timestamps received by the recording unit.